---
title: "How to verify a payment provider is really non-custodial: 8 checks you can run yourself"
seoTitle: "How to verify a provider is really non-custodial"
description: "Eight checks that prove whether a blockchain payment provider ever holds your funds: on-chain approvals, stored balances, terms of title, failure tests."
date: "2026-10-11"
updated: "2026-10-11"
category: "compliance"
author: "BlindPay Team"
faq:
  - q: "How can I tell if a payment provider is non-custodial?"
    a: "Look for evidence, not the label. Ask for a flow-of-funds diagram, check the token approval your wallet signs on a block explorer, look for any balance the provider holds for you, and read the terms for who owns funds in transit. Then run a failed payment in the sandbox and watch where the money goes. Each check either confirms the claim or shows where custody starts."
  - q: "Does signing an ERC-20 approval give the provider custody of my wallet?"
    a: "No. An ERC-20 approve call lets one contract pull up to a set amount of one token from your wallet. Your keys and the rest of your balance stay with you. The risk sits in the amount: an approval for exactly the quoted payout limits exposure to that payment, while an unlimited approval lets the spender pull more later. Check the amount on a block explorer."
  - q: "Why does it matter whether a provider is custodial?"
    a: "Because custody decides who owns the money if the provider fails. In the Celsius bankruptcy, a judge ruled in January 2023 that assets in Earn accounts belonged to the estate, so customers became unsecured creditors. In the Synapse case, the CFPB alleged poor records of where consumer funds sat, with a shortfall of $60 to $90 million. Less custody means less of this exposure."
  - q: "Is a non-custodial payment provider unregulated?"
    a: "Not necessarily. Non-custodial describes who controls funds, not whether a business needs licenses. A provider that converts currency or transmits value can still have money transmission, AML, and sanctions obligations depending on the jurisdiction and the flow. Regulatory treatment varies by country and by product, so ask each provider which licenses and registrations cover your specific flow. This is general information, not legal advice."
  - q: "Is BlindPay non-custodial?"
    a: "For payout flows from customer-controlled wallets, yes. You authorize the exact amount and BlindPay executes that single transaction. If a payout cannot be delivered after the stablecoins are collected, BlindPay refunds them to the quote's refund wallet or the sending wallet; non-USD local rails refund automatically, while USD payouts and timed-out reviews are refunded after an operator review. Optional BlindPay-managed wallets (beta) are custodial."
---

To verify a provider is really non-custodial, test where your money sits at every step: inspect the token approval you sign, look for any balance the provider holds for you, read the terms for who owns funds in transit, and run a failed payment in a sandbox. A real non-custodial flow never leaves value parked under the provider's sole control.

"Non-custodial" is easy to write on a landing page. It is harder to prove, and the proof matters most on the day something breaks. These eight checks take an afternoon and turn a marketing claim into evidence you can put in a vendor file.

**Key takeaways**

- Custody is a question of control: who can move the value without your signature, and for how long.
- On EVM chains, check that the approval you sign covers the quoted amount, not an unlimited allowance.
- A provider-held "balance" in a dashboard means someone custodies it. Find out who.
- Run failure tests in the sandbox. Where funds go when a payout fails tells you more than any diagram.
- Many products mix models. Ask which features are custodial, not whether the company is.

## What does "non-custodial" actually mean for a payment provider?

It means the provider never holds your funds under its own independent control beyond the single transaction you authorized. You keep the keys, you approve each movement, and value does not sit in a provider account between payments.

> **Definition:** A **non-custodial payment provider** executes a payment you authorize from a wallet or account you control, without taking ownership of the funds or holding them as a balance on your behalf. A **custodial** provider holds the funds in accounts or wallets it controls and owes you a balance.

US regulators drew the same line years ago. FinCEN's May 2019 guidance ([FIN-2019-G001](https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-certain-business-models)) calls wallets where third parties control user funds "hosted" and wallets where users control funds "unhosted". It looks at four criteria: who owns the value, where it is stored, whether the owner interacts directly with the payment system, and whether the intermediary has total independent control over the value. Those four questions are a good frame for every check below.

For the conceptual background, start with [non-custodial payments explained](/resources/more/non-custodial-payments-explained) and the [custodial vs non-custodial wallet comparison](/resources/more/custodial-vs-non-custodial-vs-mpc-wallets). This page is the test plan.

## Why bother checking? What goes wrong when custody is unclear?

Custody decides who owns the money if the provider fails. Two recent cases show the cost of guessing wrong.

In January 2023, the judge in the Celsius bankruptcy ruled that assets in its Earn accounts belonged to the bankruptcy estate, because the terms of use transferred title to Celsius ([Axios](https://www.axios.com/2023/01/04/celsius-bankruptcy-earn-accounts)). Customers became unsecured creditors. In the Synapse case, the CFPB alleged the company failed "to maintain adequate records of the location of consumers' funds", and partner banks found a shortfall of between $60 and $90 million ([CFPB](https://www.consumerfinance.gov/enforcement/actions/synapse-financial-technologies-inc/)).

Neither was a blockchain hack. Both were questions of who held what, on paper and in practice. [What happens if a stablecoin payment provider fails](/resources/more/what-happens-if-a-stablecoin-payment-provider-fails) walks through the insolvency scenarios in more detail.

## What are the 8 checks?

Run them in order. The first four need documents and a block explorer. The last four need a sandbox account and an hour of a solutions engineer's time.

| # | Check | Evidence to ask for | Passes when | Warning sign |
| --- | --- | --- | --- | --- |
| 1 | Flow of funds | A diagram of every account and wallet the money touches | Each step names who controls the value and for how long | "Funds are pooled" with no detail |
| 2 | On-chain authorization | The approval or signature your wallet produces | Amount equals the quoted payout | Unlimited allowance, or a transfer to a provider address |
| 3 | Stored balance | Dashboard and API objects | No provider-held balance on the non-custodial path | A "balance" you cannot see on-chain |
| 4 | Title in the terms | Terms of service, customer agreement | You keep ownership of funds in transit | Language that transfers title to the provider |
| 5 | Keys | Wallet setup docs | You hold the keys, or the custodial option is labeled as such | Vague answers about key management |
| 6 | Failure path | Sandbox test of a failed or refunded payout | Funds return to a wallet you control, with a transaction hash | "Contact support" as the only answer |
| 7 | Fiat leg | Settlement and reconciliation records | Records match the bank's at every step | Records that only exist in the provider's ledger |
| 8 | Exceptions | Written list of custodial features | Custodial features are named and opt-in | "We are fully non-custodial" with no exceptions listed |

## How do you check the on-chain authorization?

Open the approval transaction on a block explorer and read two fields: the spender and the amount. If the amount equals the quoted payout, your exposure is limited to that payment.

On EVM chains, stablecoins are ERC-20 tokens. A provider that pulls funds asks your wallet to call `approve` on the token contract, naming its contract as the spender. The explorer shows the exact allowance. An allowance of the maximum integer value is a standing permission to pull more later. That is not custody in the legal sense, but it is control in the practical one.

Other chains use different mechanics. Stellar uses a signed transaction, and Solana uses token delegation for a set amount. The test is the same: the authorization should be scoped to one payment. If instead the flow asks you to send funds to a provider address first, the provider holds them until it pays out, and you are in a custodial step.

## How do you test the failure path?

Create a payout in the sandbox that is designed to fail, then follow the money. A non-custodial provider returns funds to a wallet you control and gives you a transaction hash you can verify.

Ask the provider how to force each terminal status in development. Some APIs use sentinel amounts that trigger `failed` or `refunded` outcomes on purpose. Then check three things: which wallet received the refund, whether the refund happened on-chain, and whether a human had to approve it. [Stablecoin payout statuses explained](/resources/more/stablecoin-payout-statuses-explained) covers what each status means.

Be precise about what you learn. Some refunds are automatic, others go through a review queue. Neither is wrong, but you need to know which applies to your rails so your support team can answer the recipient.

## What if the provider is custodial for part of the flow?

That is normal, and it is fine if it is disclosed and protected. Many products offer an optional hosted wallet next to a non-custodial payout path. The question is whether you know which one you are using.

When a step is custodial, ask how the provider protects you. New York's Department of Financial Services updated its guidance on [custodial structures](https://www.dfs.ny.gov/industry-guidance/industry-letters/il20250930-updated-guidance-custodial-structures) on September 30, 2025. It expects custodians to segregate customer assets on-chain and in internal ledgers, keep an audit trail for omnibus wallets, and make sure the beneficial interest always remains with the customer. That is a useful benchmark even outside New York. Regulatory treatment of custody varies by jurisdiction, so treat it as a reference, not a rule that applies to every provider.

## How does BlindPay answer these checks?

BlindPay operates as a non-custodial payment processor for payout flows from customer-controlled wallets: you authorize the exact amount and BlindPay executes that single transaction. On EVM chains that authorization is an ERC-20 `approve` for the quoted amount, returned in the [payout quote](/docs/payout-quotes). Stellar uses a signed transaction and Solana uses token delegation ([payouts](/docs/payouts)).

If a payout cannot be delivered after the stablecoins are collected, BlindPay refunds them to the quote's refund wallet, or to the sending wallet when none is set. On Pix and other non-USD local rails the refund is automatic, while USD payouts and payouts whose review times out are refunded after an operator review.

Optional BlindPay-managed wallets (beta) are custodial when you choose that path ([managed wallets](/docs/wallets)). That is the exception list for check 8, in writing. Development instances let you force a `refunded` outcome with a sentinel amount, so you can run check 6 before you sign anything.

## What should you do next?

Put the eight checks in your vendor file and ask every shortlisted provider for the evidence in the table. Pair it with the [30 due diligence questions](/resources/more/stablecoin-payments-provider-due-diligence) and the [custody risk questions for off-ramps](/resources/more/custodial-vs-non-custodial-off-ramps). If blockchain rails are new to your team, [blockchain payments vs crypto payments](/resources/more/blockchain-payments-vs-crypto-payments) explains the basics first.

Run check 6 yourself on a BlindPay development instance by following the [payout quickstart](/docs/quickstart-payout).