What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To verify a service’s “non-custodial” claim, trace where each asset is held and test what the service’s permissions let it do. Identify the broker, custodian, exchange, wallet, or contract involved; read the actual account and API permissions; and find out who controls crypto keys and transaction signing. A service may not hold assets directly yet still have authority to trade or transfer them. The label alone does not establish that a service is safe, insured, regulated, or unable to move your money.
What does “non-custodial” mean for an investment service?
There is no single test that applies to every asset type or jurisdiction. For a securities or brokerage account, focus on who holds the assets and what authority the automation provider has. The SEC describes investment-adviser custody as “holding client funds or securities, directly or indirectly, or having the authority to obtain possession of them.” Its guidance treats withdrawal authority as significant, while distinguishing authorized trading from broader powers to dispose of assets. Read the SEC’s custody guidance.
For crypto, the key question is who controls access to the private keys and who can authorize transactions. The SEC says that with self-custody, the investor has sole control over access to the keys; a third-party custodian manages and controls that access. A service can provide an interface to a wallet without holding its keys, but that does not prove that every other company or component in the investment arrangement is also non-custodial.
Start by naming the asset and the arrangement: conventional securities, cash, crypto assets, tokenized securities, or a mix. An answer about a brokerage connection does not settle how a crypto wallet works, and a wallet’s key setup does not establish who holds linked cash or securities.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Where are the assets held, and whose account is it?
Ask the provider to identify the legal entity that holds each asset and the account or wallet in which it sits. Depending on the product, that may be a broker-dealer, bank, custodian, crypto exchange, wallet, smart contract, or an account controlled by the service. Get the custodian’s full legal name and contact information, then compare the answer with the account-opening documents and statements.
For a securities account, check whose name appears on the account and whether statements come directly from the custodian. Request the advisory agreement, power of attorney, and any standing authorization—not just a marketing description of the connection. SEC guidance says advisers with custody generally must use a qualified custodian, subject to limited exceptions, and should tell clients who the custodian is and how assets are held. That guidance concerns investment advisers and should not be read as a universal rule for every investment app.
Can the service withdraw or transfer my money?
Read the authorization at the institution that holds the assets. In a brokerage account, determine whether the service can only place trades in your account or can also withdraw cash or securities, change destination instructions, write checks, or dispose of assets outside authorized trading. In an exchange connection, inspect the actual API scopes shown by the exchange rather than relying on a “read-only” or “trade-only” label.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For a wallet connection, examine what each approval enables. Check whether the provider can transfer assets to an address it chooses, whether each transfer needs your separate signature, and whether a contract gives a delegated operator or administrator additional powers. A trading permission is not the same as withdrawal permission, but broad powers to dispose of assets deserve particular scrutiny.
Also test revocation: find the control that disables an API key, account authorization, or wallet approval, and establish whether you can use it without the provider’s help. The exact mechanism varies by platform, so confirm it in that platform’s documentation and, where possible, verify that access has actually been removed.
Who holds my crypto private keys?
Ask who generated the keys, where they are stored, who can access encrypted or decrypted key material, and who can sign or co-sign transactions. A public address is not a private key: it can receive assets and help verify transactions, but it cannot authorize one. The SEC’s crypto custody bulletin explains the difference and the responsibilities that come with self-custody. Losing a key can mean permanently losing access to the assets.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check the transaction-signing flow rather than stopping at the wallet’s name. Establish who must approve a transaction, whether the provider can co-sign, and who controls any recovery phrase, signing device, contract administrator, or delegated operator. If a hardware wallet is part of the setup, it may reduce exposure to internet cyberthreats, but it can still be lost, damaged, or stolen; owning one does not by itself verify the service’s custody claims.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe SEC Trading and Markets staff statement dated April 13, 2026 describes a self-custodial wallet, for purposes of its limited discussion, as one where neither the wallet provider nor its associated covered interface has custody of or access to the user’s encrypted or decrypted private key. The statement concerns specified interfaces preparing user-initiated transactions in crypto asset securities, not every wallet, investment automation service, or type of security. Read the statement and its scope.
What happens to assets if the service or custodian fails?
Ask how client holdings are separated from the provider’s own property and what process returns them if the provider, custodian, or exchange fails. Get clear answers on whether assets can be lent, used as collateral, rehypothecated, or commingled, and whether your consent is required. Find out what any insurance actually covers and excludes, who pays the fees, and what transfer or account-closure charges apply. These are diligence questions, not guarantees that a particular arrangement is protected.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For crypto custody services within MiCA’s scope in the EU, Article 75 requires a client position register and custody policy, procedures for returning assets, and segregation of client holdings from the provider’s holdings; it also addresses liability for certain attributable losses. These provisions are specific to in-scope EU providers, not a global standard. See MiCA Article 75.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should I compare services’ custody claims?
Use the same evidence checklist for every provider. Record the answers in writing, and compare them with the permissions visible in the connected account or wallet.
| Check | Evidence to obtain | What an unclear answer leaves unresolved |
|---|---|---|
| Asset location | Legal name and role of each broker, bank, custodian, exchange, wallet, or protocol; account name and relevant statements. | Who holds the asset and which entity’s rules or protections may apply. |
| Withdrawal and transfer power | Account authorization, power of attorney, API scopes, wallet approvals, and signing requirements. | Whether the provider can move or dispose of assets beyond placing authorized trades. |
| Key and signing control | Who generated, stores, accesses, and can use key material; who can co-sign or administer a contract. | Whether the wallet is genuinely self-custodial and who can authorize transactions. |
| Use and segregation of assets | Written terms on lending, collateral, rehypothecation, commingling, and separation from provider property. | How assets may be used and how they would be handled in a failure. |
| Transparency and revocation | Agreements, statements, fee and conflict disclosures, permission logs, and the steps to revoke access. | Whether the service’s disclosures match its actual authority and whether you can end that authority. |
Confirm the legal entity behind the product, its regulatory status for the activity it performs, and the identity of any separate custodian. Compare written disclosures with the permissions you can see. Review fees, conflicts, venue relationships, use of trading information, and cybersecurity disclosures where relevant. The SEC’s April 2026 interface statement identifies role, fee, conflict, cybersecurity, and venue disclosures for the interfaces within its stated scope; it is not a blanket finding about all investment services.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should I read current SEC custody statements?
The SEC fact sheet dated October 1, 2026 describes proposed custody-rule amendments, not rules that are already in force. The proposal would allow adviser self-custody of crypto under stated conditions, including safeguarding expertise, systems addressing private-key management, joint authorization by at least two people, and separate client crypto addresses. Do not treat those proposed conditions as current requirements for every service. Read the SEC proposal fact sheet.
The SEC’s investor bulletins are educational guidance, not a substitute for reviewing the specific agreement and permissions. The 2025 crypto custody bulletin says it is not a rule, regulation, or Commission statement and creates no new obligations. Legal treatment depends on the asset, the provider’s actual authority and operations, and the jurisdiction involved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
