Plain answer
Exchange custody and self-custody move responsibility to different places. Compare the failures each choice must prevent and survive.
“Should I keep crypto on an exchange or move it to a wallet?” sounds like a question with one safe answer.
It is not. Each choice removes some risks and introduces others.
An exchange account can make access, trading and recovery simpler, but the user depends on the provider. Self-custody gives the holder direct control of the keys, but mistakes, theft and lost backups become their responsibility.
The useful comparison is not convenience versus purity. It is which failures you are equipped to prevent and survive.
The plain-English answer
A cryptoasset is recorded on a blockchain. A wallet does not literally contain the coins. It manages the private keys used to authorise transactions involving the relevant blockchain addresses.
With a custodial exchange account, the provider normally controls the keys and keeps an internal record of what it owes the customer. With self-custody, the user controls the keys through wallet software or a hardware device.
Control and responsibility travel together:
- exchange custody means trusting the provider’s security, solvency, controls and access process;
- self-custody means trusting your own security, backups and ability to recognise a dangerous transaction.
If the basic asset is unfamiliar, start with what a cryptoasset is.
What “on an exchange” usually means
When crypto is bought through a centralised exchange and left in the account, the customer commonly sees a balance in the provider’s system. The provider may combine customer assets in blockchain addresses it controls rather than creating a separate on-chain address for every line in every account.
The practical advantages can include:
- a familiar login and account-recovery process;
- easy buying, selling and currency conversion;
- no need to handle a recovery phrase for that account; and
- customer support when access problems occur.
The dependency is equally important. Withdrawals can be delayed or stopped. An account can be frozen after a security or identity check. A provider can suffer a cyberattack, operational failure or insolvency. The customer may have a contractual claim without having direct ability to move the underlying asset.
Two-factor authentication and withdrawal controls can reduce account risk, but they do not remove provider risk.
What self-custody changes
In self-custody, the user holds the credentials needed to authorise transactions. A software wallet may keep keys on a phone or computer. A hardware wallet aims to keep signing keys isolated from an internet-connected device.
The advantages can include:
- less dependence on an exchange remaining available;
- direct ability to transfer the asset on-chain; and
- clearer separation between trading access and long-term custody.
But there may be no helpdesk capable of reversing a mistake. Risks include:
- losing the device and the backup;
- exposing a recovery phrase;
- installing malicious wallet software;
- signing a transaction or smart-contract approval that steals assets;
- sending to the wrong address or network; and
- leaving no workable access plan for illness, incapacity or death.
Self-custody is not risk-free custody. It replaces institutional dependencies with operational responsibility.
Exchange versus self-custody: responsibility matrix
| Question | Custodial exchange account | Self-custody wallet |
|---|---|---|
| Who normally controls the private keys? | Provider | User |
| Who manages day-to-day security? | Shared: provider secures custody; user secures account access | User, device and wallet setup |
| Password or access recovery | Provider process may help | Recovery depends on the user’s backup design |
| Provider insolvency or withdrawal freeze | Direct exposure | Less direct exposure once assets are withdrawn correctly |
| Lost recovery phrase | Usually not relevant to the exchange account | Can cause permanent loss if no safe backup exists |
| Mistaken on-chain transfer | Often irreversible once sent | Often irreversible once sent |
| Trading convenience | Usually high | Often requires a transfer to a venue or decentralised service |
| Main human risk | Phishing, weak login security and misplaced trust in provider | Phishing, unsafe backups, malicious approvals and irreversible mistakes |
The matrix does not pick a winner. It reveals where responsibility sits.
Is an FCA-registered crypto exchange “approved”?
No. As checked on 31 August 2026, the FCA’s current cryptoasset registration regime is focused on anti-money-laundering and counter-terrorist-financing requirements. The FCA says applicants must not present an application as an endorsement or recommendation. A firm appearing as registered under that regime therefore should not be mistaken for an FCA safety approval or for the protections attached to many regulated investment activities.
The FCA says the application period for relevant permissions runs from 30 September 2026 to 28 February 2027, before the new regime starts on 25 October 2027. That future framework should not be described as if it already protects an account today.
Check the current FCA register and warnings before using a provider, but do not turn registration into a safety guarantee.
Does the FSCS protect crypto held on an exchange?
The Financial Services Compensation Scheme says it does not protect cryptoassets. If an exchange or wallet provider fails, a customer should not assume the scheme will return the crypto or compensate the loss.
Some businesses offer services alongside crypto that may have different regulatory treatment. Protection depends on the specific activity and claim, not merely on the brand displaying an FCA reference number.
This distinction belongs beside Edition 2’s lesson on risks that are distinctive in crypto. Price volatility is obvious. Custody, access and legal protection can determine whether a quoted value is usable at all.
A safer way to make the choice
Begin with capability rather than ideology.
For an exchange account, ask:
- Is the firm on the relevant FCA register, and have I checked the exact legal entity?
- How does it describe custody, segregation and insolvency treatment?
- Can withdrawals be restricted, and under what terms?
- What account security and withdrawal allow-list controls are available?
- Have I tested a small withdrawal rather than assuming it works?
For self-custody, ask:
- Can I verify the wallet source and update process?
- Can I create and store backups without photographing or cloud-syncing a recovery phrase?
- Can I test recovery with a small amount before relying on it?
- Can I recognise the address, network, fee and permissions before signing?
- Is there a secure, understandable access plan if I cannot act?
A split arrangement can reduce dependence on one failure point, but it also creates more systems to understand and maintain. Complexity is not automatically diversification.
Small tests matter
Crypto transactions are often difficult or impossible to reverse. A careful process uses small, verified steps:
- confirm the destination address and network through a trusted route;
- send a small test amount;
- wait for it to arrive and confirm control;
- review the remaining address again before sending more; and
- keep recovery material separate from everyday devices and messages.
Never enter a recovery phrase because a supposed support agent asks for it. Whoever obtains that phrase may be able to control the wallet.
The useful conclusion
An exchange can reduce the burden of key management while adding reliance on a provider. Self-custody can reduce that provider dependency while making the holder responsible for security, recovery and every signed instruction.
Neither choice changes the market price. Both can determine whether the holder can realise it.
That completes Edition 3’s chain: fees reduce the balance, spreads change the tradable quote, execution changes the fill, dilution changes the ownership claim and custody changes control. The headline value is only the beginning of the outcome.
Sources
- FCA: Crypto basics — consumer risks and the limits of regulatory protection.
- FCA: How to apply for cryptoasset registration — current MLR registration scope and the warning against presenting an application as an endorsement.
- FCA: The UK’s cryptoasset regime — the planned broader regime and commencement date.
- FCA: What you need to do when preparing for the new cryptoasset regulatory regime
- FSCS: Cryptoassets — are they covered, and what’s the risk? — cryptoasset-specific explanation that FSCS does not protect cryptoassets.
This article is general financial education, not personal advice or a recommendation of an exchange, wallet or cryptoasset. Regulatory information was checked on 31 August 2026 and may change.