Direct Cryptocurrency Ownership: Custody, Keys, Exchanges and Security

Risk Warning: Cryptoassets are largely unregulated in the UK. Directly held cryptocurrency is highly unlikely to be covered by the Financial Services Compensation Scheme (FSCS), and complaints generally fall outside the Financial Ombudsman Service. The FCA's own guidance is blunt: if you invest in crypto, you should be prepared to lose all your money. Prices are extremely volatile and a holding may fall to zero. All capital invested is at risk.

---

Every route into cryptocurrency except one keeps the investor at a distance from the asset. An exchange-traded product, a managed fund, an offshore bond allocation — in each case somebody else holds the coins and the investor holds a claim. Direct ownership is the exception. Buy Bitcoin or Ethereum on an exchange and withdraw it to your own wallet, and there is nothing between you and the asset: full price exposure, full control, and full responsibility for keeping it safe.

That last part deserves more attention than it usually gets. Mainstream finance is built on reversibility — forgotten passwords are reset, lost share certificates reissued, disputed payments recalled. A decentralised network offers none of this, by design. Control of a cryptocurrency holding is control of its private keys, and a lost key has no recovery process because no central party exists to override the ledger. This guide covers what follows from that fact: the custody models available, the exchange counterparty risk on record, the security discipline self-custody demands, and the UK tax treatment of holding and disposing of coins directly.

Whether crypto belongs in your portfolio at all — and at what scale — is a prior question this guide does not reopen. Our rational framework for crypto assets deals with it in full. What follows assumes the decision to hold directly has been made and concentrates on doing it competently.

Ownership Versus Exposure: What "Direct" Actually Means

A cryptocurrency balance is an entry on a blockchain — a distributed ledger maintained by a network of computers with no central operator. The thing an owner actually possesses is not a coin but a private key: the cryptographic credential that authorises transfers from a given address. Whoever controls the key controls the asset. The crypto community compresses this into six words — not your keys, not your coins — and the whole custody question sits inside that phrase.

Contrast this with the exposure products. A crypto exchange-traded product is a listed security: it sits in a normal brokerage account, tracks the price of the underlying asset, and delegates custody to an institutional custodian in exchange for ongoing product fees. The investor gets the price and outsources the operational burden. Direct ownership inverts the bargain — no product fees, no issuer between you and the asset, and every element of custody, security and record-keeping lands on your desk.

Neither route softens the underlying volatility. The choice is about who carries the operational risk, not how much market risk exists.

The Protection Gap: What UK Regulation Does and Does Not Do

The FCA describes crypto as largely unregulated in the UK, and its consumer guidance says that anyone deciding to invest should be prepared to lose all their money — pointing to sudden market moves, firm failures, poor segregation of client funds and cyberattacks as the ways that can happen. It also states that it is highly unlikely a crypto investor will be covered by the FSCS, so no compensation should be expected for crypto-related losses.

There is regulation around the edges, and it is important to understand what it does and does not deliver. Cryptoasset businesses providing in-scope services in the UK must be registered with the FCA under the Money Laundering Regulations — an anti-money laundering and counter-terrorist financing measure, not authorisation, and not a judgement on a firm's solvency or the safety of client assets. Since 8 October 2023 the financial promotions regime has applied to crypto marketing: promotions must be clear, fair and not misleading, must carry prominent risk warnings, and incentives such as refer-a-friend bonuses are banned. A fuller framework is coming — the FCA's new authorisation regime for cryptoasset firms is expected to come into force on 25 October 2027 — but until it does, a decision to hold crypto directly is a decision to operate outside the compensation architecture that stands behind bank deposits and regulated investments.

Exchange Custody and Its Counterparty Risk

For most investors, direct ownership begins on a centralised exchange, and the path of least resistance is to leave the purchased coins there. The exchange holds the private keys; the customer holds an account. For small sums and active trading balances this is a reasonable convenience. Its weakness is that the holding becomes, in substance, a claim on the platform — and the historical record on platform failure is not theoretical.

FTX is the defining case. The CFTC's complaint, filed in December 2022 after the exchange's November 2022 collapse, stated that the defendants' conduct caused the loss of over $8 billion in FTX customer deposits. In 2024 a US federal court entered a $12.7 billion judgment against FTX and Alameda — $8.7 billion in restitution and $4 billion in disgorgement — finding that an exchange which had marketed itself as a safe way to buy and sell crypto had in fact commingled and misused the customer assets it claimed to hold in custody. No compensation scheme stood behind any of it.

The practical lessons are threefold. First, prefer platforms that are registered or licensed in a recognised jurisdiction and are transparent about how client assets are segregated from the firm's own — our guide to choosing a cryptocurrency exchange works through the selection criteria in detail. Second, treat the exchange balance as a working float, not a vault: money in transit rather than money at rest. Third, remember that no exchange feature — insurance marketing, proof-of-reserves pages, brand familiarity — converts an unsecured claim into a protected deposit.

Self-Custody: Keys, Wallets, Hot and Cold

Withdrawing coins from the exchange to a wallet you control removes the platform from the equation entirely. What replaces it is personal operational risk, and managing that risk starts with understanding the two wallet families.

A hot wallet is software — a mobile or desktop application, or a browser extension — that stores private keys on an internet-connected device. It is free, immediate and convenient for small balances and frequent transactions. Its exposure is exactly its convenience: keys held on a connected device are reachable, in principle, by malware, phishing pages and compromised apps.

A cold wallet keeps the private keys on a dedicated hardware device that never exposes them to the internet. Transactions are signed on the device itself and must be physically confirmed on it, which makes remote key theft extremely difficult. For meaningful long-term holdings, cold storage is the widely accepted practice: the marginal inconvenience of confirming transfers on a physical device is the price of removing the connected-device attack surface.

Both wallet types are generated from a recovery phrase — a short sequence of ordinary words produced when the wallet is created, from which the private keys can be regenerated on any compatible device. The recovery phrase is the asset. Anyone who obtains it can reconstruct the wallet and take everything; anyone who loses it, together with the device, has lost the holding permanently. It follows that the phrase should be recorded physically — never typed into a computer, photographed, or stored in cloud notes — and kept in more than one secure physical location. Larger holders sometimes go further, splitting authority across multiple keys held in different places so that no single loss or theft is fatal, or using regulated institutional custodians whose defining feature is legal segregation of client assets from the firm's own balance sheet — precisely the discipline whose absence destroyed FTX's customers.

Security Hygiene: The Habits That Keep a Holding Intact

Self-custody is not a product you buy once but a set of habits you keep. The ones that matter most:

Respect irreversibility. A blockchain transaction cannot be recalled. An asset sent to a mistyped address, or to the right address on the wrong network, is gone. Verify addresses in full rather than by their first and last characters, and send a small test transaction before moving any significant balance.

Assume you are a target. Phishing sites imitating exchanges, counterfeit wallet applications, and social-engineering approaches through messaging groups are endemic in this market. Two rules filter out most of it: no legitimate party will ever ask for your recovery phrase, and no unsolicited request to "verify", "link" or "validate" a wallet through a third-party site is genuine. Buy hardware wallets directly from the manufacturer rather than through marketplace resellers, and keep device firmware current.

Expect friction on transfers — it is a feature of the regime. Since 1 September 2023, UK cryptoasset businesses have been required to comply with the Travel Rule: collecting, verifying and sharing information about cryptoasset transfers as part of anti-money laundering controls. Transfers to self-custodied wallets can attract additional questions from the sending platform. Slow is normal; treat a platform that asks nothing as a warning sign rather than a convenience.

Plan for incapacity and death. Keys that die with their owner take the assets with them. Executors cannot apply to anyone for access, so an estate plan for directly held crypto means ensuring that a trusted person can eventually locate the recovery phrase and instructions — without creating a security hole while you are alive. Sealed physical instructions held with a will, or split storage arrangements, are common approaches; leaving the problem unaddressed is a common way holdings are lost.

UK Tax: Disposals, Records and the Widening Reporting Net

Direct ownership carries the full record-keeping burden, because HMRC's Capital Gains Tax net catches more events than many holders expect. HMRC treats each of the following as a disposal: selling tokens for money, exchanging tokens for a different cryptoasset, using tokens to pay for goods or services, and giving tokens away other than to a spouse or civil partner. Swapping Bitcoin for Ethereum is therefore a taxable disposal of the Bitcoin even though no pounds ever appear.

Gains above the annual exempt amount — £3,000 for the 2026/27 tax year — are taxable at 18% within the basic-rate band and 24% above it. Cost basis is calculated through per-token pooling: acquisitions of the same token are pooled at average cost, with same-day purchases and purchases within 30 days of a sale matched outside the pool under separate rules. Moving tokens between wallets you beneficially own is not a disposal — HMRC's manual is explicit that no disposal occurs where beneficial ownership is retained throughout — but the exemption is only as good as the records proving both wallets are yours. HMRC's guidance places the record-keeping obligation squarely on the taxpayer: dates, token counts, sterling values and pooled costs for every transaction, kept by you rather than reconstructed from exchange statements after the fact.

The reporting environment is also tightening. Under the UK's implementation of the OECD Cryptoasset Reporting Framework, reporting cryptoasset service providers must conduct due diligence on their users from 1 January 2026 and file their first reports with HMRC between 1 January and 31 May 2027 covering 2026 activity, with information on non-UK users exchanged with other participating jurisdictions. Self-custodied wallets are not themselves reporting entities, but virtually every route between coins and currency passes through a platform that is. For the cross-border dimensions — residence, treaty issues and the treatment in common expat jurisdictions — see our cryptocurrency tax guide for international investors.

Sizing a Direct Holding Within a High-Risk Sleeve

Sizing logic for directly held crypto starts from the FCA's warning rather than from return expectations: the position should be one whose complete loss you could absorb without altering your financial plans. That is not rhetorical caution — firm failure, key loss and protocol failure are all routes to a total write-off that diversified equity portfolios simply do not have.

In portfolio terms, that argues for holding crypto inside a defined high-risk sleeve alongside other speculative positions, sized so that the sleeve as a whole — not each position individually — is survivable. Our crypto assets investment framework sets out the sizing analysis in full, including how quickly crypto's volatility comes to dominate a portfolio's risk as the allocation grows. Two further disciplines are specific to direct ownership. Concentration in custody deserves the same attention as concentration in assets: a sleeve held entirely on one exchange, or secured by one recovery phrase in one location, has a single point of failure whatever its market diversification. And rebalancing has tax consequences that exposure products in wrappers do not: trimming a directly held position that has grown is a disposal, with the CGT and record-keeping consequences described above, so rebalancing intentions belong in the plan from the start rather than as an afterthought.

Where Direct Ownership Leads

Holding your own coins is the entry point to everything else in the ecosystem. It is the precondition for staking on proof-of-stake networks, where rewards are variable and never guaranteed and further risks — lock-ups, validator penalties, platform failure — stack on top of the ones described here. It is equally the precondition for DeFi protocols, an explicitly experimental arena suitable only for technically sophisticated investors. Investors who conclude that the operational burden of direct ownership outweighs its benefits are not out of options: regulated exchange-traded crypto products deliver the same price exposure inside a conventional brokerage account, with custody delegated for a fee. The cryptocurrency hub compares the access routes side by side.

How Global Investments Can Help

Global Investments does not provide cryptocurrency execution or custody services, and we neither promote nor discourage direct ownership. Where our investment team adds value is around the holding: thinking through whether direct custody or a regulated wrapper better fits a client's circumstances, how a crypto position sits within a broader international portfolio and its high-risk sleeve, and how cross-border reporting and disposal taxation apply to holdings that already exist. For internationally mobile clients with significant directly held positions, that conversation usually spans custody structure, record-keeping, realisation sequencing and estate arrangements. Contact us to discuss any of it in the context of a wider wealth review.

---

This guide is for information and education only and does not constitute a personal recommendation or regulated investment advice. Cryptoassets are largely unregulated in the UK; directly held cryptoassets are highly unlikely to be covered by the FSCS and complaints generally fall outside the Financial Ombudsman Service. The value of cryptocurrency can fall rapidly and may fall to zero — be prepared to lose all money invested. Tax treatment depends on individual circumstances and may change. Seek independent professional advice before investing.