Custodial vs Non-Custodial vs Hybrid Crypto Payment Gateways: Who Controls Your Revenue?

The customer has paid. The order is ready to ship. Finance still needs to know whether the proceeds are coins the business controls, a processor balance awaiting settlement, or cash already in the bank.

Traditional payment processing also separates acceptance from payout. Crypto adds another question: who can authorize a transfer of the incoming funds? Choosing between custodial, non-custodial and hybrid gateways means answering both questions. Control over receipt and certainty of usable settlement are different things. A good arrangement must fit the business’s needs for both.

What the three arrangements actually divide

Start with authority over the receiving wallet, rather than the features listed beside a product label. Who controls the private keys? Who can authorize an outgoing transfer? Does the merchant receive funds directly, or acquire a balance that another party must settle?

This is also the distinction between wallet infrastructure and payment infrastructure. A receiving address does not, by itself, match payments to orders, establish how underpayments are handled, arrange conversion or reconcile payouts. Those are payment-service responsibilities, whether the merchant or a provider performs them.

Custodial: the provider authorizes movement

In a custodial receiving wallet, the provider controls the private keys and can authorize transfers. The merchant depends on the provider to move or release those funds under the agreed terms. Access to a dashboard is not equivalent to authority over the wallet.

A custodial crypto payment gateway delegates that part of the operation. It does not, just by being custodial, promise fiat conversion, a particular payout schedule or comprehensive refund handling. Those services must be established separately.

Non-custodial: the merchant retains transfer authority

With a non-custodial crypto payment gateway that routes payments to a merchant-controlled wallet, the merchant retains authority over outgoing transfers. The gateway may support payment detection and reporting, but the business does not need the gateway to release funds already received into that wallet.

That independence has a boundary. The merchant can still depend on other parties for checkout services, conversion and banking access. It also retains responsibility for protecting the keys and operating the wallet. Direct receipt is control over an asset—not a complete treasury operation.

Hybrid: control is explicitly divided

“Hybrid” is not a standardized third custody model with predictable protections. It is useful only when the division of authority is clear; a particular key-management technology does not establish that division on its own.

For example, a merchant could receive funds into its own wallet, then separately authorize a transfer to a provider for managed conversion and bank payout. The merchant controls receipt; the later stage depends on the conversion provider’s execution and settlement terms. This illustrates divided control, not a definition of how every hybrid crypto payment gateway works—or a guaranteed middle ground.

Why the custody label can still mislead

A provider’s software wallet and its merchant-processing service can allocate control differently. Understanding one does not necessarily explain the other.

BitPay’s merchant terms effective 1 April 2026 illustrate the distinction. They describe its Acceptance Services as not providing cryptocurrency custody, while also stating that merchants have no claim against the actual cryptocurrency received and that account-ledger entries represent funds temporarily held until settlement. Its separate wallet terms describe software through which BitPay has no access to users’ keys or funds.

The practical lesson is not to override the provider’s terminology. It is to ask what the merchant actually receives under the relevant service: funds in a wallet it controls, or an entitlement awaiting settlement? A provider’s name—or the phrase “non-custodial”—cannot answer that across every product and processing stage.

Follow the revenue from receipt to usable settlement

Receipt, conversion and final delivery answer different finance questions. Receipt establishes that the customer’s payment has arrived at the designated destination. Conversion, if needed, changes the asset or currency. Final delivery puts the settlement funds where the business intends to use them.

These stages can be bundled into one service, but a completed payment status is not evidence that a bank payout has arrived. Likewise, selecting crypto settlement does not establish that the merchant already controls the coins due to it.

A non-custodial crypto payment gateway can be part of a fiat-settlement arrangement. Direct wallet receipt simply does not perform that conversion on its own. The business needs a route from the received asset to bank currency, including authorization to move the funds, an available conversion service and a supported payout destination. The gateway may coordinate that route, or the merchant may arrange it separately.

Stablecoin settlement requires the same precision. Receiving a stablecoin into a merchant-controlled treasury wallet may be the desired endpoint, but it is not a bank deposit. If a supplier requires fiat tomorrow, neither a stablecoin balance nor a processor balance awaiting payout necessarily funds that bill.

For a fiat-funded business, conversion and payout conditions deserve as much attention as key ownership. Timing, minimums, banking availability and conditions permitting settlement holds affect when proceeds become usable. Finance needs to distinguish funds received, funds being converted and funds delivered—not treat them all as equally available.

Control determines who has to act

Merchant-controlled keys move more security and operational work inside the business. Access protection, backups and the devices used to authorize transfers become direct merchant responsibilities. Approval arrangements also need to work when a usual signer is unavailable. Otherwise, control can coexist with an inability to make a necessary transfer.

Managed processing delegates some of that work, not all security responsibility. Merchant account credentials and payout destinations still need protection. BitPay’s terms, for example, assign merchants responsibility for their credentials and chosen settlement-wallet security, and state that BitPay cannot recover funds lost through a compromised wallet. The useful security comparison is between responsibilities retained and delegated—not between “safe” and “unsafe” models.

Refunds expose the same division. After receipt into a merchant-controlled wallet, a refund requires a newly authorized outgoing transfer. The business needs someone with authority to approve the commercial refund and someone able to execute it securely; those need not be the same person.

Under managed processing, the merchant may decide whether a refund is owed while the provider executes it under its terms. The agreement must establish which balance funds the refund and what happens if that balance is insufficient. Outsourcing execution does not necessarily outsource the refund decision or its cost.

An incorrect payment is different from refunding a valid purchase. With an underpayment or payment sent to an unsupported destination, first establish whether the merchant was credited, whether the funds are recoverable and who has authority to return them. The normal refund workflow may not apply.

When conversion fails, control determines who can take the next step. While the crypto remains in a merchant-controlled wallet, the merchant retains authority to authorize another action. After funds have been transferred to a converter or processor, the merchant depends on that party for actions under its control. Further execution and any remedy depend on the agreed obligations; return of the funds, completed conversion or payout should not be assumed.

Settlement failures can also change the asset outcome, not just the delivery date. BitPay’s terms say that if a chosen cryptocurrency settlement cannot be completed, the account balance is fixed at its USD or EUR value when settlement otherwise would have occurred. A later crypto payout is calculated from that fixed fiat value, so its coin quantity may differ from the quantity originally expected. This is a concrete reason to distinguish an expected crypto payout from crypto already under merchant control.

Choose the operating model your business can sustain

If the business wants to retain crypto or stablecoins and has the capacity to secure keys and execute transfers, merchant-controlled receipt can align closely with its treasury needs. The selection work then shifts to payment handling and any conversion route still required.

If operations depend on bank currency arriving on particular dates, evaluate conversion and payout performance before treating custody as the deciding feature. Managed processing may reduce internal execution work, but that benefit must be weighed against dependence on the provider’s settlement terms. A divided arrangement is useful only if the handoffs are clear and responsibility for failures between them is assigned.

Compliance and liability require a separate assessment. Neither direct wallet receipt nor use of a managed processor establishes a licensing status, exemption from verification or responsibility for a particular loss. Those conclusions depend on the actual activities, relevant jurisdictions, applicable law and agreements. Provider compliance commitments can coexist with merchant obligations and contractual limits on provider liability.

Before choosing, ask the provider to explain one successful payment and one payment that fails after receipt. Each explanation should make clear who holds the funds, who can authorize the next action, what the merchant is owed and who must resolve the exception. That reveals more than the model label alone.

Conclusion

The right gateway combines the control your business wants with a settlement process it can rely on. Compare who receives and moves the funds, how conversion works and when proceeds become usable. Then match the responsibilities you retain to the team that will carry them.

For requesting more information about how we can help reach out to us. We're here to help and answer any questions you may have.

Contact us!