At a glance
| Decision | Practical answer |
|---|---|
| Start here | Choose by who signs outgoing transfers, where receipts settle and how access is recovered. |
| Choose deliberately | A merchant-controlled wallet requires its own signing/recovery plan; a service account has withdrawal conditions. |
| Main tradeoff | Hosting location alone does not establish custody or safety. |
Two payment pages can look almost identical while sending revenue into very different arrangements. One credits an account from which the merchant must later withdraw. Another sends the asset to a wallet the merchant controls. The difference matters when someone needs to move money, restore access or resolve a restriction.
This article is about control of funds. Hosted versus self-hosted systems covers who operates the software; those are separate decisions within the merchant payment series.
AI-generated concept illustration. It does not depict a provider's architecture or certify the safety of either arrangement.
Follow the funds, then identify the signer
Ask four questions for the specific product and payment route:
- Where does the completed customer payment settle?
- Who can authorize an outgoing transfer from that destination?
- Must the merchant request a withdrawal or satisfy account conditions to use it?
- Who controls recovery if access is lost?
A hosted payment page is not proof of custody. A wallet interface on the merchant's device is not proof that the merchant alone controls signing. Product configuration, delegated permissions and connected services matter.
Compare responsibilities
| Area | Service-custodied arrangement | Merchant-controlled receiving wallet |
|---|---|---|
| Outgoing transfers | Provider's account/signing and withdrawal system is involved | Merchant's signing setup authorizes transfers |
| Recovery | Account recovery and service policy are central | Merchant must preserve the relevant recovery/control mechanism |
| Availability | Withdrawal access depends on the service and arrangement | Spending depends on wallet control, network and other applicable restrictions |
| Operational work | Provider may supply account, reporting or conversion functions | Merchant arranges wallet security and any later conversion |
| Risk that remains | Provider, account compromise, asset/network and operational risks | Key/signing compromise, asset/network and operational risks |
These are evaluation categories, not guarantees. A provider may offer several models under the same brand, and a business can use a hybrid arrangement.
Hosting and custody can cross
BTCPay Server describes its software as non-custodial. Its documentation also distinguishes Lightning configurations and external services; you still need to understand the wallet connected to the instance you actually use.
Coinbase Business payment-link help describes funds arriving in a Coinbase Business account. That account route should not be conflated with an unrelated self-custody wallet or developer facilitator under the same company name.
Use these as examples of why product-level questions are more useful than a list of company labels. The provider comparison separates merchant products from settlement infrastructure.
Non-custodial does not mean nothing can go wrong
Controlling a receiving wallet does not prevent someone replacing your printed QR, stealing a signing key, or tricking an operator into authorizing a transfer. It also does not remove stablecoin issuer restrictions or guarantee market liquidity.
Keep a clean separation between customer-facing payment details, private management access and wallet signing. A cashier who needs to see a receipt generally does not need the business's recovery material. Read staff receiving without the owner wallet and the security checklist.
What to ask before selecting a model
Ask the provider to describe the route from payer to usable merchant funds, including intermediate accounts, conversion, payout timing and withdrawal conditions. Check what happens during account review, an unavailable service or a lost device. Look for current terms applicable to your entity and region rather than assuming another merchant's arrangement applies.
For a merchant-controlled wallet, document who may sign, how control is recovered, who approves treasury moves and how payment records are reconciled. Do not store wallet recovery material in a staff-facing POS page or a shared order sheet.
PayIn's current scope
PayIn's hosted Payment links and POS displays request supported USDC to the configured receiving wallet; they do not create a PayIn merchant balance that the shop later withdraws. Private management access controls payment settings and records, while the receiving wallet has its own control and recovery requirements. That does not establish immunity from signing, issuer or operational risk.
If your goal is automatic settlement to a bank account, evaluate that specific service separately. Use after-receipt planning to connect the custody decision to daily business operations.