Custodial vs. Non-Custodial Wallets: Which One Should Your Platform Build?

Most providers choose one wallet model. That’s usually the right call. The hard part is choosing the one that fits your product, your users, and the work your team is prepared to take on.

Quick definitions:

• Custodial wallet: A licensed third party holds the private keys for the user.
• Non-custodial wallet (also called an embedded wallet or self-custody wallet): The user holds the private keys. Your business provides the login and interface, but it never controls the keys.

Think of valet parking. With a custodial wallet, you hand the keys to someone else. They look after the car and can help if you lose your claim ticket, but they control access while it is with them. With a non-custodial wallet, the keys stay in your pocket. No one else can move the car, but if you lose the keys and have no spare, you’re stuck.

Who holds the keys decides who is responsible for the funds, what compliance work you take on, and what happens when a user needs help.

Polygon OMS offers both wallet models. We work through this choice with businesses every week. What trips teams up? Picking the model everyone is talking about instead of the one their users need, or underestimating how much work custody creates.

The question that decides everything: who holds the keys?

Every crypto wallet has two basic parts:

• Public key: the address people use to send funds
• Private key: the secret that lets you spend those funds

Whoever holds the private key controls the money. The login, recovery process, and compliance work all follow from there.

• With a custodial wallet, a licensed partner keeps the key. That makes account recovery possible and gives users someone to call when they need help. It also means relying on that partner to keep the funds secure and access available. (Services provided via Coinme, acq. by Polygon Labs)
• With a non-custodial wallet, the user keeps the key. That doesn’t have to mean writing down a 12- or 24-word seed phrase anymore. Passkeys, email or social login, and hardware-secured key generation can handle much of the work in the background. But if a user loses every recovery method, support can’t restore the funds.

Custodial vs. non-custodial, side by side

What each model asks of your team

What a custodial wallet requires:

• A money transmitter license in the US, or virtual asset service provider registration in the EU and many other jurisdictions with a virtual-asset framework
• An AML and KYC program
• Security controls appropriate for qualified custody
• Ongoing regulatory reporting
• In most cases, an audit function

None of this is quick. Becoming a licensed custodian can take several quarters, which is why many teams start with a non-custodial wallet instead.

This is why the Polygon Open Money Stack works with regulated partners. You can offer a familiar login, account recovery, and a support line without becoming the licensed custodian yourself. Regulated service provider partners hold the licenses and take on the custody obligations. Polygon Labs provides the technology that connects your business to those partners. It does not provide custody.

What a non-custodial wallet requires:

• A secure way to generate and store keys, using hardware-secured enclaves rather than plaintext
• A recovery process users can understand, such as passkeys, social recovery, or a seed phrase backup
• Acceptance that a lost key with no backup means a lost account

Today’s embedded wallets make that last outcome less likely. Smart sessions can give someone limited, revocable permission for one action, such as a subscription payment, an in-game purchase, or an automated payout. They don’t have to open up the whole wallet every time.

The user still has legal control. The wallet software simply takes more of the security work off their plate.

Use cases: who tends to choose what?

• A neobank or cross-border fintech may choose non-custodial so people can hold and earn on dollar balances directly. If account recovery and customer support matter more, custody will be a better fit.
• A payment or payout business will often choose custody when merchants want someone else accountable for the money. A business built around contractors or creators may go non-custodial so recipients can hold and move their balance without asking permission.
• A card issuer or treasury team will probably feel more at home with custody and its familiar compliance process. A product built around automated, policy-bound spending may choose non-custodial smart-session wallets instead.
• A marketplace or creator business may choose non-custodial so sellers control their balances. If the product is built around a familiar checkout and recoverable accounts, custody may win out.
• A gaming or prediction-market business will often start non-custodial. It can launch faster, connect directly to dApps, and meet users where they already are.

Which wallet should you build?

Ask yourself three questions:

1. Who are your first users, and what do they expect? People looking for a traditional financial app, including password resets and customer support, will usually prefer a custodial wallet. People who already hold crypto and want to connect to DeFi protocols or NFT marketplaces need non-custodial access because custodial wallets generally can’t connect directly.
2. How much compliance work are you prepared to take on? If becoming a licensed money transmitter or VASP isn’t on the roadmap for the next year, a custodial-only model is unrealistic unless a partner takes on the license. Non-custody usually avoids wallet-specific custody licensing, though other parts of your product may still create compliance obligations.
3. Will one model cover the main use case? If it does, stop there. Add the other model only when a real group of customers needs it and the extra work is worth taking on.

What’s next

Most businesses can choose one model and build a good product around it. The right choice depends on what your customers expect and which tradeoffs your team can handle.

Talk to our team about which Open Money Stack wallet model fits your product, or browse the docs to compare your options.

FAQ

Is a custodial or non-custodial wallet safer?

Neither is always safer. They carry different risks.

Custodial wallets protect people from losing their own keys, but they depend on the custodian’s security and financial controls. Non-custodial wallets remove that dependency, but each person takes responsibility for key recovery.

Can a business offer both custodial and non-custodial wallets to the same users?

Yes, but most businesses choose one. Offering both makes sense when you serve distinct groups with different needs, such as people who want direct DeFi access and people who expect account recovery and customer support.

Do non-custodial wallets require a money transmitter license?

Generally, no. Because the business never takes custody of user funds, businesses offering non-custodial wallets typically fall outside money transmitter and virtual-asset-custody licensing requirements. A custodial wallet usually requires some form of license or registration because a third party holds funds for users.

What happens to custodial wallet funds if the provider fails?

It depends on the custodian’s legal structure and jurisdiction. The funds may become part of a recovery or insolvency process, which is why a business should understand how its custody partner holds assets and what protections apply. Non-custodial wallets don’t carry this specific dependency because no third party holds the keys.

Are embedded wallets the same as non-custodial wallets?

Usually, but check the provider. “Embedded wallet” describes where the wallet appears, inside a product rather than in a separate app. It doesn’t tell you who controls the keys. Most embedded wallets today are non-custodial by design, but the terms aren’t exact substitutes.

Which wallet should a fintech business build?

Start with the model that matches your customers’ behavior. If they want DeFi access or dApp connections, choose non-custodial. If they want customer support, account recovery, and a familiar login, choose custodial.