According to the latest Google Play Developer Policy update, cryptocurrency wallet providers operating in more than fifteen jurisdictions—including the United States and the European Union—must now obtain licenses and comply with relevant industry standards.
In practical terms, this means that any custodial cryptocurrency wallet provider seeking to list their application in these jurisdictions must first register and file with the appropriate regulatory bodies, obtaining approval before distribution. Non-custodial wallets are exempt from this policy.
A non-custodial wallet does not store a user’s cryptocurrency with the wallet provider. Instead, software or hardware wallets—such as Ledger and MetaMask—generate wallets where users retain sole control over their mnemonic phrases or private keys. If these keys are lost, the provider cannot assist in recovering the assets.
By contrast, a custodial wallet is typically provided by a cryptocurrency exchange, where the user’s assets are held and managed by the platform. Access is granted through account credentials and identity verification, and the exchange may freeze assets or disclose the user’s identity to legal authorities in accordance with applicable laws.
In the United States, oversight is provided by the Financial Crimes Enforcement Network (FinCEN). Custodial wallet providers must register after meeting specific requirements, including the implementation of a real-time, written Anti-Money Laundering (AML) program—an obligation that extends well beyond standard Know Your Customer (KYC) checks.
Within the European Union, custodial wallet providers must comply with legislation governing Crypto-Asset Service Providers (CASPs). To operate, they must register as a CASP in an EU member state and fulfill multiple regulatory obligations.
In Hong Kong, custodial wallet providers must enter the licensing regime of the Securities and Futures Commission (SFC), obtaining both Type 1 (dealing in securities) and Type 2 (providing automated trading services) licenses. Acquiring these licenses entails submitting extensive documentation and implementing rigorous compliance measures.
In these regulated jurisdictions, custodial wallet developers who fail to secure the required registrations and licenses will be barred from releasing updates or listing their applications on Google Play. Existing versions may also be subject to removal from the store.
Related Posts:
- FBI, CISA, NSA Warn of Iranian Cyberattacks on Critical Infrastructure
- $20 Million Drained and Returned: Government Wallet Under Scrutiny
- VMware Sues Siemens: Unlicensed Software Use Alleged
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.