Risk-based unhosted wallet verification now includes Satoshi Test

At a glance

What this is: Sumsub has added automated Satoshi Test microtransaction verification to its unhosted wallet ownership checks, extending coverage to four accepted proof methods.

Why it matters: For IAM and compliance teams, this shows how wallet ownership proof is becoming a governance control, not just a transaction convenience, with implications for NHI-style verification, policy routing, and regulated access decisions.

By the numbers:

• Sumsub's State of the Crypto Industry 2026 report finds that 74% of crypto firms now prioritize verification accuracy.

👉 Read Sumsub's update on Satoshi Test wallet verification

Context

Unhosted wallet verification is the control problem of proving that the person initiating a crypto transfer actually controls the wallet being used. In regulated environments, that matters because peer-to-peer transfers can bypass the normal oversight points that exchanges and custodians provide, leaving policy teams to rely on ownership proof instead of platform custody.

The primary identity issue here is not human login assurance but transaction-time verification of wallet control. That places the problem squarely in NHI governance, where proof method, risk policy, and workflow integration have to line up before value moves on-chain.

Sumsub's update matters because it closes a practical gap between policy intent and operational execution: firms need multiple acceptable verification paths, not a single brittle method. The broader pattern is familiar across identity programmes, where the control that matters most is the one that can be enforced inside the live flow rather than after the fact.

Key questions

Q: How should security teams handle wallet ownership verification in regulated crypto flows?

A: They should bind ownership proof to the transaction itself, not treat it as a separate administrative check. The strongest pattern is policy-driven verification inside deposit and withdrawal workflows, with method choice based on jurisdiction, wallet type, and transfer risk. That keeps the control auditable while reducing manual reconciliation.

Q: Why do unhosted wallets create more governance risk than custodial wallets?

A: Unhosted wallets remove the intermediary that normally provides identity, oversight, and recordkeeping. That means firms must prove wallet control directly and make the proof part of the compliance decision. Without that, the organisation is relying on assumptions about ownership that are not visible or enforceable.

Q: What breaks when wallet verification happens outside the transfer flow?

A: The control becomes easy to bypass, hard to audit, and weakly connected to the actual movement of funds. A check that happens after the decision or on a separate channel cannot reliably prevent illicit transfers. Governance then lags execution, which is where compliance failures start.

Q: Who is accountable for unhosted wallet verification decisions?

A: Accountability sits with the VASP and its compliance and identity governance functions, because they define the policy, the approved proof methods, and the transaction gate. Regulators expect firms to show that their verification model is risk-based, documented, and consistently enforced across jurisdictions.

How it works in practice

Satoshi Test and wallet ownership proof in Travel Rule flows

The Satoshi Test, also called microtransaction verification, uses a small, time-bound transfer from the wallet being verified to prove control of that wallet. Unlike static declarations, it gives the service a live signal that the originator can sign or move value from the address being checked. In Travel Rule workflows, that signal is useful because the verification happens before the deposit or withdrawal is allowed to continue. The control is not about trust in a user profile, but about tying a transaction to the wallet that created it.

Practical implication: Use time-bound wallet proof as part of the approval path for regulated transfers, not as a separate after-the-fact check.

Why multiple ownership methods matter for risk-based policy

Sumsub says its solution now covers four commonly accepted ownership proof methods: digital signature, self declaration, screenshots, and the Satoshi Test. That matters because no single method fits every jurisdiction, wallet type, or risk threshold. A risk-based programme needs the ability to select stronger proof when the transfer context is higher risk and lighter proof when policy allows it. The technical challenge is less about the method itself than about orchestration, because the verification method has to map cleanly to the transfer decision.

Practical implication: Build policy routing that selects the verification method based on jurisdiction, wallet type, and transfer risk, not just user convenience.

Embedded verification and control-flow enforcement

The material difference in this update is that verification is embedded directly into deposit and withdrawal flows. That removes manual reconciliation steps and makes wallet ownership proof part of the transaction state, rather than a parallel review process. This is important in compliance operations because control value drops when a check happens outside the execution path that moves funds. Embedded controls also make it easier to preserve legitimate user experience while still enforcing review, which is where many crypto compliance controls fail in practice.

Practical implication: Prefer controls that block or gate the transaction itself, because off-platform checks are easier to bypass and harder to audit.

NHI Mgmt Group analysis

Wallet ownership verification is becoming an identity governance control, not a screening control. The practical issue is not simply whether a wallet can be checked, but whether the check is bound to the transfer decision itself. Once verification sits inside the transaction flow, it starts to function like a policy-enforced access decision for value movement. For practitioners, that shifts the control question from screening to governed authorisation.

Risk-based proof selection is the right model for unhosted wallets. Different wallets, jurisdictions, and transfer conditions justify different assurance levels, and a single verification method creates avoidable friction or blind spots. The most mature pattern is to treat ownership proof like policy routing: stronger proof when the risk is higher, lighter proof only where the control objective still holds. Practitioners should align proof strength to the transaction context, not to a one-size-fits-all workflow.

Unhosted wallet controls sit at the intersection of NHI governance and regulated transfer oversight. The same governance discipline used for service accounts and other non-human identities applies here: define the identity subject, prove control, bind the proof to a workflow, and keep the lifecycle auditable. That makes wallet verification less like a point solution and more like a policy-backed identity check for machine-mediated value transfer. Practitioners should manage it as part of the broader NHI control surface.

Embedded verification exposes the identity blast radius of weak transaction design. When ownership checks happen outside the transfer path, the organisation loses control over when verification occurs and what it actually protects. This creates a gap between compliance intent and operational enforcement that attackers and fraud patterns can exploit. The practitioner lesson is that wallet verification must be enforced where the value moves, or it will remain a paper control.

Cross-jurisdiction Travel Rule alignment depends on control adaptability, not one fixed proof method. The article points to an environment where firms must satisfy different regulatory expectations without rebuilding the workflow each time. That favours policy-driven orchestration over static compliance scripts. Practitioners should expect wallet ownership verification to evolve into a configurable control layer tied to jurisdiction, risk, and transfer type.

From our research:

• 74% of crypto firms now prioritize verification accuracy, according to The 2024 ESG Report: Managing Non-Human Identities.
• From our research: 92% of organisations expose NHIs to third parties, raising supply-chain governance concerns, according to Ultimate Guide to NHIs , Key Challenges and Risks.
• From our research: For practitioners building governed verification flows, the next step is to align wallet proof with broader lifecycle controls in Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.

What this signals

Wallet ownership proof is moving into the same governance category as non-human identity verification. Teams that already manage API keys, service accounts, and token lifecycles should recognise the pattern quickly: policy is only real when it is enforced in-flow, with clear approval logic and audit evidence. The control boundary is no longer the wallet alone, but the workflow that authorises the transfer.

Identity blast radius is now a compliance metric. If a wallet relationship can be trusted too broadly, too long, or across too many jurisdictions, the organisation has created avoidable exposure in its transfer governance. The useful question is not whether verification exists, but whether it can be varied, logged, and revoked with the same discipline as other non-human access.

With 92% of organisations exposing NHIs to third parties, the broader lesson is that delegated control paths are becoming the dominant risk surface for regulated automation. That makes governed ownership checks, auditable policy routing, and lifecycle-linked revocation the practical baseline, not advanced maturity.

For practitioners

• Map wallet ownership proof to transfer risk Define when digital signatures, self declaration, screenshots, or microtransaction verification are acceptable. Tie each method to jurisdiction, wallet type, and transaction value so the workflow reflects policy rather than habit.
• Embed checks in the transfer path Block deposit or withdrawal progression until ownership proof is completed and validated. Avoid separate manual review queues for the core control, because off-platform checks are harder to audit and easier to bypass.
• Set audit rules for proof method selection Log which verification method was used, why it was chosen, and which policy rule allowed it. Keep that record alongside the transaction so compliance teams can explain assurance decisions later.
• Treat unhosted wallets as governed identity subjects Create lifecycle rules for trusted wallet relationships, including review, revocation, and exception handling. Use the same governance discipline you would apply to non-human identities that can initiate value-moving actions.

Key takeaways

• Unhosted wallet verification is a governance control, because it proves control of a wallet before value moves through a regulated workflow.
• The scale signal is clear: 74% of crypto firms now prioritise verification accuracy, which shows the control problem is already mainstream.
• Teams should enforce wallet proof inside the transfer path, with risk-based method selection and auditable policy routing.

Key terms

• Unhosted Wallet: A wallet that is controlled by the user rather than by a custodian or exchange. In governance terms, the organisation cannot rely on an intermediary's identity controls and must instead verify wallet control directly before permitting regulated transfers.
• Satoshi Test: A microtransaction-based ownership proof method that uses a small, time-bound transfer to confirm control of a wallet. It is useful where the organisation needs a live verification signal tied to the transaction flow rather than a static declaration or screenshot.
• Travel Rule Workflow: The regulated transfer process that collects, verifies, and exchanges required information for virtual asset transactions. For non-custodial wallets, the workflow must also prove wallet ownership so compliance checks are enforced before funds move.
• Risk-Based Verification: A control approach that adjusts assurance strength to the context of the transaction, such as jurisdiction, wallet type, and value at stake. It avoids one-size-fits-all checks and lets firms apply stronger proof where the compliance and fraud risk is higher.

Deepen your knowledge

Unhosted wallet verification and risk-based transfer controls are covered in the NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building governed proof flows for regulated transfers, it is worth exploring.

This post draws on content published by Sumsub: the addition of automated Satoshi Test verification to its Unhosted Wallet Verification solution. Read the original.