Bank, Exchange or Wallet: Who Holds the Keys to Your Crypto?

There are several ways to hold digital assets, including through a bank offering crypto services, a centralised exchange or a personal wallet. On screen, these arrangements can look similar. What separates them is who controls the private keys, how the assets are held and what protections apply if something goes wrong.

Three Models, One Question

A private key is used to sign transactions, allowing someone with the necessary credentials to move crypto assets. Despite the name, a crypto wallet does not actually store the assets themselves. It manages the keys used to access and transact with balances recorded on a blockchain.

With a self-custody wallet, you control the private keys rather than relying on a custodian to manage them. Access depends on protecting those keys and any recovery information. Anyone who obtains that sensitive information may be able to access the assets.

The responsibility also changes. You must manage security precautions that a custodial provider would otherwise handle, including protecting recovery information and checking transactions before approving them.

A centralised exchange works differently. It provides a platform for buying and selling digital assets, often with liquidity and trading tools. Many exchanges use custodial accounts, where the platform controls the private keys. Your account balance reflects holdings recorded by the provider rather than assets held at a blockchain address you independently control. The precise ownership rights and custody arrangements depend on the provider's terms and applicable rules.

Where Banks Fit In

Some banks and bank-linked financial institutions provide access to digital assets alongside traditional financial services. What they can offer depends on their regulatory permissions and business model. In Dubai, for example, VARA's public register lists banks among its licensed providers, with authorised activities that include virtual asset custody and broker-dealer services.

Another practical difference is account integration. Where supported, customers may be able to buy and hold crypto through their existing banking relationship rather than transferring funds to an outside exchange. This depends on the institution and is not available from every bank. Convenience is not evidence that one arrangement is safer than another.

Consider a simple example. You hold a fixed amount of a digital asset.

Through a bank offering custodial crypto services, the holding may appear alongside your other investments, with custody handled by the bank or an appointed provider. On an exchange, your holdings may be maintained through wallets controlled by the platform, including pooled arrangements. With a self-custody wallet, you control the credentials needed to authorise transactions.

Now suppose the exchange experiences a security breach, insolvency or operational disruption. Your access to assets held through that platform could be restricted.

With self-custody, access generally does not depend on the exchange remaining operational, provided you retain the necessary credentials and the relevant blockchain network continues functioning.

But the risk does not disappear. Lost or exposed keys, incorrect transfers and malicious transaction approvals can still result in irreversible losses.

Common Misunderstandings and What to Verify

One mistake is assuming all three models come with the same protections. They do not. Protections vary by provider, jurisdiction, product and the legal arrangement under which assets are held.

Another mistake is assuming that every wallet provides self-custody. Some wallets are custodial, meaning another party controls the keys. A personal wallet only provides independent key control when it uses a self-custody arrangement.

For UAE readers, regulatory status deserves particular attention. Depending on the activity and jurisdiction, relevant authorities include Dubai's Virtual Assets Regulatory Authority (VARA), the federal Capital Market Authority (CMA, formerly the Securities and Commodities Authority), the Dubai Financial Services Authority (DFSA) in the DIFC, the Financial Services Regulatory Authority (FSRA) in ADGM, and the Central Bank of the UAE for activities within its remit, including regulated payment-token services.

Their official resources can help readers check a provider's regulatory status and authorised activities:

• VARA Public Register
• Capital Market Authority (CMA)
• DFSA Public Register
• ADGM FSRA Public Register
• CBUAE Register of Licensed Financial Institutions

For example, VARA distinguishes between providers holding full licences and those with in-principle approval. An in-principle approval does not authorise a provider to begin regulated virtual asset operations.

Before relying on any custody arrangement, it helps to check:

• Who controls the private keys, and what legal arrangement governs the assets.
• Whether the provider is licensed or otherwise authorised for the specific service being offered.
• Whether customer assets are segregated and what happens if the custodian becomes insolvent.
• What fees apply to trading, custody and transfers.
• Whether insurance or other protections exist, what they cover and what exclusions apply.
• Whether withdrawals are subject to restrictions, approval procedures or holding periods.
• What recovery options exist if access credentials are lost or compromised.

A provider's regulatory authorisation does not eliminate the risk of losing digital assets. Likewise, using a personal wallet does not automatically make holdings secure.

Each model answers the same underlying question differently: who controls access, who manages security and who carries the consequences if something fails.

Understanding those differences is more useful than comparing account interfaces or assuming that familiar financial terminology guarantees the same protections.

Key Takeaways

Banks offering crypto custody, centralised exchanges and self-custody wallets differ in who controls the private keys, how assets are held and what protections may apply.

Custodial services place important access and security responsibilities with a provider. Self-custody gives users greater direct control but also makes them responsible for protecting their credentials and authorising transactions.

UAE readers can check a provider's regulatory status and authorised activities through official regulator sources, and review custody arrangements, fees, insurance coverage and withdrawal conditions in the provider's own terms.

Sources: Ethereum.org Accounts, Ethereum.org Security, US SEC Investor Bulletin, VARA, UAE Legislation: Federal Decree-Law No. 32 of 2025, Capital Market Authority, DFSA, ADGM FSRA, Central Bank of the UAE, CBUAE Register.

Disclaimer: This content is for educational and informational purposes only. It is not legal, financial, investment, cybersecurity, medical, business, career, or other professional advice. Verify important information with official sources or qualified professionals before acting.