Custodial vs non-custodial: which model to choose

Every founder building a crypto and fiat product hits the same fork early, and it is not a UI decision. It is who holds the keys. That single choice shapes your security posture, your liability, your licensing conversation and how a partner bank or auditor will view you.

The word “custody” causes confusion because it sounds like a storage question. It is really a control question. Whoever controls the private keys controls the money, no matter which brand name sits on the app. This guide breaks down the two models, walks through the reasons a non-custodial wallet fits B2B infrastructure, and lists what to weigh before you commit. For the wider build, see the pillar on how to build a crypto and fiat payment platform.

Custodial vs non-custodial in one line

Custody is the control of private keys. In a custodial model a third party holds those keys and can move funds for the user. In a non-custodial model the user holds their own keys and every movement needs their approval. Everything else, wallet type, security stack, insurance, follows from that one distinction.

Here is the comparison at a glance.

Dimension	Custodial	Non-custodial
Who holds the keys	The provider or platform	The end user
Who approves a transfer	The provider, on the user’s behalf	The user signs each movement
Counterparty risk	Concentrated in the provider	Removed at the provider level
Safeguarding burden	On the provider’s balance sheet	Reduced at the provider level
Typical licensing exposure	Higher (holding client funds)	Often lower (agent of licensed partners)
Recovery if keys are lost	Provider can often help	Depends on the user’s backup
Best fit	Simplicity, managed treasury	Control, lower regulatory surface

Neither column is universally correct. The right answer depends on what you are building, who your users are and which markets you serve. What follows is why non-custodial has become the default for B2B payment infrastructure, and where custodial still earns its place.

6 reasons a non-custodial model fits B2B fintech infrastructure

1. It removes counterparty risk at the platform level

When users hold their own keys, you are not a pooled honeypot of client funds. The single largest failure mode in this industry, a platform that is hacked or becomes insolvent and cannot return balances, does not apply the same way when you never hold the money. Users carry their own asset directly rather than a claim against you.

2. It shrinks your regulatory surface

Holding customer funds pulls you squarely into safeguarding and money-transmission rules. A non-custodial design means you never take custody, which for many products is the difference between needing a heavyweight licence yourself and operating as an agent of licensed partners. It does not erase compliance, but it changes the conversation. Map this perimeter with counsel early, and see our guide on licensing to move crypto and fiat.

3. It reduces what you have to safeguard

The less customer money that touches your balance sheet, the smaller your attack surface and your audit scope. You still run serious security, but you are protecting infrastructure and access, not a central vault of everyone’s assets. That is a materially easier posture to defend to a partner bank.

4. It keeps compliance obligations intact where they belong

Non-custodial is not a compliance shortcut. KYC and KYB at onboarding, sanctions and PEP screening, transaction monitoring and travel-rule data still apply. The point is that a non-custodial architecture lets those controls run in the flow without also making you the safekeeper of client funds. For how these checks work end to end, read how KYC and AML work for crypto and fiat payments.

5. It still supports real products, including cards

A common myth is that non-custodial means limited. It does not. A card can spend directly from a non-custodial balance, with the wallet connected to the card network so purchases settle against the real-time balance, plus limits, freeze controls and 3-D Secure. See card issuing that spends from a crypto or fiat balance.

6. It gives users control they increasingly expect

After several high-profile platform failures, “not your keys, not your coins” is now a mainstream expectation, not a niche slogan. Offering genuine control is a trust signal, and for many B2B customers it is a procurement requirement rather than a nice-to-have.

4 things to consider before you commit to non-custodial

Non-custodial is not free of trade-offs. Weigh these honestly.

1. Key recovery is harder

If a user loses their keys and their recovery material, funds can be unrecoverable. Custodial providers can often reset access; pure self-custody cannot. Modern schemes such as multi-party computation and social or policy-based recovery soften this, but recovery design is now your responsibility, not an afterthought.

2. User experience needs care

Asking users to approve every movement and guard a recovery phrase adds friction. Good non-custodial products hide the cryptography behind clean flows and sensible defaults, but you must design for the moment a non-technical user faces a signing prompt or a backup step.

3. Some use cases genuinely need custody

Managed treasury, certain regulated products, and flows where a business must move client funds on their behalf can require a custodial or regulated-custodian arrangement. The honest answer is that many platforms end up with a hybrid, non-custodial for user balances and a regulated custodian for specific pooled or institutional funds.

4. Segregation and treasury still matter for B2B

Even non-custodial, a B2B platform handling any operational or client-adjacent funds needs clean segregation, auditable movement and clear treasury policy. Non-custody reduces the surface; it does not remove your duty to run funds cleanly and prove it on demand. This pairs naturally with multi-currency accounts and a unified ledger.

Wallet types at a glance: hot, cold and hardware

A wallet is just where keys live and how they sign. The choice is a balance between how often funds move and how much is at stake.

Wallet type	Connectivity	Typical use	Trade-off
Hot wallet	Online	Active balances, frequent movement	Convenient, larger attack surface
Cold wallet	Offline	Long-term holdings, reserves	Very secure, slower to use
Hardware wallet	Offline device	Personal and treasury holdings	Strong key isolation, physical to manage

Most serious setups combine them: a small hot balance for day-to-day flow and the bulk in cold or hardware storage. The same logic applies to a business treasury, where operational float sits hot and reserves stay cold.

Security under the hood: MPC, multisig and HSMs

Custody security is mostly about how signing authority is protected and split. Three techniques dominate, and they can be combined.

• Multi-signature (multisig): a transaction needs several independent keys to approve, so no single key or person can move funds alone.
• Multi-party computation (MPC): the signing key is never assembled in one place; independent parties jointly compute a signature, removing the single point of compromise.
• Hardware security modules (HSMs): tamper-resistant hardware that stores keys and performs signing so raw keys never leave the secure boundary.

For an infrastructure provider, the goal is that no single device, server or employee can move funds unilaterally, and that every approval is policy-driven and logged. These techniques serve both custodial and non-custodial designs; the difference is who sits inside the approval policy.

Custody, regulation and compliance (with a Mexico note)

Custody choices are inseparable from regulation, and the rules vary by market. As a general principle, jurisdictions increasingly distinguish between platforms that hold client crypto (which attracts safeguarding, capital and reporting duties) and non-custodial software that never controls user funds.

In Mexico, virtual asset activity sits within the Fintech Law framework, with the CNBV and Banco de México as the relevant authorities, and holding or operating virtual assets on behalf of clients carries specific obligations. Treat this as a general orientation only, because thresholds, authorizations and the exact perimeter change over time and by activity. Confirm the current position for your model with local regulatory counsel before you rely on it.

Two points hold across markets. First, regulated or “qualified” custodians exist precisely for institutions that must delegate custody under supervision, often with insurance over assets under custody, though coverage terms and limits vary and should never be assumed. Second, whichever model you pick, KYC, AML and monitoring obligations follow the activity, not the custody label.

Best practices for keys and recovery

Whatever model you land on, a few practices are non-negotiable.

• Protect the recovery phrase like the asset itself. It is the master key. Store it offline, never in plain text, and never in a screenshot or cloud note.
• Separate hot and cold. Keep only working balances online; hold reserves in cold or hardware storage.
• Design recovery before you launch. Decide how a user (or your treasury) regains access after device loss, using multisig, MPC or policy-based recovery, and test it.
• Enforce approval policies. Require multiple approvers for large or unusual movements, and log every signature for audit.
• Prove segregation on demand. Keep client and operational funds clearly separated and reconcilable at any moment.

Where Tokelia fits

Tokelia is built non-custodial by design: end users keep control of their own funds and every movement needs their approval, so you launch a real payment product, virtual accounts, unified crypto and fiat rails, card issuing and cross-border payments, without holding customer money on your balance sheet. Compliance is built into the base stack rather than sold as add-ons. Money services are provided by Tokelia LLC, a company registered as a Money Services Business with FinCEN, with regulated banking delivered by licensed institutions.

If you are weighing custodial against non-custodial for your own product, the fastest way to pressure-test it is to walk a real flow with our team. Talk to us and we will map it to your use case and markets.