Custodial vs. Non-Custodial Wallets Explained

Ask any crypto product team one question and you learn almost everything about the wallet: who can move the funds without the user doing anything? The answer sorts every wallet design into custodial or non-custodial, and it is the single most consequential decision behind any wallet architecture.

This guide lays out the spectrum between fully custodial and full self-custody, where MPC-based wallets sit on it, and why the distinction carries real regulatory and trust weight for fintechs.

What is the difference between custodial and non-custodial wallets?

A custodial wallet is one where a third party, typically an exchange or wallet provider, holds the private keys and can move funds on the user's behalf. A non-custodial wallet keeps control with the user, either because the user alone holds the key or because the architecture structurally prevents any single party from signing without the user's participation. The dividing line is authority, not convenience or who built the software.

This distinction is easy to blur because custodial and non-custodial wallets can look identical to a user. Both might offer email login, a clean interface, and instant transactions. The difference lives entirely in the backend: who actually holds the power to sign.

The custody spectrum

Custody is not binary in practice, even though the definition is. It helps to see it as a spectrum from full custody to full self-custody, with meaningfully different points in between.

| Model | Who controls signing | Typical trade-off | |---|---|---| | Fully custodial | Provider holds keys and signs for users | Simple for users, but provider risk and regulatory exposure concentrate entirely on one party | | MPC shared control | Key shares split across user and provider; neither alone can sign | Non-custodial in practice when the user's share is required; balances security and convenience | | Smart contract wallet | Onchain logic and signer rules the user configures | Programmable and recoverable, but adds contract risk and gas considerations | | Full self-custody | User alone holds the key or seed phrase | Maximum control, but total responsibility and no safety net if the key is lost |

Most consumer-facing crypto products today sit somewhere between fully custodial and MPC shared control. Full self-custody remains important for crypto-native users who want it, but it is a poor default for mainstream products, since a lost seed phrase means permanently lost funds with no recovery path.

What determines where a wallet sits on the spectrum

Two questions place any wallet on the spectrum precisely. First: can the provider produce a valid signature without the user's participation? If yes, no matter how the marketing describes it, the wallet leans custodial. Second: can the user export their key or migrate away without the provider's permission? If yes, that is a strong signal of genuine non-custodial design, since it proves the user was never dependent on the provider's goodwill.

MPC wallets illustrate why the label depends on implementation, not technique. If a provider holds enough key shares to reach the signing threshold alone, the wallet is functionally custodial regardless of how advanced the cryptography is. Genuinely non-custodial MPC requires that the user's share be necessary for every signature, so the provider physically cannot move funds alone. Our MPC wallet explainer covers how the key-share math works underneath this.

Para's Distributed MPC keeps a share bound to the user's device through a passkey. That share is required for every signature, so Para cannot sign on a user's behalf. That is what makes the wallet non-custodial by design rather than by promise.

Why this matters for fintechs

For a fintech or neobank adding crypto features, custody is not just an engineering choice. It shapes regulatory obligations directly. Holding user funds custodially typically triggers money-transmission licensing requirements in the United States and comparable obligations elsewhere, along with the compliance overhead and liability that come with directly controlling customer assets.

Non-custodial infrastructure changes that calculation. When a fintech integrates a non-custodial wallet provider, the fintech itself never holds the keys, and neither does the provider alone. That structure simplifies regulatory classification in many jurisdictions, because the fintech is offering a technology integration rather than acting as a custodian of customer funds. It does not eliminate the need for legal review, since rules vary by jurisdiction and product, but it removes the heaviest category of obligation from the table.

There is a trust dimension too. Fintech customers who are trusting a brand with stablecoin balances or onchain payouts benefit when that brand can honestly say it never holds their keys. It is a concrete answer to "what happens if you get hacked or go out of business," which matters more in financial products than almost anywhere else in software.

What non-custodial means for embedded wallets specifically

Embedded wallets sometimes get assumed to be custodial by default, since the provider handles so much of the infrastructure. That assumption is wrong. Custody depends entirely on the key management design underneath, not on whether the wallet happens to live inside an app. A well-built embedded wallet using MPC, where the user holds a required device-bound share, is non-custodial in exactly the same sense as a hardware wallet, even though the user experience feels like an ordinary account.

This is one of the most important questions to ask any wallet-as-a-service provider before integrating: is the embedded wallet you provision for my users custodial or non-custodial, and how do you prove it? A provider that cannot answer clearly, or that hedges the question, is telling you something important.

Para's approach

Para wallets are non-custodial by design. Distributed MPC splits key generation and signing across the user's device and Para's infrastructure, and the user's passkey-protected share is required for every transaction. Para cannot access or move user funds, users can export their keys at any time, and the architecture is independently audited by Least Authority and SOC 2 Type II compliant. This runs at scale across 15M+ wallets and partners including ENS, Vana, and Camp Network. See the full architecture at the Para docs, or read our breakdown of what to look for in an embedded wallet provider for the questions that reveal a provider's true custody model.

Frequently asked questions

What is the difference between a custodial and non-custodial wallet?

A custodial wallet has a third party holding the private keys and able to move funds on the user's behalf. A non-custodial wallet keeps control with the user, or structurally prevents any single party from signing alone, as with MPC. The core question is always who can move the funds without the user's direct action.

Are embedded wallets custodial?

Not necessarily. Custody depends on the key management design, not on whether a wallet is embedded. A well-built embedded wallet using MPC, where the user holds a required device-bound share, is non-custodial even though the provider handles the infrastructure.

Why does custody matter for fintechs?

Custody affects both risk and regulatory classification. Holding user funds custodially typically brings money-transmission obligations and concentrates risk in one party. Non-custodial infrastructure lets fintechs offer wallet features without taking on custodial liability or classification in many jurisdictions.

Can a non-custodial wallet still lose user funds?

Non-custodial does not mean risk-free. Bugs, phishing, and device loss can still affect users. What non-custodial removes is the risk that the provider itself, through negligence, insolvency, or compromise, can access or move funds. Good design pairs non-custodial architecture with strong recovery and authentication.

Is MPC always non-custodial?

No. MPC is a technique, not a guarantee. If a provider holds enough key shares to reach the signing threshold alone, the wallet is functionally custodial regardless of the cryptography used. Genuinely non-custodial MPC requires the user's share to be necessary for every signature.