Ten warning signs to catch before you sign with a blockchain payments provider, how each shows up in a sales call or sandbox, and the question to ask.
The biggest red flags in a blockchain payments provider are vague licensing, prices you only see after signing, terms that hand the provider title to your funds, a sandbox that cannot fail, and no per-payment trail. Each one shows up early in a sales call or a sandbox, and each has a question that exposes it.
Checklists tell you what good looks like. This page is the opposite list: the signs that a provider will cost you time, money, or customer trust later. Use it alongside the technical buyer's checklist and the 30 due diligence questions.
Key takeaways
A gap is a missing feature with a roadmap date. A red flag is an answer that stays vague after you ask twice, especially about money, licenses, or failure.
Definition: A red flag in provider due diligence is a sign that the provider cannot or will not show you how your money moves, who is responsible for it, or what it will cost. It is different from a product gap, which is a feature the provider does not ship yet.
The test is simple. Gaps get specific answers ("Q1, here is the spec"). Red flags get general ones ("we're fully compliant", "it's instant", "pricing depends"). Write the answers down. Vague answers rarely get more specific after the contract is signed.
| # | Red flag | How it shows up | Question that exposes it |
|---|---|---|---|
| 1 | Licensing without names | "We're licensed everywhere we operate" | Which entity contracts with us, and which registration numbers cover our flow? |
| 2 | Price after signature | No binding quote until the contract is signed | Can we create a live quote with fees and an expiry in the sandbox today? |
| 3 | Title to your funds | Terms say deposits become the provider's property | Who owns funds in transit if you become insolvent? |
| 4 | Growing pre-funding | Required balance rises with volume, no formula | What is the formula, where is the balance held, and who owns it? |
| 5 | Unlimited approvals | Integration guide asks for a maximum token allowance | Can authorization be scoped to the quoted amount? |
| 6 | A sandbox that cannot fail | Every test payout succeeds | How do we force failed, returned, and refunded outcomes? |
| 7 | "Instant everywhere" | One speed claim for every rail | What is the settlement time per rail, and what are the cut-offs? |
| 8 | Compliance with no split | "We handle compliance" and nothing more | Which checks do you run, which do we own, and how do information requests work? |
| 9 | Corridors on a slide | A country list without production evidence | When did your last production payout on this corridor settle? |
| 10 | No per-payment trail | Statuses without identifiers | What transaction hash, wire reference, and signed webhook do we get per payment? |
Because they decide who is responsible when something breaks, and whether your money is still yours. Product gaps cost you a quarter. Custody failures cost you the balance.
On licensing (red flag 1), ask for the contracting entity and registration numbers, then check them yourself. In the US, FinCEN's MSB registrant search shows whether a business has filed a federal registration. That filing is not a state money transmitter license, so it answers only part of the question. MSB vs money transmitter license vs VASP vs EMI explains which license covers what.
On custody (red flags 3 and 4), read the terms before the pitch deck. In January 2023, the Celsius bankruptcy judge ruled that assets in Earn accounts belonged to the estate because the terms transferred title (Axios). If a provider does hold funds, New York's custodial structures guidance (updated September 30, 2025) is a useful benchmark: segregated assets, an audit trail for omnibus wallets, and beneficial interest that always stays with the customer. How to verify a payment provider is really non-custodial turns this into 8 hands-on checks.
Red flags 2, 5, 6, and 10 show up in the first afternoon of testing. You do not need a sales call to find them.
approve call the guide tells you to make. An allowance for the quoted amount limits exposure to one payment. A maximum allowance does not.They show up as confident, general answers to specific questions. Speed, compliance, and coverage are where pitch decks are most optimistic.
Because records are what protect you when balances disagree. Without per-payment identifiers, you cannot prove where your money was, and neither can the provider.
The Synapse case is the clearest recent example. The CFPB alleged Synapse failed "to maintain adequate records of the location of consumers' funds", and partner banks found a shortfall of between $60 and $90 million against Synapse's records (CFPB). That was a fintech middleware failure, not a blockchain one. The lesson carries over: a provider's ledger is only as good as the external references behind each entry.
Ask for a sample payout object and a sample webhook payload before the contract. If the identifiers are not there in the sample, they will not be there in production either.
BlindPay's answers are in its public docs, so you can check them before a call. Live quotes return the fee breakdown and the amount the recipient receives, and expire 5 minutes after creation (payout quotes). BlindPay combines a monthly plan with per-transaction fees that vary by rail and network and are disclosed in the live quote before execute.
For payouts from wallets your customers control, BlindPay operates as a non-custodial payment processor: you authorize the exact amount and BlindPay executes that single transaction. Optional managed wallets (beta) are custodial when you choose that path. Development instances force failed and refunded outcomes with sentinel amounts (payouts), webhooks are signed with Svix headers (webhooks), and SWIFT (POBO/COBO) payouts return a UETR once the wire is confirmed (POBO and COBO). BlindPay is backed by Y Combinator and processes $2.5 billion in annualized volume across 100+ countries.
Copy the table into your vendor file, send the ten questions to every shortlisted provider in writing, and score the answers with the RFP template. If your team is new to the topic, blockchain payments vs crypto payments covers the basics first.
Test red flags 2, 6, and 10 against BlindPay today by creating a quote and a forced refund in the payout quickstart.
The evidence examiners expect from automated risk monitoring: a 10-item evidence table, good vs poor practice, SAR timelines, RFIs, and a 30-day plan.
Blockchain payments are legal for businesses in the US, EU, UK, Brazil, and Mexico, under different rules. What each country regulates, as of October 2026.
Why a stablecoin card purchase can be a taxable disposal, how the US, UK, Germany, Spain, the Netherlands, and Brazil differ, and which records to keep.