Self-custody versus exchange

Coins on an exchange are a claim on the exchange; coins in a wallet the reader controls are the reader’s to lose. The FIU register says nothing about custody. This page explains what a reader should look for in an exchange’s terms about segregation and withdrawals.

Who holds the keys

In a self-custody wallet, the reader holds the private keys. The keys are a secret that allows the holder to move the coins. If the reader loses the keys, the coins are lost. If the reader keeps the keys safe, no one else can move the coins without the keys. The reader is the only one responsible for the security of the keys.

On an exchange, the exchange holds the keys. The reader has a login and a password, but the exchange controls the coins. The reader’s balance is a claim on the exchange, not a direct holding. If the exchange is hacked, goes bankrupt, or freezes withdrawals, the reader may lose the coins. The exchange’s promise to return the coins is only as good as the exchange.

What a claim on an exchange is worth

A claim on an exchange is worth whatever the exchange can pay. If the exchange is solvent and honest, the claim is worth the amount of coins. If the exchange is not, the claim may be worth less, or nothing. The exchange may hold the coins in its own wallets, or it may hold them with a custodian. The reader does not know, unless the exchange says so in its terms.

The FIU register says nothing about custody. A provider can be on the register and still hold coins insecurely. The register records that the provider has reporting duties, not that it has good custody. A reader who leaves coins on an exchange is trusting the exchange to return them. That trust should be based on the exchange’s terms, not on its registration.

What to look for in an exchange’s terms about segregation

An exchange’s terms should say whether client assets are segregated from the exchange’s own assets. Segregation means the exchange keeps client coins in separate wallets or accounts, so that if the exchange fails, the client coins are not used to pay the exchange’s debts. The terms should also say who holds the keys to those wallets, and whether the exchange uses a third-party custodian.

A reader should look for a clear statement that client coins are segregated and that the exchange does not lend them out without permission. If the terms are silent on segregation, the reader should ask. The absence of a statement is a fact. The FIU register does not require segregation, so a registered exchange may or may not segregate. The reader must check the terms.

What to look for in an exchange’s terms about withdrawals

An exchange’s terms should state the conditions under which a reader can withdraw coins. The terms should say whether withdrawals are processed automatically or manually, how long they take, and whether there are limits. The terms should also say whether the exchange can freeze withdrawals, and under what circumstances. Some exchanges reserve the right to freeze withdrawals if they suspect fraud or money laundering; that is common, but the terms should be clear.

A reader should be wary of an exchange that does not publish withdrawal terms. If the terms are vague, the reader may not be able to get coins out when needed. The reader should also check whether the exchange has a history of freezing withdrawals, but that information is not on the FIU register. The register is silent on withdrawals.

The trade-off between convenience and control

An exchange is convenient: the reader can buy and sell quickly, and the exchange handles the security of the keys. But the reader gives up control. If the exchange is hacked, the reader may lose coins. If the exchange freezes withdrawals, the reader cannot move coins. A self-custody wallet gives control, but the reader must handle security. Losing the keys means losing the coins, and there is no customer support to recover them.

The choice between exchange and self-custody is a personal one, based on the reader’s risk tolerance and technical skill. This site does not tell a reader which to choose. It explains what each one means and what to look for in the terms. The FIU register does not help with this choice, because it says nothing about custody.

What the FIU register does and does not say about custody

The FIU register lists providers that have registered as reporting entities under the anti-money-laundering law. It does not state where a provider keeps its coins, how it secures them, or whether it segregates client assets. The register is not a custody rating. A reader cannot tell from the register whether a provider is a good custodian.

A reader who wants to know about custody must read the provider’s terms and any public statements about its custody arrangements. The reader should ask whether the provider uses cold storage, whether it has insurance, and who holds the keys. The answers are not on the FIU register. The register is one fact, not a substitute for due diligence.

A self-custody mistake can delete coins in a way no exchange failure can

When you hold your own keys, a single error in writing down or storing your recovery phrase can make the coins unreachable forever. There is no support desk that can reset your phrase, and no regulator that can order the blockchain to reverse a transaction. This is a different kind of loss from an exchange freezing withdrawals; it is silent and often discovered only months later when you try to move the coins.

The most common mistake is keeping the phrase in a place that is lost, damaged, or seen by someone else. A phone photo, a note in a messaging app, or a sheet of paper left in a drawer all carry risks that an exchange password reset does not. Some users split the phrase into parts and store them in different places, but that can backfire if one part is lost and the rest become useless.

Before moving any amount to self-custody, practice with a small sum and go through the full recovery process on a separate device. If you cannot restore a wallet from its phrase without help, you are not ready to hold a meaningful balance. The discipline of testing recovery once is cheaper than learning about it after a loss.

An exchange can change withdrawal rules at a time that suits it, not you

When your coins sit on an exchange, the platform controls the withdrawal queue, the fees, and the minimum amounts. During a market panic or a regulatory action, an exchange may suspend withdrawals for hours or days, and you have no way to force the coins out. This is not a technical failure but a business decision that the terms of service usually allow.

The practical consequence is that you cannot plan a sale or a transfer as if the coins were in your own wallet. If you need to pay someone or move funds by a deadline, an exchange hold can break that plan. Some platforms also impose higher withdrawal fees when network traffic rises, and you have to accept the charge or leave the coins where they are.

Readers who hold coins on an exchange should read the terms about withdrawal suspension and fee changes. The key question is whether the platform must give notice before changing rules, or whether it can act immediately. A clause that says the exchange may restrict withdrawals 'in its sole discretion' is a warning that the exit door can close without warning.

A claim on an exchange is a claim on a private ledger, not on the blockchain

When you buy crypto on an exchange and leave it there, your balance is an entry in the exchange's internal database. You do not have a blockchain address under your control for those coins, and you cannot prove ownership to anyone outside the exchange. If the exchange's ledger is wrong, or if it chooses to freeze your account, your only route is through its customer service and legal process.

This distinction matters in insolvency. If an exchange goes into liquidation, you are an unsecured creditor unless the terms create a trust or a segregated custody arrangement that survives bankruptcy. The coins may be pooled with other assets, and the liquidator may take months to determine who gets what. In contrast, coins in your own wallet are outside the exchange's estate and cannot be claimed by its creditors.

Before leaving coins on an exchange, check the terms for language about 'beneficial ownership' and 'custody'. Some platforms state that you remain the owner, but that statement is only as good as the legal structure behind it. If the terms say the exchange holds coins on your behalf as a bailee, that is weaker than a trust; if they say the coins are part of the exchange's assets, you are lending to the platform.

A hardware wallet does not remove risk; it moves it to a different place

A hardware wallet keeps your keys offline, which protects against remote hacking of your computer or phone. But it introduces a physical object that can be lost, stolen, or damaged. If you lose the device and do not have the recovery phrase, the coins are gone. If someone finds the device and knows or guesses your PIN, they can sign transactions.

The security of a hardware wallet also depends on the supply chain and the software you use with it. A device bought from an unauthorised seller may have been tampered with before it reached you. The wallet's companion app may have a vulnerability that leaks your balance or transaction history. None of these risks are present when you simply hold coins on a reputable exchange, but the exchange brings its own set of risks.

A practical order of operations for a reader moving to self-custody is: buy the hardware wallet directly from the maker, set it up as new, write the recovery phrase on paper, and store that paper in a fireproof and waterproof container. Do not type the phrase into any website or app, and do not photograph it. Then send a small test amount, wipe the device, and restore from the phrase to confirm the backup works.

The tax treatment of a loss in self-custody is harsher than a loss on an exchange

India's flat-rate tax on crypto gains applies to any transfer of a virtual digital asset, regardless of where the asset is held. If you lose coins through a self-custody mistake, that loss is not a transfer and cannot be set off against any gain. You simply have fewer coins, and the tax law does not recognise the loss as a deductible event. An exchange failure that results in a loss of coins is treated the same way.

This asymmetry means a self-custody error can be more expensive than an exchange hack in terms of tax consequences. When an exchange is hacked and you lose coins, you may still owe tax on any earlier gains you realised, but you cannot deduct the lost coins. When you lose a hardware wallet, the same rule applies. The tax law does not care how the coins were lost; it only cares that you no longer have them.

A reader who holds coins in self-custody should keep a record of the acquisition cost and the date of acquisition, even if no tax is due until a sale. If the coins are later lost, that record will not save you any tax, but it will help you explain the disappearance if the tax department asks. The absence of a loss deduction is a reason to be extra careful with self-custody, not a reason to avoid it entirely.