Key Takeaways
- Fintech apps add crypto custody by plugging a non-custodial MPC wallet and compliance layer into their existing stack through APIs, so the core ledger, KYC flow, and app stay intact.
- Non-custodial MPC distributes key shares across the user, the infrastructure provider, and a user-controlled recovery share — removing third-party counterparty risk while keeping a bank-like user experience the user signs with a tap or biometric.
- Regulators now reward that control, as US banks regained custody room in 2025 and the EU has banned outsourcing custody to unauthorized firms since July 1, 2026.
On July 1, 2026, the MiCA transitional period closed across all 27 EU member states. In its final ESMA public statement on the end of the MiCA transition, the regulator reminded firms that custody cannot be outsourced to entities without CASP authorization, even in a B2B setup.
For fintech product teams, that raises the cost of holding customer keys. A growing number are choosing a non-custodial MPC wallet instead, where users control their own assets and the fintech owns the experience around them.
What Crypto Custody Means for a Fintech App
Crypto custody is the control of the private keys that authorize transactions on a blockchain. Whoever can produce a valid signature controls the asset, regardless of what the app balance shows.
Any fintech that lets customers hold, send, or spend digital assets has to decide who signs for them. The table below shows the fintech types that most often add crypto and what they use it for.
| Fintech Type | Primary Crypto Workflow |
| Neobanks and digital banks | Buying, holding, and selling crypto next to fiat accounts |
| Payment apps and PSPs | Stablecoin payments and merchant crypto acceptance |
| Remittance and cross-border apps | Stablecoin transfers that settle in minutes |
| Crypto card programs | Spending crypto balances through Visa or Mastercard cards |
| Brokerages and wealth apps | Crypto and tokenized asset investing |
| Payroll and B2B payment platforms | Stablecoin payroll and supplier payouts |
| Lending platforms | Borrowing against crypto held in the user’s wallet |
Each runs on a fiat ledger, so teams add a wallet layer beside it through APIs.
Custodial vs Seed Phrase vs Non-Custodial MPC Wallets for Fintech Apps
The first product decision is who holds the keys. The table below compares the three options most fintech teams evaluate.
| Factor | Custodial | Seed Phrase Wallet | Non-Custodial MPC |
| Who controls assets | The fintech or its licensed custodian | The end user | The end user |
| How keys are held | Full keys held by the platform | One private key backed up as a seed phrase | Key shares split, and no transfer signs without the user’s share |
| User experience | Familiar login | Seed phrase setup and backup | Bank-like login with biometrics |
| Licensing load | Highest, custody license or licensed partner | Lowest | Lighter, as the fintech cannot move user funds alone |
| Recovery | Handled by the platform | Lost seed phrase means lost funds | User-controlled recovery share |
Non-custodial MPC is the model many fintechs land on because it pairs user ownership with the experience of a banking app. The list below shows how it serves common use cases.
- Payments and remittances are approved by the user with a tap or biometric, while policy rules set per-transaction limits.
- Card spending draws on a spending allowance the user pre-approves, so the card program never holds the full balance.
- Savings and investing stay in the user’s wallet, with stricter rules for large withdrawals.
- The fintech’s own treasury runs in a separate institutional MPC wallet with multi-person approvals.
How Non-Custodial MPC Key Sharding Secures Customer Assets
Multi-party computation (MPC) splits signing power into separate key shares. The full private key is never created in one place, not during wallet generation and not during signing. Shares combine through a threshold signature scheme (TSS) to sign.
In a non-custodial setup, the user holds the share that every transaction requires. A common configuration spreads them like this.
- Share one sits on the user’s device in a secure enclave or passkey-backed storage.
- Share two sits with the infrastructure provider, which co-signs only when the user approves.
- Share three is an encrypted recovery share the user controls, such as a cloud backup locked with the user’s own credentials.
The signing threshold is set so the provider and fintech cannot move funds without the user. Compared withmulti-sig wallets, MPC signs off-chain, works across more blockchains, and removes the seed phrase entirely.
MPC alone does not make a wallet safe. Why MPC wallets aren’t enough comes down to governance, since a weak co-signing server can still be abused. Production setups pair MPC with a policy engine, device binding, and transaction limits that the co-signer enforces before adding its share.
Non-Custodial Wallet Architecture for an Existing Banking Stack
Your core ledger stays the system of record for fiat. The list below shows the five layers a typical architecture needs.
- App and UX layer. Your existing mobile and web app shows crypto balances, deposits, and transfers next to fiat accounts.
- Orchestration and API layer. A middleware service maps user IDs to wallet addresses, mirrors on-chain balances in the app, and consumes deposit and withdrawal webhooks.
- Non-custodial MPC wallet layer. The MPC engine creates user wallets and co-signs under policy rules, while the user’s share approves every transaction.
- Compliance layer. KYT screening, sanctions checks, and Travel Rule data run before the co-signer adds its share.
- Blockchain and liquidity layer. Node access, gas management, and liquidity partners connect the app to supported chains.
Because users keep signing control, this architecture adds crypto without the fintech taking custody of customer assets. Crypto wallet-as-a-service speeds this up by exposing layers three to five as APIs and SDKs, and some apps add account abstraction so users never handle gas fees.
Crypto Custody Licensing and Compliance Changes in 2025 and 2026
Licensing is where most crypto roadmaps stall. Holding customer keys brings custody rules, while a non-custodial model keeps the fintech out of safekeeping. The table below shows the changes that matter most for product teams.
| Region | Change | What It Means for Fintech Teams |
| US | SEC SAB 122 rescinded SAB 121 in January 2025 | Custodied crypto no longer forces a full balance sheet liability |
| US | OCC Interpretive Letter 1183 in March 2025 | National banks can offer crypto custody without prior supervisory non-objection |
| US | OCC Interpretive Letter 1184 in May 2025 | Banks can use sub-custodians and execute trades for custody clients |
| EU | MiCA transitional period ended July 1, 2026 | Custody must run through an authorized CASP, with no outsourcing to unauthorized firms |
| Global | FATF Travel Rule enforcement expands | Transfers need originator and beneficiary data shared between providers |
The US changes, including the OCC’s Interpretive Letter 1183, mainly help fintechs that choose a custodial path through a partner bank. In the EU, MiCA makes holding customer keys a licensed activity, so a non-custodial wallet lets teams launch without a custody authorization. Services such as trading, exchange, or transfers can still need a license, so legal review stays essential.
Compliance does not disappear in a non-custodial model. Travel Rule compliance still applies when users move funds through your platform, and KYT transaction monitoring scores each transfer before it settles. When both run inside the co-signing step, the fintech can block a risky transfer without ever being able to move user funds itself.
Step-by-Step Non-Custodial Wallet Integration Roadmap for Neobanks
With non-custodial MPC as the target model, integration becomes a sequencing exercise. The steps below show how fintech teams move from decision to launch.
- Adopt a non-custodial MPC model. Set the signing threshold so no transaction completes without the user’s share.
- Map your licensing scope. Confirm with legal counsel which services, such as trading or transfers, still need a license in each launch market.
- Select MPC wallet infrastructure. Check chain coverage, SOC 1 and SOC 2 reports, co-signing policy controls, and user recovery options.
- Connect the core ledger. Link wallets to customer profiles and mirror on-chain balances in the app through webhooks.
- Wire compliance into co-signing. Connect KYT screening, Travel Rule messaging, and policy limits to the co-signing step before the first live transfer.
- Launch in phases. Start with a small set of assets and users, then expand chains, limits, and features.
Add Non-Custodial Crypto Custody to Your Fintech App With ChainUp
Adding crypto custody to a fintech app comes down to three decisions. Give users control of their keys with a non-custodial MPC model, wrap it in strong governance, and run compliance inside the co-signing step.
The ChainUp white label MPC wallet is built for this model. It lets you launch a branded wallet inside your app, with a policy engine for transaction rules across more than 200 main chains. Built-in KYC screening and Travel Rule support keep transfer compliant, backed by SOC 1 and SOC 2 certified operations.
Talk to the ChainUp team today to map a non-custodial custody architecture for your banking app.
