Not a Financial OS but a Permission Kernel: What the Self-Custody Wallet Race Is Actually About

The Turning Point Was the Redefinition of the Account, Not Feature Creep

Viewed as an accumulation of features, the wallet race looks like a story about swaps, cards and chain coverage. The technical turning point was somewhere else.

ERC-4337, which entered production use in 2023, freed the wallet from a one-to-one binding with a private key and made it a smart contract account whose signature verification and execution logic can be defined arbitrarily. That made biometric authentication via passkeys, social recovery, third-party sponsorship of gas fees, and session keys scoped by purpose and limit into properties of the account itself.

EIP-7702, activated in the Pectra upgrade on May 7, 2025, then opened that path to existing users. A new transaction type, 0x04, lets an existing externally owned account delegate the behavior of a smart contract without changing its address. The set of signatures designating the delegation target is called the authorization_list. The name itself is the point: what is being handled is neither balance nor key, but permission.

The wallet has become a policy execution device that decides whether a transaction may proceed. The proliferation of features is the consequence, not the cause.

The Global Contest Has Moved from Chain Count to the Approval Experience

The behavior of the major players is consistent with this reading.

MetaMask, generally cited at around 30 million monthly active users and among the largest self-custody wallets, has concentrated recent releases on card payments, its own stablecoin, and gas payment in tokens other than ETH, all of which reduce friction at the moment of use. Bitget Wallet leads with gas abstraction that lets fees be paid in a variety of tokens across multiple networks. Phantom, originating on Solana, has expanded chain coverage on the strength of an unusually legible interface. Trust Wallet retains presence through chain coverage and cumulative user scale.

Safe, by contrast, has established a firm position not with individuals but with DAOs and corporates, through multisig and fine-grained permission management. Hardware wallets such as Ledger and Trezor continue to deliver value on a single axis: physical isolation of keys from any online environment.

Lined up this way, the market is plainly not converging on a single winner. Roles are differentiating instead. What they share is that competition has shifted from how many chains are supported to how approval is designed. Hardware wallets offer physical approval, Safe offers organizational approval, and smart account platforms offer conditional automated approval. All three are competing over how permission is expressed.

Japan's Three Players Are Taking Different Faces of the Same Boundary

The pattern is even clearer in Japan, where the leading non-custodial wallets are each staking out a different face of permission.

MynaWallet performs identity verification through the Japanese Public Key Infrastructure attached to the My Number card, while keys remain with the user in a non-custodial design. Operation runs through passkeys, and gas is sponsored by the operator. The architecture builds on research the company undertook after being selected for an Ethereum Foundation grant round related to ERC-4337 in September 2023, and general availability began in July 2026 across six EVM-compatible chains. With Sumitomo Mitsui Card, it ran tap-to-pay JPYC trials in Fukuoka City in January 2026 and at Kitakyushu Messe on April 25, and in February it ran a QR code payment trial with Digital Garage, JCB and Resona Holdings. The face it holds is who the person is.

JPYC Gateway, launched by Asteria on April 1, 2026, is a corporate treasury management service. It provides multi-stage approval workflows, audit logs, gasless transfers and no-code integration with ERP and accounting systems, with a flat transfer fee of eight yen per transaction. On June 16 the company published a certification framework for approved external wallets alongside its bundled standard wallet. Its stated target is a concrete operational problem: with an ordinary wallet, a single employee can move very large sums unilaterally, which internal control regimes cannot accept. The face it holds is who approves.

HashPort Wallet, a non-custodial wallet that inherited the digital wallet built for the Osaka-Kansai Expo, reports cumulative downloads above 1.15 million. On August 6, 2026, together with KDDI and Lawson, it ran a technical trial of JPYC payment integrated with the point-of-sale register at a Lawson store in Takanawa Gateway City. The design lets the merchant accept payment through its ordinary POS without opening or managing a wallet. The face it holds looks like where the money can be spent, but more precisely it is a design that removes the need for the merchant to hold receiving authority itself.

The three appear to compete, yet they divide three faces of the permission boundary: identity verification, internal approval, and merchant acceptance. Where the global contest runs on experience and coverage, Japan's runs on who attests and who approves.

Regulation and AI Agents Point at the Same Place

Two developments reinforce this reading.

The first is regulation. As of the FATF's June 2025 targeted update, 85 of 117 assessed jurisdictions had passed Travel Rule legislation. In the European Union, the Transfer of Funds Regulation has applied since December 2024, and the Anti-Money Laundering Regulation becomes applicable on July 10, 2027. That regulation requires crypto-asset service providers to apply risk-mitigating measures on transfers involving self-hosted wallets and prohibits maintaining anonymous accounts. It does not ban self-custody, but regulatory attention is concentrating precisely on the interface between regulated providers and self-custodied wallets, which is exactly where identity and permission are established.

The second is AI agents. HashPort has indicated plans for a first release in September 2026 of Model Context Protocol support connecting its wallet to AI agents. The notable element is the stated design principle that any movement of assets requires explicit approval by the user and that the non-custodial model, with keys held by the user, is preserved. Deciding what and how much to delegate to an agent requires a mechanism, and that mechanism is the account's permission design itself.

Regulation and AI are demanding the same layer of the wallet. That is why calling this layer a financial operating system is slightly imprecise. An operating system denotes the substrate that runs applications, whereas what is being contested here more closely resembles a kernel's permission management. Whose assets may move, on whose approval, and under what conditions. The place where that determination is made is becoming the location of competitive advantage in finance.

Policy is oriented the same way. In the Basic Policy on Economic and Fiscal Management and Reform 2026, approved by cabinet decision on July 21, 2026, the Japanese government wrote "promotion of onchain finance" into its asset management nation agenda for the first time. A footnote defines it as finance in which settlement using tokenized deposits and stablecoins on a blockchain is linked and integrated by program with the management of commercial and logistics data. If settlement and data are to be linked, some party and some set of conditions must authorize that linkage.

Business Development Insights

1. Shift the wallet evaluation axis from chain coverage to expressiveness of permission policy. When selecting a wallet to embed in a service or an asset management platform for internal use, chain counts and fee comparisons are only the entry point. The substantive differences are whether approvers can be separated into multiple stages, whether conditions can be set by amount and by destination, whether delegated authority can expire automatically on a time or value limit, and whether the full operation history remains in auditable form. Making these four the primary axes of the evaluation matrix materially improves selection quality. That domestic corporate services lead with multi-stage approval and audit logs is evidence that this axis has already surfaced in practice.
2. Settle the mapping between verified customer identity and onchain permission before evaluating token issuance. Financial institutions and corporates already hold KYC-verified customer bases. Discussions of onchain initiatives tend to begin with how an asset should be issued, but the practical bottleneck is how existing customer identities map onto onchain authority. That a domestic implementation embedding public personal authentication into a non-custodial wallet has already reached general availability shows this mapping is technically solvable. Conversely, pursuing issuance without that design cedes the customer relationship to the wallet operator and leaves the institution as a supplier of the underlying asset.
3. Agree internally now on which transactions must require human approval in the agent era. With implementations connecting wallets to AI agents expected within 2026, the line between automated balance queries and human-approved asset movements will soon be an operational question. What needs deciding is policy, not technology: what the value threshold should be, whether internal transfers and external payments are treated differently, and how escalation works when an approver is unavailable. These can be debated as extensions of existing authorization schedules and approval rules, without waiting for technical evaluation to conclude. Settling policy first turns into a precise requirements definition for the technology selection that follows.

Sources

• Ethereum Improvement Proposals, EIP-7702: Set EOA account code https://eips.ethereum.org/EIPS/eip-7702
• Ethereum Improvement Proposals, ERC-4337: Account Abstraction Using alt mempool https://eips.ethereum.org/EIPS/eip-4337
• Alchemy, "Prepare for EIP-7702 and the Ethereum Pectra Upgrade" https://www.alchemy.com/blog/eip-7702-ethereum-pectra-hardfork
• OpenZeppelin Docs, EOA Delegation https://docs.openzeppelin.com/contracts/5.x/eoa-delegation
• MynaWallet / Sumitomo Mitsui Card, news release on stablecoin payment trials using the My Number card (January 16, 2026) https://www.smbc-card.com/company/news/25/news0002105.pdf
• MynaWallet press release on the stablecoin QR code payment trial with Digital Garage, JCB and Resona Holdings https://prtimes.jp/main/html/rd/p/000000010.000125732.html
• Bittimes, "My Number card and crypto wallet app released, supporting six chains" https://bittimes.net/news/225790.html
• Asteria, "JPYC Gateway, Japan's first corporate JPYC treasury management service, launching April 1" (February 27, 2026) https://jp.asteria.com/news/2026022727936/
• Asteria, "Announcing the standard wallet and approved wallets for JPYC Gateway" (June 16, 2026) https://jp.asteria.com/news/2026061643190/
• JPYC Gateway official site and FAQ https://jpycgateway.com/faq.html
• HashPort press release on the in-store stablecoin payment trial with KDDI and Lawson https://prtimes.jp/main/html/rd/p/000000181.000046288.html
• Neweconomy, "Experiencing JPYC payment at Lawson: Japan's first convenience store POS integration trial" (August 6, 2026) https://www.neweconomy.jp/posts/598504
• Cabinet Office of Japan, "Basic Policy on Economic and Fiscal Management and Reform 2026" (cabinet decision, July 21, 2026) https://www5.cao.go.jp/keizai-shimon/kaigi/cabinet/honebuto/2026/2026_basicpolicies_ja.pdf
• RegPulse, "EU AML Package 2026: AMLR, AMLD6, and AMLA" https://www.regpulse.io/blog/eu-aml-package-2026
• Crystal Intelligence, "The Travel Rule: hosted vs unhosted crypto wallets" https://crystalintelligence.com/crypto-regulations/the-travel-rule-hosted-vs-unhosted-crypto-wallets/