From 1 July 2026, users are asked to confirm that the Bitcoin wallet they are withdrawing to, or depositing from, is one that they control.
What has changed?
The “Travel Rule”, part of the AML/CTF reforms, requires digital currency exchanges, such as Bitaroo, to collect and, in many cases, share identifying information about the people on both sides of a transfer when funds move to or from a custodial service.
To avoid routinely sending your personal information to third parties, Bitaroo instead verifies that your wallet is self-custodial.
We built a tool to do this: the Self Hosted Address Zenith Attestation Module, or SHAZAM for short.
What is a self-custodial (self-hosted) wallet?
A self-custodial wallet is one where you, or the person you are paying, hold the private keys. Examples include hardware wallets such as BitBox02, Ledger and Trezor, and software wallets such as Sparrow, Electrum and BlueWallet, where the keys live on your own device.
A custodial wallet, on the other hand, is one where a company holds the keys on your behalf. Examples include accounts at other exchanges and many Lightning wallets.
What will I be asked to do?
Bitcoin Withdrawal
On-chain: The first time you withdraw to a new address, SHAZAM asks you to verify that the address belongs to a wallet you control. You can choose a method that suits you: cryptographically signing a short message, providing your wallet’s extended public key (or, for a multisig wallet, its output descriptor), or completing a small satoshi test. Once an address is verified, you will not need to verify it again.
Lightning: You will be asked to attest that the destination is a self-custodial wallet, in addition to SHAZAM performing its own checks on the backend.
Bitcoin Deposit
On-chain: You will be asked to prove that the bitcoin you are receiving comes from a self-custodial wallet that you control. The same verification methods as withdrawals are available.
Lightning: You will be asked to attest that the source is a self-custodial wallet, in addition to SHAZAM performing its own checks on the backend.
What happens if I do not or cannot verify?
Your funds remain safe. An on-chain withdrawal that has not been verified is held rather than sent, and you can complete or cancel it at any time from Recent Withdrawals. A Lightning transaction to a destination that cannot be confirmed as self-custodial will not be sent.
Does this protect my privacy?
Yes. Confirming self-custody allows Bitaroo to avoid routinely disclosing your personal information to third parties. Bitaroo never takes custody or control of your keys. Signing a message, providing an extended public key, or supplying your multisig wallet’s output descriptor proves that you control the wallet without giving anyone the ability to move your funds.
Need help?
If you believe a destination has been incorrectly identified as custodial, or you are unsure which verification method to use, please contact our support team.