How wallet as a service works
The company calls the provider's API to create a wallet, get deposit addresses, read balances and submit transfers. The provider runs the nodes, watches the networks, estimates fees and reports events by webhook.
Keys are generated and protected by the provider's systems, most often with multi-party computation or hardware security modules. A policy engine applies the company's rules before anything is signed:
- Spending limits per transaction and per day
- Address allow-lists
- Approval by several people for large amounts
- Screening of destination addresses
Who is the custodian in wallet as a service
Three models exist. The provider controls the keys and is the custodian, or the company controls them and the provider supplies only technology, or the end user holds a key share and nobody else can sign alone.
In the EU, MiCA defines custody as safekeeping or controlling, on behalf of clients, crypto-assets or the means of access to them, and the service needs authorisation. Recital 83 says that hardware or software providers of non-custodial wallets should not fall within the regulation's scope.
The model, and which of the two firms holds the authorisation, is therefore the first thing a wallet-as-a-service contract settles.
Wallet as a service, embedded wallet or custodian?
- Embedded wallet
- The wallet an end user sees inside an app. Wallet as a service is the infrastructure behind it.
- Custodian
- A regulated firm that holds assets for clients. A wallet-as-a-service provider may be one, or may only supply software.
- In-house key management
- The same stack built and run by the company: more control, and the full burden of security and upkeep.
Where Wallet as a service shows up in a platform
Modules that do the work
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- BackofficeOne console to run the platform: customers, money, risk, content and staff permissions.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.