Crypto● Neutral
Proof of Address Ownership: The €1,000 Crypto Withdrawal Rule
MiCA requires exchanges to verify you own your wallet address on withdrawals over €1,000. Here are the methods, the timing trap, and how to avoid the queue.
Continue with
Anyone moving crypto-assets from an exchange to a self-custodied wallet has, since the MiCA transition period ended, run into an intermediate step that does not arise on a transfer to another exchange: the provider wants to know whether the destination address really belongs to you. This is neither obstruction nor a house rule. It is an obligation under the European transfer of funds regulation, set out in Article 14(5) of Regulation (EU) 2023/1113. It bites above €1,000, and it falls on the provider, not on you.
The consequence for you is nonetheless a very practical one. When a withdrawal deadline is running, when an exchange is winding down or a token is pulled from trading, you want your balance moved to your own wallet quickly. That is exactly the moment proof of ownership inserts itself, and depending on the method chosen it costs you minutes or several hours. Knowing beforehand what may be demanded, and what your wallet needs to be capable of, saves that time.
The term everything turns on is defined in Article 3(20) of Regulation (EU) 2023/1113. A “self-hosted address” is a distributed ledger address that is not linked to a crypto-asset service provider, nor to an entity established outside the Union providing comparable services.
What matters is therefore not the physical form of the wallet but whether a service provider sits behind the address. A hardware wallet falls under the definition, a software wallet on your own machine does too, and so does a paper address whose key you have never stored digitally. The deposit address of a second exchange, by contrast, is not a self-hosted address, even where it has been assigned to you personally. On a transfer between two exchanges the two houses pass the prescribed information to each other; the question of proof never arises there.
The wording is short and unambiguous in its aim. On a transfer to a self-hosted address, the originator’s crypto-asset service provider collects the prescribed information on originator and beneficiary, retains it, and ensures that the transfer can be individually identified. Where the amount exceeds €1,000, the substance is added: the provider then takes appropriate measures to establish whether that address is owned or controlled by the originator.
Two points here are routinely skimmed over. First, the regulation speaks of “ownership or control” and not of proof of identity; what is being tested is the link between you and one specific address, not your person all over again. Second, Article 14(8) sets a hard sequence: the provider shall not allow a transfer to be initiated or executed before full compliance with the article is assured. As long as the proof is missing, the withdrawal does not go out. That is why a withdrawal sometimes sits in the queue with no visible error.
The €1,000 threshold applies solely to the qualified determination of ownership or control. The information requirement itself has no lower limit. Under Article 14(1), the information on the originator includes the name, the distributed ledger address, the account number of the crypto-asset account and the address including the country, together with the number of an official personal document and the customer identification number, or failing that the date and place of birth. Paragraph 2 requires the corresponding information on the beneficiary.
On a transfer to your own wallet you are both parties in one person, originator and beneficiary. That is why the process feels unremarkable from where you sit: the exchange already holds the data and enters it itself. The rule only becomes visible above the threshold, because a step is added there that only you can perform. Anyone withdrawing smaller amounts regularly will rarely meet it; anyone clearing out an account will meet it almost every time.
Under Article 14(6) the provider additionally verifies the accuracy of the information on the originator on the basis of documents, data or information obtained from a reliable and independent source. Paragraph 7 makes clear that this verification counts as done where your identity has already been established under the anti-money laundering rules and the data retained. On an account that has been through full verification, that part is therefore settled before you trigger the withdrawal. At an exchange holding a European authorisation it is a precondition of the account in any case, and a look at the comparison of regulated crypto exchanges shows which houses meet that framework for European customers.
The threshold is a euro amount; the transfer consists of crypto-assets. How the two are brought together is governed by the European Banking Authority’s travel rule guidelines (EBA/GL/2024/11), applicable since 30 December 2024. Paragraph 82 records that the provider uses the exchange rate of the crypto-asset to be transferred at the time of the transfer in order to determine its value in euro, irrespective of any transaction fees.
In practice that means the decisive moment is the withdrawal itself, not the point at which you bought, and not the amount net of the network fee. A holding that sat clearly below the threshold at purchase can cross it on the way out. Splitting a withdrawal into several smaller ones is no advisable way around it either, since providers are independently obliged to detect and assess unusual transaction patterns.
The return leg is governed symmetrically. Under Article 16(2) of the regulation, on a transfer from a self-hosted address the beneficiary’s provider collects the same information and retains it; where the amount exceeds €1,000, it too takes appropriate measures to establish whether the address is owned or controlled by the beneficiary. Paragraph 3 further requires it to verify the information on the beneficiary before making the crypto-assets available.
Anyone bringing holdings back out of self-custody onto an exchange in order to sell there should plan for this. The credit can hang until the proof is in, and it does so precisely in a situation where speed is usually the point. The procedure is the same as in the opposite direction, except that the check now sits on the receiving side.
The regulation says that a check must happen, but not how. Paragraph 83 of the EBA guidelines fills that gap. Providers should apply at least one of five verification methods to assess whether a self-hosted address is owned or controlled by the originator or the beneficiary.
Those named are unattended verification procedures under the EBA guidelines on the use of remote customer onboarding solutions, with the address stated; attended procedures under the same guidelines; sending a predefined amount from or to the self-hosted address to an account of the provider; asking the customer to digitally sign a specific message with the key belonging to the address; and other suitable technical means, provided they allow a reliable and secure assessment.
Which method is used is, under paragraph 84, the provider’s decision, taken on three considerations: the technical capabilities of the self-hosted address, the robustness of the assessment a method can deliver, and the money laundering and terrorist financing risk. Paragraph 85 adds that a combination of several methods should be applied where one alone is not reliable enough. You have no claim on that choice, but you can expect the two middle variants to dominate in practice.
Under this method the provider sets an amount, preferably the smallest denomination of the crypto-asset in question, and you send it from the self-hosted address to an account of the provider. If the payment arrives from exactly that address, control is taken as demonstrated. With bitcoin the smallest unit is a satoshi, which is why the industry often names the procedure after it.
The advantage is that the method works with practically any wallet, since sending is something every wallet can do. The drawback is the time it takes. You need a confirmation on the network in question, and you pay a network fee for it that can exceed the micro-amount transferred many times over. Anyone going through the procedure for the first time should not count on completing the actual withdrawal within the same quarter of an hour.
A second point concerns the order of events. The micro-amount has to come from the address you later intend to use as the destination. With wallets that generate a fresh address for every receipt this is a trap: the address you use for the proof and the address the wallet displays for the withdrawal can diverge. A look at the settings of your hardware wallet before the first proof saves you repeating the whole exercise here.