Sources checked 10 November 2026. This page explains the questions a company can expect when it moves bitcoin between a provider and its own wallet, and what evidence helps. It is not legal or compliance advice and not a recommendation to buy, sell or hold bitcoin. Providers set their own procedures within the law, so yours may ask for more. If anything here conflicts with a linked source, the source wins.
Short answer
When a company withdraws bitcoin from an exchange or broker to its own 2 of 3 multisig, or sends bitcoin back to the provider to sell, the provider may ask whose wallet it is. In the UK this comes from the Travel Rule in Part 7A of the Money Laundering Regulations, which since 30 June 2026 uses an £800 threshold for some requests and lets a provider hold back incoming bitcoin until it has the information it asked for. In the US the Funds Travel Rule applies to transmittals of $3,000 or more between financial institutions, and providers run their own anti-money laundering checks on withdrawals to unhosted wallets. Keep a short ownership pack for each company wallet so these questions take minutes, not days.
When the questions come
| Movement | What the provider may ask | What helps |
|---|---|---|
| First withdrawal to a new company address | Whose wallet it is, whether the company controls it, and the purpose. | The ownership pack below, and a small test withdrawal first. |
| Regular withdrawals under a schedule | Usually less, once the address is known and saved in the account. | Using the same verified addresses through the provider's address book or allow list, with two people approving changes. |
| Deposit from the company multisig to sell | Where the bitcoin came from, and confirmation the sending wallet is the company's. | The withdrawal history linking those coins to earlier purchases, and the same ownership pack. |
| Bitcoin received from another business | The name of the sender, and possibly more. | The invoice or contract, and the sender's details. See taking bitcoin as payment. |
Choose your country for the rules behind those questions.
UK: the Travel Rule and unhosted wallets
Part 7A of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 applies to cryptoasset transfers, apart from some excluded cases. The FCA says that from 1 September 2023 UK cryptoasset businesses must collect, verify and share information about cryptoasset transfers, known as the Travel Rule, and that firms remain responsible for compliance even when they use third-party suppliers.
Source: legislation.gov.uk: Money Laundering Regulations 2017, regulation 64A: application of Part 7A (cryptoasset transfers), FCA: Expectations for UK cryptoasset businesses complying with the Travel Rule.
Regulation 64B defines an unhosted wallet as software or hardware that enables a person to store and transfer a cryptoasset on their own behalf, and in relation to which a private cryptographic key is administered by that person. An unhosted wallet transfer is a transfer from an unhosted wallet to the cryptoasset business of a beneficiary, or from the cryptoasset business of an originator to the unhosted wallet of a beneficiary. A company's own 2 of 3 multisig, with keys held by its keyholders, fits that description. Our judgement, not a rule: a collaborative arrangement where a provider holds one of three keys may be treated differently by different providers, so ask yours.
Regulation 64G says a cryptoasset business involved in an unhosted wallet transfer may request from its customer information listed in regulation 64C(5) that it does not already hold: the names of the originator and beneficiary, the registered name if a firm, and the account number or a unique transaction identifier. Where the transfer, taken together with linked transfers, is worth £800 or more and the customer is the beneficiary, it may also ask for further information about the originator. The £800 figure was substituted on 30 June 2026 by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026.
Source: legislation.gov.uk: Money Laundering Regulations 2017, regulation 64G: requesting information for unhosted wallet transfers (£800 from 30 June 2026), legislation.gov.uk: Money Laundering Regulations 2017, regulation 64C: information accompanying an inter-cryptoasset business transfer.
The provider decides whether to ask by reference to its own risk assessment, taking account of factors including the purpose and nature of the relationship and the transfer, the value, how often the customer makes transfers and how long the relationship has lasted. If it does not receive information it has requested, regulation 64G(4) says it must not make the cryptoasset available to the beneficiary. For a company, that means a deposit from its own multisig can sit unavailable at the provider until the questions are answered, which matters if the sale has a deadline.
US: the Funds Travel Rule and FinCEN guidance
Under 31 CFR 1010.410(f), a transmittor's financial institution or intermediary financial institution in the United States must include specified information, such as the transmittor's name, account number and address, the amount and date, and the recipient's financial institution, in any transmittal order for a transmittal of funds of $3,000 or more. FinCEN's 2019 guidance on convertible virtual currency says transactions in it qualify as transmittals of funds and may fall within this Funds Travel Rule, which a money transmitter must meet before or at the time of the transmittal.
Source: eCFR: 31 CFR 1010.410(f): the Funds Travel Rule for transmittals of $3,000 or more, FinCEN: FIN-2019-G001: business models involving convertible virtual currencies (PDF).
The same guidance describes hosted wallets, where a provider controls the funds, and unhosted wallets, where the user does. It says that a person using an unhosted wallet to transact on their own behalf is not a money transmitter, and that with an unhosted multisig wallet the value belongs to the owner and a provider of an additional key does not have total independent control over it. A withdrawal to the company's own multisig has no receiving financial institution in the chain. The provider still runs its anti-money laundering programme and sanctions screening on the withdrawal, so it may ask about the destination wallet in the same way as a UK provider.
Source: FinCEN: FIN-2019-G001: business models involving convertible virtual currencies (PDF), US Treasury OFAC: Sanctions compliance guidance for the virtual currency industry (October 2021, PDF).
US states that license virtual currency businesses can add requirements of their own. See US rules and insurance.
The wallet ownership pack
Our judgement, not a rule: providers vary in what they accept, but the following usually answers the question quickly. Keep one for each company wallet, with the company records, not with the recovery material.
- A one-page statement on company letterhead: the company name and number, the wallet type (for example, a 2 of 3 multisig held by named keyholders), and the receiving address or addresses the company will use with this provider.
- The board minute or policy extract that authorises the wallet and names the keyholders. See key ceremony for how the wallet was set up.
- Proof of control, if asked. Some providers ask for a message signed with the wallet's keys, others for a small deposit from the wallet. BIP 322 describes a generic signed message format that can cover multisig; it needs the signers to coordinate, and wallet support varies. See proof of control.
- The test transaction. The transaction ID of the small first withdrawal, and confirmation that it arrived in the company wallet as shown on its signing devices.
- The purchase history for coins being sent back to the provider, linking them to the original purchases and withdrawals.
Source: Bitcoin BIPs: BIP 322: Generic signed message format (proof of funds, multisig).
Share single receiving addresses, not the wallet's configuration file or extended public keys. The configuration file lets anyone who has it see every address and balance in the wallet. Give a provider only what it needs for the transfer in front of it. See steel backups for multisig for why the configuration file matters.
Controls on the provider side
- Use the provider's address book or withdrawal allow list, if it has one, so that withdrawals can only go to the company's verified addresses.
- Require two people to add or change an allowed address, and keep any delay the provider applies to new addresses switched on.
- Verify each new address on the company's signing devices, not from an email, chat or screen. See check on the device.
- Withdraw in batches set by the policy, not after every purchase. See scheduled buying policy.
- Allow time before any sale for a deposit to be released, and do not rely on bitcoin being available at the provider the moment it confirms.
Common questions
Does the Travel Rule stop a company holding its own bitcoin?
No. It sets out what information providers collect and share. Companies can still withdraw to their own multisig; they may need to answer questions first.
Is the £800 a limit on how much can be withdrawn?
No. It is the value at or above which a UK provider may ask for certain extra information about the originator, under regulation 64G(1)(b), counting linked transfers together.
Will the provider see the company's whole wallet?
It sees the addresses it sends to or receives from, and can follow those on the public blockchain. Sharing the configuration file would show it everything, which is not needed.
Common mistakes
- Sending a large first withdrawal to a new address with no test and no ownership statement ready.
- Sending the provider the wallet configuration file or extended public keys as proof of ownership.
- Withdrawing to a keyholder's personal wallet, so the provider correctly sees a different owner.
- Depositing to sell on the day the money is needed.
- One person able to add a new withdrawal address alone.
Read next
- Buying bitcoin as a company, providers, checks and the test transaction.
- Sending bitcoin safely, addresses, tests and approvals.
- Multisig for a company, how the 2 of 3 works.
- Audit evidence, proof of control and records.
- Rules and insurance, the wider UK and US rules.
- UK crypto regime from October 2027, what changes for providers next.
Sources
Primary sources only. Each link was checked on 10 November 2026. Rules change, so confirm the current version with your adviser.
- legislation.gov.ukMoney Laundering Regulations 2017, regulation 64A: application of Part 7A (cryptoasset transfers)
- FCAExpectations for UK cryptoasset businesses complying with the Travel Rule
- legislation.gov.ukMoney Laundering Regulations 2017, regulation 64B: interpretation, including unhosted wallet and unhosted wallet transfer
- legislation.gov.ukMoney Laundering Regulations 2017, regulation 64G: requesting information for unhosted wallet transfers (£800 from 30 June 2026)
- legislation.gov.ukMoney Laundering Regulations 2017, regulation 64C: information accompanying an inter-cryptoasset business transfer
- eCFR31 CFR 1010.410(f): the Funds Travel Rule for transmittals of $3,000 or more
- FinCENFIN-2019-G001: business models involving convertible virtual currencies (PDF)
- US Treasury OFACSanctions compliance guidance for the virtual currency industry (October 2021, PDF)
- Bitcoin BIPsBIP 322: Generic signed message format (proof of funds, multisig)
One email. The whole library.
Policy checklist, board paper, recovery drill record, document pack and the rest, in one send. Then one short Thursday lesson for small companies in the UK and the US.
Free. One email with the whole template library, then one short lesson each Thursday. Unsubscribe at any time. See our privacy notice.
This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.
Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.
Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.