Buyer's guideDigital Assets

Choosing a wallet model for a consumer digital asset programme

For a consumer programme, the wallet decides who can join without help, who can recover a lost account and who carries custody obligations. There are four broad models: custodial accounts, embedded or MPC wallets created at sign-up, smart-contract accounts, and the user's own self-custody wallet. This guide scores them on the criteria a brand cares about, explains the Hedera mechanics that matter and sets out a path from custodial to portable.

Reviewed 8 min read

On this page
  1. Why the wallet decides adoption before the token does
  2. Four wallet models in plain terms
  3. Scoring the four models against a brand's criteria
  4. Hedera mechanics that change the wallet decision
  5. Custody can be a regulated service
  6. Matching the wallet model to the programme
  7. Starting custodial and opening an export route later
  8. Questions to put to a wallet or custody provider
  9. Questions and answers
  10. Sources

Why the wallet decides adoption before the token does

A collectible, ticket, membership or points balance only works if the people it is meant for can hold it. Every extra step at sign-up, such as installing an app, writing down a recovery phrase or buying a network token to pay fees, loses part of the audience before they see any benefit. Members rarely notice the token standard. They always notice the wallet.

The wallet model also settles three questions the business cannot hand off: who restores access when someone loses a phone, who answers for stolen keys, and whether the brand is holding assets on its customers' behalf. Each has legal, security and support consequences for years after launch, which is why the decision belongs at the start of product design rather than at integration time.

Four wallet models in plain terms

Custodial account
The programme or its provider holds the private keys and records each user's holdings, much as a bank records deposits. Users sign in with an email or existing account and never handle keys.
Embedded or MPC wallet
A wallet created automatically at sign-up, with the key split into shares by multi-party computation or protected in secure hardware, so no single party holds the whole key. Users approve actions with a login, passkey or device.
Smart-contract account
An account controlled by contract logic rather than one key, allowing spending limits, several approvers, session keys and sponsored fees. On EVM chains it is often built on the ERC-4337 account-abstraction standard3.
Self-custody wallet
A wallet the user installs and controls, holding their own keys or recovery phrase: complete portability and control, and complete responsibility for keeping keys safe.

Scoring the four models against a brand's criteria

CriterionCustodial accountEmbedded or MPC walletSmart-contract accountSelf-custody wallet
Onboarding frictionLowest: email or existing loginLow: wallet created at sign-upLow to medium, depending on the sign-up flowHighest: install, back up and fund a wallet
RecoveryProgramme restores access after identity checksBackup share or provider process, to be tested before launchRule-based, such as guardians or a recovery keyUser alone; a lost phrase usually means lost assets
Custody exposure for the programmeHighest: the programme controls user assetsDepends on who can move assets; needs legal analysisDepends on who holds the controlling keysLowest
Security responsibilityProgramme secures keys at scaleShared by provider, programme and userContract code and key holdersUser
PortabilityNone unless an export route is builtOften exportable, depending on providerPortable within the chain's ecosystemFull
Support burdenPredictable, like account supportModerate: provider and programme both involvedModerate, plus contract upgradesHigh: users need help with wallets you do not control
Main cost driversKey management and custody controlsProvider fees per wallet or transactionContract development, audits and fee sponsorshipIntegration and user support

Ratings are relative and qualitative. The legal position of each model depends on the jurisdiction and on exactly who can move assets, so read the custody row as a prompt for advice, not a conclusion.

Hedera mechanics that change the wallet decision

On Hedera, a few network features change how much of this a user ever sees. Sending tokens to an alias, such as an EVM address derived from a user's public key, creates the account automatically, so a programme can hand a user an address before any on-chain account exists4. An account created from an EVM address starts hollow: it can receive assets but cannot send them until it signs a transaction with the matching key, which matters when users later redeem or export4. Tokens normally need associating before an account can receive them, but auto-created accounts default to unlimited automatic associations2.

Every Hedera transaction is identified by the account that pays its network fee, and other accounts can sign the same transaction5. A programme can therefore pay for its users' transfers and redemptions so members never hold HBAR: where the programme holds keys it submits transactions itself, and where users hold keys the user signs the transfer while the programme signs as payer. Token-level controls such as freeze and KYC flags are covered on our Hedera Token Service page.

Custody can be a regulated service

Matching the wallet model to the programme

  • If

    Users are mainstream consumers and assets are low-value and rarely leave the programme.

    Then

    Start with custodial accounts or an embedded wallet, sponsor every fee and keep the ledger out of sight.

    Friction costs more members than portability gains.

  • If

    The assets are collectibles or tickets that users expect to resell or display elsewhere.

    Then

    Use an embedded wallet with a clear export route and support connecting a self-custody wallet.

    Holders value portability once an asset has value outside the programme.

  • If

    Your audience already uses crypto wallets.

    Then

    Support bring-your-own self-custody wallets first, with an embedded option for newcomers.

    Pushing experienced users into a custodial account feels like a step backwards.

  • If

    Legal review says custody would need an authorisation you do not hold.

    Then

    Use a licensed custody provider or a model in which users hold control, and record the reasoning.

    Running custody without permission is a structural risk, not a configuration setting.

  • If

    You need spending limits, several approvers or delegated actions.

    Then

    Evaluate smart-contract accounts and budget for audits and upgrade governance.

    The rules live in code, which needs the same review as any other financial logic.

Starting custodial and opening an export route later

  1. Launch with custodial balances tied to existing profiles

    Link holdings to the user's existing login so the first experience involves no wallet set-up at all.

  2. Attribute holdings per user from day one

    Keep each user's assets in a distinct on-chain account or a clearly attributed sub-ledger, so they can be moved individually later without a bulk clean-up.

  3. Offer verified export

    Let users connect a self-custody wallet, prove control by signing a message and withdraw to it, applying any screening or transfer restrictions the asset carries.

  4. Publish the rules

    State in the terms which assets can leave, what export means for benefits and what support the programme can give once assets sit in a wallet it does not control.

Questions to put to a wallet or custody provider

0 of 6 checked

Questions and answers

What happens if a user loses access to their wallet?

It depends on the model. With a custodial account the programme restores access after its usual identity checks. Embedded and MPC wallets recover through a backup share, passkey or provider process, which should be tested before launch. Smart-contract accounts can define recovery rules such as guardians. With self-custody, a lost recovery phrase usually means the assets are gone, which is why mainstream programmes rarely start there.

Can users take their assets to another wallet or platform?

Only if the programme is built for it. Custodial balances stay inside the programme unless you offer withdrawal to a user-controlled wallet. Embedded wallets are often exportable, depending on the provider. Self-custody assets are portable by design, though other platforms recognise them only if they support the same network and token type. Publish the export policy before launch so users know what they hold.

Do we need to collect KYC from wallet users?

Not always. Identity checks depend on what the asset is and what users can do with it. A non-transferable membership pass may need nothing beyond normal account checks, while transferable assets with monetary value, or a custodial service inside a licensing regime, can bring customer due diligence and sanctions screening. Legal review should decide this per market, and the wallet design should make checks possible where required.

Is an embedded wallet custodial?

Sometimes. It turns on who can move the assets. If the provider or the programme can sign transactions without the user, regulators may treat the arrangement as custody even when the key is split into shares. If only the user's device or login can complete a signature, it sits closer to self-custody. Ask providers to document exactly who can sign, and have counsel assess it.

Can one programme support several wallet models?

Yes, and many do. A common pattern is a custodial or embedded default for new users, with the option to connect a self-custody wallet. The programme then runs two recovery paths, two support playbooks and two ways of proving ownership at redemption. Keep the token rules identical wherever the asset is held, so benefits do not depend on the wallet.

Sources

  1. Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) — EUR-Lex · checked 10 October 2026
  2. Account properties: automatic token associations and account aliases — Hedera documentation · checked 10 October 2026
  3. ERC-4337: Account Abstraction Using Alt Mempool — Ethereum Improvement Proposals · checked 10 October 2026
  4. Auto account creation and hollow accounts — Hedera documentation · checked 10 October 2026
  5. Transactions and queries: transaction IDs and fee payer accounts — Hedera documentation · checked 10 October 2026

More in Digital Assets

Back to Digital Assets

Next step

Get a second opinion on your wallet model

Describe your audience, the asset and the markets you serve. We will set out which wallet models fit, what to ask providers and which questions need a legal view before you commit.

Discuss a wallet strategy