Bitcoin card custody is a critical component of institutional digital asset payment infrastructure, connecting secure Bitcoin storage with card authorization, crypto-to-fiat conversion and conventional merchant settlement. For issuing banks, payment processors, custodians and institutional programme managers, Bitcoin card custody and settlement arrangements introduce liquidity, counterparty, cybersecurity and operational risks. This report examines how Bitcoin-linked payment cards operate, how digital assets are safeguarded and converted, and how institutions manage settlement obligations, treasury exposure and regulatory compliance.
For institutions, the answer is consistent: in a conventional Bitcoin card purchase, the merchant receives fiat currency through Visa or Mastercard settlement, while the program decides who holds the bitcoin, when it is sold, and who funds the gap before settlement. The merchant side looks like any other card payment. Everything upstream of the card network (key control, conversion timing, prefunding and reconciliation) varies by program, and that is where the risk sits.
Crypto cards connect two systems that run on different clocks. Card authorization takes a fraction of a second. Interbank settlement takes days. Bitcoin markets trade around the clock. Each handoff between custody, a liquidity provider and a sponsor bank creates a point where assets, obligations or price exposure change hands. Issuers, processors and investors who can map those handoffs can price the exposure, write better contracts and spot weak partners before launch.
Readers who want ongoing, independent analysis of custody models, settlement infrastructure and issuer economics can follow Card-Bitcoin’s research as these programs and their partner structures evolve.
Key Takeaways
- Merchants receive fiat, so the main custody and price risk sits with the program before settlement.
- Self-custody cards still hand assets to a program at the point of spend.
- Stablecoin settlement is expanding, but partner eligibility and rollout stages differ by market.
Executive Summary
A Bitcoin card program is a chain of custody transfers that ends in a normal card settlement. The sensitive design choices concern when bitcoin is sold, who holds fiat before the network settles, and who absorbs losses if a trade or partner fails.
Where Does Custody End and Card Settlement Begin?
Custody ends when the cardholder’s bitcoin is sold or moved to a program-controlled address. Card settlement begins once fiat (or an approved settlement asset) is committed to the issuer’s settlement account. In custodial models, that switch happens on an internal ledger. In self-custody models, it happens through an on-chain transfer at or before the swipe.
The gap between these two points is the core operating problem. An approved authorization is only a hold. Funds move later through clearing and settlement, and domestic card settlement commonly runs on a T+1 to T+3 business-day timeline.
Which Decisions Determine the Program’s Risk Profile?
Four decisions shape most of the exposure:
- Custody model: exchange, third-party, self-custody or shared control.
- Conversion timing: sale at authorization, at clearing, or in a pre-load before spend.
- Funding method: prefunded settlement account, credit line, or same-day liquidity provider.
- Settlement asset: fiat through standard network rails or an approved stablecoin.
Who Controls Assets Across a Bitcoin Card Program?
Control passes across at least four parties: the custodian holds keys, the liquidity provider converts assets, the issuer owns the card liability, and the network settles net positions. Contracts must state who holds title at each stage, because counterparty risk follows that title.
Issuers, Banking Partners, Processors and Program Managers
The issuing bank holds the BIN, is the network member (or works through a sponsor) and owes the network for approved transactions. The processor runs authorization logic and passes balance checks to the program’s ledger. The program manager runs the customer relationship, KYC flows and often the crypto integration. Responsibility for compliance failures sits with the bank under network rules, even when tasks are outsourced.
Custodians, Liquidity Providers and Asset-Control Boundaries
Crypto custody is the control of private keys that move assets. A digital asset custody provider may be the card program itself, an affiliated exchange or a separate trust company. The liquidity provider sells bitcoin for dollars and delivers fiat to the settlement account. When one firm plays both roles, the program gains speed but concentrates failure risk. Insolvency treatment also matters. The SEC staff notes that SIPC does not protect custodial claims for non-security crypto assets held by member broker-dealers. That makes segregation and account terms central to recovery.
How Do Custodial and Self-Custody Card Models Differ?
The difference comes down to who holds keys before the swipe. Both models end with the program holding assets for conversion, and both depend on the same issuer and network.
Exchange and Third-Party Custody
In custodial crypto debit cards such as the Coinbase Card or Binance Card, the user’s balance sits with the provider from deposit through spend. At purchase, the provider sells crypto on its own books and funds the card transaction. This design is fast and easy to reconcile. The cardholder is exposed to the custodian’s solvency, security and account freezes.
Self-Custody and Collaborative Custody at the Point of Spend
Gnosis Pay is an example of a self-custody design. The user keeps assets in a self-custody wallet governed by a smart contract, and funds move on-chain to the program when the card is used. Self-custody stops at that transfer. Bitcoin wallets secured by a hardware wallet, or collaborative custody setups from firms such as Casa and Unchained, protect savings but are usually separate from the spending balance. Users move funds from cold holdings into a card-linked account first, and debates over whoever controls digital wallets reflect how valuable that funding step is.
Custody-Model Comparison: Keys, Funding and Failure Exposure
| Factor | Exchange custody | Third-party custody | Self-custody card | Pre-funded fiat load |
|---|---|---|---|---|
| Who holds keys before spend | Exchange | Custodian | User | User (before off-ramp) |
| When custody transfers | At deposit | At deposit | At swipe or pre-approval | At off-ramp |
| Conversion point | Internal ledger at spend | Custodian or liquidity provider | Program after on-chain transfer | Before card load |
| Main failure exposure | Exchange insolvency or freeze | Custodian and LP default | Smart contract, chain delays, program halt | Off-ramp counterparty |
| On-chain visibility | Low | Low | High for wallet-to-program leg | Off-ramp only |
Illustrative comparison based on common designs; individual program terms vary.
What Happens Between Card Authorization and Merchant Settlement?
The program sells bitcoin, funds the issuer in fiat and settles with the network days after the cardholder sees an approval. The crypto-to-fiat conversion and the card settlement run on separate timelines, so someone carries price or credit risk in between.
Illustrative Workflow: Authorization, Asset Sale and Fiat Funding
This is a modeled example, not any single program’s documented flow:
- Cardholder buys $500 of goods. The acquirer routes the request through the network to the issuer’s processor.
- The processor asks the program ledger whether the user has enough bitcoin at the current quoted price, plus a buffer.
- The program places a hold on the bitcoin and approves.
- The program sells the bitcoin through its liquidity provider, either at once or in a batch.
- Fiat proceeds move to the issuer’s settlement account before the network’s settlement cutoff.
If the sale happens at step 4 immediately, price risk is short. If it waits for clearing, the program carries market exposure for hours or days.
Clearing, Merchant Settlement and Exception Reconciliation
Clearing matches the merchant’s capture to the original authorization. Settlement amounts can differ from authorized amounts because of tips, partial captures or currency changes. Hold windows also vary; one provider documents card-not-present holds of five to seven days for Visa, and such defaults are provider-specific. Crypto payment settlement teams must reconcile three ledgers daily: the crypto sale, the card clearing file and the bank settlement entry. Mismatches feed exception queues for refunds, reversals and late presentments.
Which Safeguards Make Custody Operationally Viable?
Viable custody pairs cold storage for reserves with tightly limited hot balances for spending, plus segregation and daily reconciliation. Institutional-grade security is a set of auditable controls, and card programs need those controls to work at payment speed.
Cold Storage, Multisignature and MPC Controls
Cold storage keeps long-term reserves offline. Hot wallets hold only what daily spend requires. Multisignature schemes need several keys to sign. Multiparty computation splits a key into shares that jointly sign without the full key ever existing in one place. Card programs need tested sweeps between cold and hot tiers, because a slow refill can trigger declines during a price swing.
Asset Segregation, Qualified Custody and Ledger Reconciliation
Segregated client accounts help keep customer assets out of a failed firm’s estate. A qualified custodian adds a regulated status that certain clients, such as advisers, must use. On October 6, 2026, the SEC published proposed amendments to adviser and fund custody rules, including crypto custody rules, which remain a proposal. Programs should reconcile on-chain balances, custodian statements and the card ledger at least daily.
Assessing Providers Without Assuming Card-Program Participation
Established institutional custodians include Anchorage Digital, Coinbase Custody, Gemini Custody, Fidelity Digital Assets, BitGo, Zodia Custody, Xapo Bank and BNY Mellon. Many serve Bitcoin ETFs, asset managers and family offices. Serving those clients does not show that a firm supports card-program flows. Banks are also entering the market; Citi has said it plans to offer bitcoin custody to institutional clients later this year. Issuers should confirm any card-specific capability directly, as with partnerships like Standard Chartered and Coinbase building institutional custody and trading solutions.
How Should Programs Fund Settlement and Manage Intraday Exposure?
Programs should prefund settlement accounts and size buffers to cover peak spend plus price moves. Intraday exposure is the amount approved but not yet converted and funded.
Prefunding, Conversion Windows and Liquidity Buffers
Prefunding places fiat in the settlement account before transactions clear. It costs capital but removes the risk of missing a network cutoff. Conversion windows set how long bitcoin stays unsold after approval. Shorter windows cut price risk but raise trading costs. Buffers should be stress-tested against weekend gaps, since bitcoin trades while banks are closed.
Treasury Reconciliation, Failed Trades and Rewards Liabilities
A failed trade with a liquidity provider leaves the program owing fiat it does not have, which is direct counterparty risk. Contracts should require backup providers and clear cutoff times. BTC rewards and bitcoin cashback create a separate liability: the program owes bitcoin it must buy or hold. Treasury teams should book that liability daily and decide whether to hedge it, since price rises increase the cost.
Where Do Card-Network and Blockchain Settlement Diverge?
Card networks settle net positions in batches through banks, while blockchains move each transfer individually and record it publicly. Stablecoins are starting to bridge the two, but mostly at the issuer-to-network layer.
Visa and Mastercard Clearing Versus On-Chain Transfers
Visa and Mastercard settlement uses deferred net settlement through settlement banks, with disputes handled through chargebacks. On-chain transfers settle gross, cannot be reversed, and are visible to anyone. A self-custody card can involve both: an on-chain leg from wallet to program and a network leg to the acquirer. Some programs, such as Rain, settle the issuer-to-network leg in stablecoins on public blockchains.
Stablecoin Settlement: Eligibility, Reserves and Pilot Boundaries
Mastercard announced in June 2026 that it will support settlement in USDC, PYUSD, USDG, USDP, RLUSD and SoFiUSD across chains including Ethereum, Solana and Base. The same release names ARQ, CBW Bank, Cross River, Lead Bank and Nuvei as expected early U.S. and Latin American partners, with rollout “subject to regulation.” That language describes expansion beyond earlier pilots, not universal availability. Visa also reports growth in stablecoin-linked card programs. Programs should check stablecoin reserves disclosures and confirm eligibility with their sponsor bank. Readers tracking the friction can see the stablecoin stumbling block.
Chain and Asset Choices in Wallet-to-Program Funding
Chain choice affects fees, confirmation time and which stablecoins are supported. A program accepting bitcoin directly must wait for confirmations or accept risk on unconfirmed funds. Many self-custody cards fund from stablecoins on cheaper chains, which means a Bitcoin holder converts first and takes on the chain’s operational risks.
Which Risks Persist After a Card Transaction Is Approved?
Approval closes the cardholder’s experience but opens the program’s exposure to price moves, partner failure, cyber events and disputes. These risks last until settlement and, for chargebacks, months after.
Institutional Risk Matrix: Custody, Counterparty and Settlement
| Risk | Where it arises | Primary bearer | Key control |
|---|---|---|---|
| Key compromise | Hot wallet, signing systems | Custodian, then users | MPC or multisig, low hot balances |
| Liquidity provider default | Conversion step | Program manager | Multiple LPs, prefunding |
| Price movement | Approval to sale | Program or user, by contract | Short conversion windows, buffers |
| Settlement shortfall | Network cutoff | Issuing bank | Prefunded accounts, collateral |
| Custodian insolvency | Held balances | Cardholders | Segregation, bankruptcy-remote terms |
| Program termination | Sponsor bank exit | Cardholders, program | Exit and wind-down plan |
Illustrative matrix; allocations depend on contracts.
Cybersecurity, Liquidity Shortfalls and Program Termination
Bitcoin transfers cannot be reversed, so a key theft is a permanent loss. Stripe cites estimates that around 20% of all Bitcoin supply is permanently inaccessible as a reminder that lost keys stay lost. Liquidity shortfalls appear first as declines, then as missed settlements. A sponsor bank’s decision to exit can stop a program within days, leaving balances stranded with the custodian.
Disputes, Chargebacks and Business-Continuity Dependencies
Card disputes follow network rules even when funds came from bitcoin. If a chargeback succeeds, the program refunds fiat, while the original bitcoin sale cannot be undone. Programs should decide whether refunds return dollars or rebuy bitcoin, and disclose it. Continuity plans should cover processor outages, custodian downtime and blockchain congestion.
Which Compliance Duties Depend on the Program Structure?
The issuing bank carries final compliance duty, while program design decides which partner performs each task. Custodial and self-custody programs face different monitoring gaps.
KYC, AML, Sanctions and Transaction Monitoring
All U.S. card programs need KYC at onboarding and ongoing AML monitoring. Custodial programs see full transaction history internally. Self-custody programs must also screen incoming wallet addresses for sanctions exposure before accepting on-chain funds. Monitoring should link on-chain funding data to card spend so alerts reflect the full flow.
PCI DSS, Data Access and Jurisdiction-Specific Obligations
Any party that stores, processes or transmits card data falls under PCI DSS. Crypto custodians that never touch card data may sit outside that scope, but the processor and program manager will not. State money transmission rules and licensing apply differently depending on who holds customer funds.
Assessing U.S. Custody and Stablecoin Rules Against Current Sources
The GENIUS Act created a federal framework for payment stablecoins, and implementing rules are still being written. The Office of the Comptroller of the Currency has been granting charters to digital asset firms, including Circle’s national trust bank approval and a decision allowing five digital asset firms to launch trust banks. Teams should check rule status against agency publications on the date of each decision, since proposals and final rules differ.
How Can Institutions Evaluate and Implement a Program?
Institutions should map title and duties first, then test failure scenarios, then document governance and exit. Each step should produce written evidence that a regulator or auditor can review.
Map Asset Ownership, Contractual Duties and Approval Authority
Draw the full flow from deposit to merchant payout. For each step, record who holds title, who can sign, and who carries the loss. Confirm that contracts match the map, including insolvency terms and liability caps.
Test Liquidity, Reconciliation and Incident Scenarios
Run tabletop and live tests for a 20% intraday price drop, a liquidity provider outage on a Friday night, a custodian freeze and a hot-wallet breach. Measure time to detect, time to fund settlement and reconciliation breaks. Repeat tests after any partner change.
Document Due Diligence, Governance and Exit Plans
Keep files on each partner’s licenses, audits, SOC reports, insurance terms and incident history. Assign board-level owners for custody and liquidity risk. The exit plan should explain how balances return to users if the sponsor bank, custodian or program manager leaves.
Match Custody Controls to Settlement Obligations
A Bitcoin card program pays merchants in fiat, so its real work is moving bitcoin safely into that fiat obligation on time. Custody design sets who is exposed before the swipe. Conversion timing and prefunding set how much price and credit risk the program carries until settlement. Stablecoin settlement adds options, with eligibility tied to named partners and regulatory approval. Institutions that map title at each handoff, prefund against stress cases and reconcile all three ledgers daily will catch shortfalls before the network cutoff does.
Frequently Asked Questions
Does a Bitcoin card merchant receive Bitcoin or fiat currency?
The merchant receives fiat currency in a conventional Bitcoin card purchase. The program converts bitcoin before or around settlement, and the acquirer pays the merchant through standard network rails.
Who holds the private keys for a Bitcoin debit card?
In custodial programs, the exchange or custodian holds the keys. In self-custody programs, the user holds keys until funds move to the program at the point of spend.
Can a self-custody card still create counterparty risk?
Yes. Once funds reach the program’s address, the user depends on the program, its liquidity provider and its sponsor bank, any of which can fail or halt the card.
How does card-network settlement differ from blockchain settlement?
Card networks settle net amounts in batches through banks, usually days after approval, with chargeback rights. Blockchain transfers settle one by one, are public and cannot be reversed.
What should an issuer verify when selecting a crypto custody provider?
An issuer should verify licensing, segregation terms, key-management design, audit reports and insurance. It should also confirm the provider can support card-speed withdrawals and daily reconciliation, since institutional custody experience alone does not prove that.