Custodial vs non-custodial stablecoin payin APIs: what changes for your business
Non-custodial stablecoin payment API or custodial? Who holds the keys, funds and risk in a payin, with a risk table and six diligence questions.
Custody in a payin depends on where the stablecoins end up. With a non-custodial setup, the provider delivers them to a wallet your customer controls, so it never holds the keys. With a custodial setup, the provider holds the wallet and the balance. BlindPay offers both: an external customer-controlled wallet, or an optional BlindPay-managed wallet (beta).
Fiat is a separate question. In any payin, the provider handles the deposit before it converts and delivers.
Key takeaways
- "Custodial" depends on the wallet that receives the stablecoins, not only on the provider's brand.
- A payin has two legs: the fiat deposit and the stablecoin delivery. Custody can differ on each.
- With BlindPay,
blockchain_wallet_id(bw_...) targets a customer-controlled wallet, andwallet_id(bl_...) targets an optional BlindPay-managed wallet in beta. - Once stablecoins land in a customer-controlled wallet, the provider cannot reverse or recover them.
- Verify custody in the provider's documentation and contract, not in marketing.
For the basics of the product, read what a stablecoin payin API is. For custody on the payout side, see custodial vs non-custodial off-ramps.
What does custodial mean in payments?
Custodial means a third party holds the means to move the funds. In stablecoin payments, that means the provider generates the wallet, holds its private keys and keeps your balance. You hold a claim on the provider, not the keys.
The upside is convenience: no wallet software, no signing, simple balances. The downside is that your funds depend on the provider's security, solvency and legal setup. MPC (multi-party computation) wallets split key control between several parties and sit between the two models.
What does non-custodial mean?
Non-custodial means the recipient alone controls the private keys. The provider can send stablecoins to the address, but it cannot move them out without the owner's signature or on-chain authorization.
BlindPay's docs describe its external blockchain wallet this way: BlindPay never holds the private keys and cannot access, freeze or recover funds in it. If a payin goes to a wrong address, BlindPay cannot reverse the transfer. For the broader idea, see non-custodial payments explained.
What risks does each model carry?
Each model moves risk to a different place. Custodial models carry provider risk: loss, freezes and insolvency. Non-custodial models carry user risk: wrong addresses, lost keys and no recovery. Both carry fiat-leg risk while a deposit processes.
Use this table to compare them for a payin.
| Question | Custodial destination (for example a BlindPay-managed wallet, beta) | Non-custodial destination (for example a customer-controlled blockchain wallet) |
|---|---|---|
| Who holds the keys? | The provider | The customer |
| Who can move funds after delivery? | The provider, on your instruction | Only the customer |
| Pre-funding | Balances sit with the provider, so ask what you must hold | No balance is held for the payin itself |
| Wrong-address risk | Lower, since the provider generates the address | Higher: funds sent to a wrong address cannot be recovered |
| If the provider fails | Your balance may be exposed. Read the terms | Delivered funds are unaffected, but payins in flight and the fiat leg may be |
| Regulatory perimeter | Provider more likely to be treated as a custodian | Provider acts as a payment processor, but may still be a service provider |
| Balance exposure | Whatever stays in the wallet | Only what the customer chooses to keep |
How does custody affect pre-funding and balances?
In a payin flow, there is no pre-funding step: the payer sends fiat first, and stablecoins arrive afterward. Custody changes what happens next. In a custodial wallet, the balance stays with the provider until you move it. In a customer-controlled wallet, the balance leaves the provider at delivery.
With BlindPay, a managed wallet (bl_...) holds a balance you can check through the wallets API, while a blockchain wallet (bw_...) is just an address BlindPay delivers to. See the managed wallets reference and the blockchain wallets reference.
The fiat leg works the same either way. A payer sends a bank transfer to payment details BlindPay provides, or to a customer's virtual account. During that window, the money is not yet stablecoins and not yet in your wallet. See virtual accounts for stablecoin payins.
What happens if a provider fails?
If a custodial provider fails, balances it holds may be at risk and recovery depends on the contract and local law. If a non-custodial provider fails, stablecoins already delivered to a customer-controlled wallet are unaffected, but payins in flight depend on the provider.
What happens if a stablecoin payment provider fails walks through the cases. The key habit is to design for both: keep reconciliation records, avoid leaving large balances in any custodial wallet, and know which statuses are final.
BlindPay's payin statuses are processing, on_hold, completed, failed and refunded. refunded means the deposit was returned to the sender. on_hold means the payin is held for manual review before continuing. See the payins reference for the full lifecycle.
How do I check a provider's model?
Check it with documents and a test, not with a label. Answer these six questions for each provider and for each product, since custody can differ between a wallet product and a payment product:
- Who generates the wallet and holds its private keys?
- Can the provider move funds without the customer's signature?
- Where does the fiat sit between the deposit and the delivery?
- Do I have to hold a balance with the provider for this flow?
- What do the terms say if the provider fails or freezes an account?
- What status or document proves each payment ended up where it should?
For a longer checklist, use how to verify a non-custodial payment provider. For how this interacts with the law, see the GENIUS Act and MiCA for payin businesses.
Where does BlindPay fit?
BlindPay offers two destinations for a payin. The docs describe both, so you can pick per customer.
| Destination | Field | Custody | Status |
|---|---|---|---|
| External blockchain wallet | blockchain_wallet_id (bw_...) | Customer-controlled | Available |
| Managed wallet | wallet_id (bl_...) | BlindPay-custodied | Beta |
- Payouts from customer-controlled wallets are non-custodial. BlindPay operates as a non-custodial payment processor for payout flows from customer-controlled wallets: you authorize the exact amount and BlindPay executes that single transaction. Optional BlindPay-managed wallets (beta) are custodial when you choose that path.
- Payins are handled in two legs. BlindPay watches for the fiat deposit, converts it, and sends stablecoins on-chain to the destination you set on the quote.
- Customer checks. The payin tutorials require a customer with
kyc_status: "approved"first. See the managed-wallet payin tutorial in the docs. - Fees. Per-transaction fees vary by rail and network and appear in the live quote. See pricing.
Sources
- BlindPay docs: Blockchain wallets, Managed wallets, Payins and Payin with managed wallet, checked on October 24, 2026.
- BlindPay pages: compliance and security.
- MiCA, Regulation (EU) 2023/1114: EUR-Lex, checked on October 24, 2026.
- GENIUS Act enrolled text: Congress.gov, S.1582, checked on October 24, 2026.
This article is general information, not legal advice.
FAQ
More compliance articles
See all compliance articlesWhere does a neobank hold customer funds? FBO accounts, custodial wallets, and non-custodial flows
Pooled FBO bank accounts, custodial stablecoin wallets, or customer-controlled wallets: who holds the money, who reconciles it, and what fails.
KYC and KYB for stablecoin payins: who verifies whom?
Stablecoin KYC for payins: your business verifies its customers, the payin provider screens and monitors. A responsibility table and BlindPay facts.
Merchant onboarding for a checkout platform: KYB steps and timing
How a checkout platform onboards merchants in 2026: terms of service, KYB fields and documents, review times, and what to show while a merchant waits.