Why Holding Customer Funds Is the Biggest Liability in Crypto Billing

Imagine you run a popular online store. You process millions of dollars in sales every month. Now imagine that every single dollar sits in a bank account controlled by your payment processor, not you. If that processor gets hacked, goes bankrupt, or decides to freeze your funds because they don't like your business model, your revenue vanishes overnight.

This is the reality for most merchants using traditional custodial crypto billing platforms. In the world of crypto billing, which involves processing digital asset payments for goods and services, holding customer funds has become the single biggest liability on a platform's balance sheet. It creates a massive target for hackers, invites regulatory scrutiny, and turns merchants into unsecured creditors in the event of insolvency.

The industry is shifting away from this risky model. Newer architectures allow payments to flow directly from buyer wallets to merchant-controlled addresses without ever touching the processor's accounts. This shift isn't just about convenience; it's about survival in an increasingly regulated and volatile market.

The Anatomy of Custody Risk

To understand why holding funds is so dangerous, we need to look at what "custody" actually means. When a billing platform holds your money, it acts as a custodian. It controls the private keys required to move those assets. This creates a central point of failure.

Auditors like PricewaterhouseCoopers (PwC) have long warned that custody risk is multi-dimensional. It covers theft of private keys, operational mistakes, and bankruptcy. If a custodian loses control of cryptocurrencies, they must write off the assets but still owe the money back to their clients. That mismatch-zero assets, full liability-is what causes companies to collapse.

In a typical custodial setup, platforms use pooled "hot" wallets. They commingle client deposits so users hold only a debt claim against the platform rather than direct title to specific coins. This makes merchants unsecured creditors if the platform fails. It’s the same structure that led to catastrophic losses in previous exchange collapses, where terms of service promised ownership, but the reality was a simple IOU that became worthless when the company ran out of cash.

Regulatory Hammer: From SAB 121 to MiCA

Regulators worldwide are waking up to this risk, and they aren't taking it lightly. The legal landscape for holding customer funds has tightened dramatically since 2021.

In the United States, the Securities and Exchange Commission (SEC) issued Staff Accounting Bulletin No. 121 (SAB 121) in March 2022. This bulletin instructed entities safeguarding crypto on behalf of users to recognize those assets on their own balance sheets along with a "safeguarding liability" measured at fair value. Essentially, if a platform held $10 million in customer crypto, it had to record a $10 million liability. While updated guidance (SAB 122) in March 2026 scaled this back slightly to a contingency liability framework, the core message remains: holding crypto creates material obligations that must be disclosed and accounted for.

Europe took an even stricter approach with the Markets in Crypto-Assets Regulation (MiCA). Adopted in 2023 and fully applying between 2024 and 2025, MiCA imposes direct liability on crypto-asset service providers (CASPs) for losses of client assets from cyber-attacks, theft, or operational failures. Under Article 75(8), CASPs are liable up to the market value of the lost assets. This means outsourcing custody to a sub-custodian doesn't remove the primary provider's liability.

Canada followed suit in February 2026 with tighter rules requiring detailed disclosures of storage arrangements and establishing explicit legal liability if customer funds go missing due to negligence. Japan also introduced plans for "liability reserves," expecting exchanges to maintain capital buffers proportionate to client balances. The global consensus is clear: if you hold the keys, you own the risk.

The Non-Custodial Alternative

If custody is such a nightmare, how do you bill customers without it? The answer lies in non-custodial gateways, which facilitate transactions without storing user funds. These systems were built explicitly to avoid the liabilities associated with holding funds.

In a non-custodial model, the payment gateway never touches the money. Instead, it generates unique receiving addresses tied directly to the merchant's wallet. When a customer pays, the crypto moves directly on-chain from the customer's wallet to the merchant's wallet. The gateway merely monitors the blockchain for confirmations and triggers webhooks to update the order status.

This architecture relies on extended public keys (XPUBs). A merchant provides their XPUB to the gateway, which derives unique addresses for each invoice. Because the gateway only has the public key, it can verify incoming payments but cannot spend them. Private keys remain solely with the merchant, often stored on hardware devices like Ledger or Trezor.

This setup eliminates several major risks:

• No Counterparty Risk: Since funds never sit in the processor's account, the merchant isn't exposed to the processor's bankruptcy or fraud.
• No Frozen Funds: Traditional processors can freeze accounts for compliance reasons. In a non-custodial system, once the transaction is confirmed on-chain, the money is yours. There is no administrator who can reverse it.
• Reduced Regulatory Burden: Without custody, many KYC (Know Your Customer) requirements vanish. Platforms like TxNod, which operate on this model, allow solo founders and indie hackers to start accepting payments without registering a company or undergoing heavy identity checks.

Comparing Custodial vs. Non-Custodial Models

To see the difference clearly, let's compare the two approaches across key dimensions relevant to merchants and developers.

The table highlights a fundamental trade-off. Custodial gateways offer simplicity but demand blind trust. Non-custodial gateways require a bit more technical setup-like connecting a hardware wallet-but provide mathematical proof of ownership and zero counterparty risk.

Operational Costs and Security Infrastructure

Holding customer funds isn't just legally risky; it's operationally expensive. To comply with regulations like MiCA or SEC guidelines, a custodial platform needs robust security infrastructure. This includes multi-signature wallets, cold storage solutions, daily reconciliations, and dedicated risk teams.

PwC notes that custody requires strict separation of duties in key management, multi-location backups, and physical protection for devices storing private keys. Any gap in these controls introduces fraud risk. For smaller billing platforms, maintaining this level of security is cost-prohibitive. It forces them to either cut corners (increasing risk) or charge higher fees to cover insurance and compliance costs.

Non-custodial processors bypass these costs entirely. Since they don't hold funds, they don't need massive capital reserves or complex safeguarding liabilities. Their operational focus shifts to software reliability-ensuring webhooks fire correctly and invoices are generated accurately. This leaner model allows them to offer lower fees, such as flat subscription models instead of high percentage take-rates on every transaction.

The Rise of Self-Custody for Merchants

The trend toward self-custody mirrors the broader ethos of cryptocurrency: decentralization and personal sovereignty. For merchants, especially solo founders and indie hackers, this means retaining full control over their revenue stream.

Platforms like TxNod exemplify this shift. By integrating with hardware wallets like Ledger or Trezor, merchants can derive payment addresses directly from their own devices. The gateway watches the blockchain and notifies the merchant, but the funds settle straight into the merchant's wallet. There is no intermediate step where the money could be trapped.

This model is particularly attractive for "vibe coders" and small project operators who want to ship quickly without getting bogged down in financial bureaucracy. With tools like TypeScript SDKs that independently re-derive payment addresses locally, developers can verify that the address they're showing customers matches their own wallet keys. It’s a trustless verification loop that removes the need to trust the gateway provider.

Furthermore, the absence of chargebacks and payout holds changes the economic calculus for high-risk verticals. In traditional fiat billing, processors can reverse transactions or hold funds for weeks. In a non-custodial crypto environment, settlement is final. Once the block confirms, the money is yours. This structural finality is a powerful advantage for businesses tired of arbitrary platform policies.

Future Outlook: Liability as a Design Constraint

As regulatory frameworks solidify globally, the liability of holding customer funds will only increase. Regulators are moving toward a regime where custody providers are directly responsible for every loss, regardless of cause. This will likely drive further consolidation among large institutional custodians while pushing smaller players and innovative startups toward non-custodial architectures.

For merchants, the choice is becoming clearer. Do you want to rely on a third party to keep your money safe, hoping their security team is better than the hackers targeting them? Or do you want to keep the keys yourself, leveraging technology that makes custody unnecessary?

The latter option offers peace of mind that no amount of insurance or legal disclaimer can match. In crypto billing, the biggest liability isn't market volatility or slow adoption-it's giving someone else control over your assets. By adopting non-custodial solutions, merchants turn that liability into a non-issue, securing their revenue against the unpredictable nature of centralized finance.