Non-custodial means the processor never touches your money. The customer pays. The funds land directly in your wallet on confirmation. There is no middle account, no "processor balance," no one with the authority to freeze your access. Custodial is the opposite: the processor holds the funds in their wallet, then forwards to you on a schedule and a set of conditions they control.
That is the one-paragraph answer. Everything else is footnotes. Here are the footnotes worth knowing.
The $15 billion teaching moment
Custodial models are not theoretical risk. Since 2014, more than $15 billion has been lost to custodial platform failures, including FTX, Celsius, Mt. Gox, BlockFi, and Voyager.
The Celsius collapse in June 2022 is the cleanest illustration. Celsius was custodying customer funds while promising up to 18 percent yield on deposits. Withdrawals were frozen overnight. $4.7 billion in customer balances were locked. In the subsequent bankruptcy proceedings, the US Bankruptcy Court for the Southern District of New York held that "Celsius' Terms of Use made clear that customer deposits into Earn Accounts became Celsius' property at the time of deposit."
That is the structural property of custodial: the moment funds land at the custodian, the customer's claim is contractual, not proprietary. The funds are not yours. They are an IOU you hold against the custodian.
FTX is the same lesson at larger scale. The world's second-largest crypto exchange held $8 billion of customer funds that were not recoverable in bankruptcy. Customer balances at FTX were not customer property in any legally meaningful sense. They were a line item on FTX's balance sheet.
The same logic applies to a custodial payment processor. When BitPay, Stripe, or NOWPayments holds your settlement balance before forwarding it to you, that balance is the processor's property. If the processor goes bankrupt, becomes a target of a regulatory freeze, or decides your account is "under review," your money is the processor's asset, not yours.
Why custodial models persist anyway
Three reasons custodial models continue to dominate despite the $15 billion warning sign.
Operational simplicity for the merchant. A custodial processor handles wallet operations, key management, gas fees, and on-chain failure modes on behalf of the merchant. The merchant gets a dashboard and a payout schedule. The cognitive overhead is similar to using Stripe for cards.
Regulatory familiarity. Custodial processors fit cleanly into existing money-transmitter licensing frameworks. The processor is regulated as a money services business. Banks know how to work with them. Auditors know how to audit them. Compliance teams know how to model them.
Fiat off-ramp by default. Custodial processors can convert incoming crypto to fiat on the fly because they have banking relationships and FX desks. Non-custodial processors traditionally required the merchant to handle off-ramp separately.
The third reason is the only one that still has weight in 2026. The first two are inertia.
What non-custodial actually fixes
Non-custodial rails fix the structural problem at the cost of slightly more operational responsibility on the merchant side.
No counterparty failure risk. The rail cannot go bankrupt with your money because the rail never holds it. The chain holds it (briefly, during confirmation) and then your wallet holds it. If the rail's company shuts down tomorrow, your past payments are unaffected because they already settled on-chain.
No account termination cliff. A custodial processor can decide your merchant category is too risky and freeze you mid-week. A non-custodial rail has no comparable lever. The rail cannot freeze a wallet it does not control.
No "under review" delays. Custodial payouts are subject to processor-side hold logic: unusual volume triggers a review, a chargeback ratio breach delays a payout, a regulatory inquiry pauses all settlements while the processor responds. Non-custodial payouts are unconditional. The transaction either confirms on-chain or it does not. There is no third state.
Better tax and audit posture. Funds that never touched a third-party intermediary have a cleaner audit trail. The chain is the receipt. There is no "processor reconciliation" step to perform.
The 2026 regulatory wedge
The regulatory framework in 2026 is starting to formalize the distinction between custodial and non-custodial.
MiCA in the EU became fully applicable in June 2026 and imposes new obligations on custodial crypto services: minimum capital requirements, segregation of customer funds, mandatory insurance for asset losses. The compliance cost for custodial processors rose materially. Non-custodial protocols largely fall outside this perimeter because they have no customer funds to segregate.
In the US, the FDIC approved a proposed rule on April 7, 2026 establishing custody and reserve standards for crypto under the GENIUS Act. Custodial processors must now hold 1:1 reserves of customer-deposited stablecoins in segregated bank accounts. The rule is a direct response to the FTX and Celsius collapses. It tightens what custodial means and what custodial costs.
The implication: custodial processors are getting more expensive to run (compliance overhead) and the cost will flow through to merchant fees. Non-custodial rails do not carry that overhead.
The trade-off you actually make
The non-custodial trade-off is operational. You hold the wallet, so you are responsible for the wallet. If you lose the private key, the rail cannot recover it. If you sign a transaction to a wrong address, the rail cannot reverse it. The processor's "we hold it for you" insurance does not exist.
For most merchants this is a smaller problem than it sounds. Modern non-custodial rails support multisig wallets, hardware-wallet integration, social-recovery schemes, and dedicated treasury solutions like Fireblocks or Gnosis Safe that solve the operational concerns without giving up custody.
Plaitr's model on this: the merchant connects an existing wallet (any EVM-compatible wallet, hardware-backed or smart-account). That wallet is the only identity Plaitr knows about. Funds settle directly to the wallet. Plaitr never holds the value, never has custody, and never has the technical ability to freeze the wallet. If the merchant uses a Safe multisig, the security is whatever the multisig is configured for.
How to test which model a "processor" actually uses
The marketing language is fuzzy. "Non-custodial" gets used by processors that briefly hold funds in a "settlement pool" before forwarding. That is custodial with extra steps.
The test: ask the processor where your funds physically live between the customer payment and your receipt. If the answer involves a wallet the processor controls (even briefly), it is custodial. If the answer is "directly to your wallet on confirmation," it is non-custodial.
The second test: ask what happens if the processor's company shuts down tomorrow. If past customer payments are still recoverable because they already landed in your wallet, it is non-custodial. If they require the processor's continued operation to disburse held balances, it is custodial.
What to do this week
Audit your current processor against the two tests above. Most merchants will discover they are using a custodial processor without having explicitly chosen one. The non-custodial option is usually a checkbox they did not know existed.
If you operate at a volume where a custodial freeze would meaningfully damage the business (anything over $50K/month is a fair threshold), the migration to non-custodial is a one-week engineering project that pays itself back the first time a custodial processor sends you an "under review" email.
The one-paragraph answer is non-custodial. The whole-page answer is the same answer with the receipts attached.