Stablecoin custody: control, risks, and payment operations
Understand stablecoin custody models, key control, customer rights, issuer risk, and the operational controls businesses need for payments.
Stablecoin custody determines how a business controls payment balances, approves transfers, and recovers access when something goes wrong. This guide separates signing technology from customer rights and explains what to test before funding a payment operation. Talk to Tempo about your payment workflow.
A treasury team needs more than a wallet balance. It needs to know who can move the money, what happens when an approver is unavailable, and how each transfer reaches the finance ledger. Those decisions belong in the payment design before meaningful balances enter the system.
What stablecoin custody means
Stablecoin custody is the arrangement for controlling access to stablecoin balances and authorizing their movement. The tokens are recorded on a blockchain; wallet technology manages the credentials and permissions used to access them. The SEC's custody overview explains this distinction between the asset and the keys.
For a business, custody also includes the agreement with a provider, the records establishing customer balances, and the process for withdrawals or recovery. A technically valid signature does not explain every party's contractual rights.
Compare control arrangements
Start with the authority to approve a transfer and the responsibility for maintaining access.
| Arrangement | Operational control | What to establish |
|---|---|---|
| Business-controlled custody | The business controls the signing credentials and access procedures | Approval roles, backups, recovery, and staff changes |
| Third-party custody | A provider manages signing access and processes instructions under its agreement | Withdrawal conditions, customer records, fees, and failure procedures |
| Shared-control arrangement | Signing or recovery responsibilities are distributed between parties | The combinations of parties that can move funds or change control |
Hot and cold storage describe how signing credentials are connected or kept offline. Either can form part of a business-controlled or third-party arrangement. They do not establish customer ownership or contractual protection by themselves.
MPC describes signing technology
Multi-party computation, or MPC, can support distributed signing. In a threshold scheme, signing involves multiple parties holding shares of a secret rather than relying on one party holding the entire signing key. NIST describes this cryptographic model.
MPC alone does not determine whether a service is custodial. Examine who holds the shares, who can approve transactions, and who can replace a participant or invoke recovery. A provider's signing architecture and the legal status of its custody service are separate evaluation questions.
Separate custody protection from asset risk
Review how the provider records ownership, separates customer assets from its own assets, and handles subcontractors. Establish what the agreement says about withdrawal access, asset use, outages, and insolvency. The FSB's stablecoin recommendations identify safeguarding, segregation, and ownership recordkeeping as relevant protections. These recommendations do not establish that a particular provider offers them.
Custody of a customer's tokens also differs from custody of the reserves backing a stablecoin. Controlling a wallet does not control the issuer's reserve portfolio or guarantee redemption. Circle's token terms, for example, place conditions on direct redemption and describe transfer restrictions and operational risks. Evaluate the chosen asset's terms separately from the wallet agreement.
A hypothetical payout operation
Consider a platform preparing 100 contractor payouts of 500 dollar-denominated stablecoin units each. Its payout requirement is 50,000 units before fees. These figures illustrate an operating design, not a provider quote.
The platform could require finance to approve the payout file and a separate operator to release it. It would verify the asset, network, destination addresses, and payment references before signing. Its procedure would specify how a rejected payment is investigated without resending payments that already succeeded.
After execution, finance would match each payment identifier to its settlement record and internal ledger. If recipients need local currency, conversion and bank delivery would remain additional steps. A custody provider processing the transfer does not establish that recipients have received fiat.
Test the complete workflow
Run a small payment and withdrawal through the proposed arrangement. Test an unavailable approver, an employee losing access, a rejected destination, and a service interruption. Record who can recover access and whether that process changes signing authority.
Compare the full cost, including setup, custody or account charges, transaction and withdrawal fees, network fees, conversion, foreign exchange, and bank payouts where applicable. Compare support hours with the hours your operation needs to pay. A low network fee does not establish the cost or availability of the complete service.
Where Tempo fits
Tempo provides the blockchain settlement layer. Businesses combine it with their chosen custody, wallet, compliance, and banking services. Near-instant onchain settlement and sub-cent network fees can support payment operations; custody agreements, approvals, and fiat delivery still depend on the rest of the workflow.
Explore Tempo's ecosystem and the stablecoin settlement guide to map the components around custody.
Frequently asked questions
What is stablecoin custody?
Stablecoin custody is the arrangement for controlling access to stablecoin balances and authorizing their movement. Businesses need to understand the signing controls, service agreement, customer ownership records, and procedures for recovering access or withdrawing funds.
Does using MPC make a stablecoin wallet noncustodial?
No. MPC describes a cryptographic approach to distributing a computation, such as signing, across parties. Custody depends on the complete arrangement, including who can authorize transfers, change policies, recover access, and exercise contractual rights.
Does self-custody remove stablecoin issuer risk?
No. Controlling signing keys does not remove risks associated with the stablecoin's issuer, reserves, redemption terms, transfer restrictions, or network. Businesses need to evaluate the asset and the custody arrangement separately.