Rules · Security

Crypto card security: who holds your money and what protects it

Ask one question before comparing a single fee: if this provider stopped answering emails tomorrow, where would my money be? The answer differs completely between custodial and self-custodial cards, and it is not in the marketing material.

Safeguarding is not insuranceIdentify the issuerAuthenticator app, not SMS

Researched and last reviewed September 2026 · how we rate cards

Verified on-rampVisa · Mastercard
REGULATED · LICENCES PUBLISHED
Open an account

CEX.IO publishes its authorisations — Gibraltar FSC DLT Provider FSC0686FSA, FinCEN MSB registration and UK FCA registration — each verifiable on the regulators own registers.

The last decade has provided repeated, expensive demonstrations of what happens when a crypto company holding customer balances runs into trouble. Crypto cards inherit that history directly, because almost all of them hold your money. This page is about knowing which model you are in and what actually protects you.

Three companies, one card, different obligations

Every crypto card involves a network, an issuer and a programme manager. The network — Visa or Mastercard — provides rails and rules and never holds your money. The issuer is a licensed bank or electronic money institution that owns the BIN range and carries the regulatory obligation. The programme manager is the crypto brand on the front, and it usually holds your balance and runs the app.

When people say "my card provider", they almost always mean the programme manager. But the entity with the licence, the regulator and the safeguarding obligation is the issuer, and it is frequently a company you have never heard of, incorporated somewhere you were not expecting. That entity is named in your card terms. Finding it takes two minutes and is the single most useful piece of due diligence available.

Banking infrastructure representing regulated card issuance
The licensed issuer named in your card terms is your escalation path and the entity a regulator supervises. It is rarely the brand on the front of the card.

Safeguarding is not deposit insurance

This distinction matters more than any feature comparison on this site.

In the EEA and the UK, electronic money institutions must safeguard customer funds — hold them in segregated accounts separate from company money, so they are not available to general creditors in an insolvency. That is genuinely protective and materially better than nothing. It is not a deposit guarantee scheme: there is no government-backed compensation if funds are missing, and recovery depends on an insolvency process that can take a long time.

In the United States, state money transmitter regimes impose permissible investment requirements on licensees — a comparable idea with different mechanics — and again this is not FDIC insurance. FDIC coverage applies to deposits at insured banks, not to balances at payment companies or crypto platforms.

And crypto held on the platform's exchange side is usually treated differently again, often as a custodial holding governed by the platform's own terms rather than by e-money rules. Read those terms to see which pot your balance sits in.

Two pots, two sets of rules

Many providers hold a fiat card balance under e-money safeguarding and a crypto balance under separate custodial terms. Money you think of as one account can be governed by two different frameworks with two different outcomes in an insolvency. The terms will tell you; the app will not.

Custodial versus self-custodial, honestly compared

CustodialSelf-custodial
Who holds fundsThe providerYou, in a wallet you control
Main riskCounterparty failure or suspensionKey loss and smart contract risk
If you lose accessSupport can restore itNobody can
If the provider failsYour balance is in an insolvencyYour balance is unaffected
Verification requiredYesYes — self-custody does not remove KYC
ExamplesCrypto.com, Bybit, Nexo, WirexGnosis Pay
Neither model is universally better. Self-custody removes the failure mode that has historically cost people the most, and adds a responsibility that has cost other people everything.

How we actually structure this

Treat a crypto card balance the way you treat cash in a wallet. Load what you plan to spend over the next few weeks, not what you own. The convenience of a card is in the spending, not the storage, and there is no version of these products where keeping a large balance on the card is the optimal choice.

The corollary is that the custody debate matters less once the balance is small. A €400 card balance at a custodial provider is a manageable risk even in a bad scenario. A €40,000 balance at the same provider is a decision you would want to have thought about much harder.

How to check a provider properly

Four steps, about fifteen minutes total.

  1. Find the issuing entity in the card terms and conditions, not the marketing page. Note its full legal name and country of incorporation.
  2. Look it up on the regulator's public register. The FCA Financial Services Register for the UK, national competent authority registers across the EEA, ASIC and AUSTRAC in Australia, the Japan FSA, SEC Nigeria, and FinCEN plus state regulators in the US.
  3. Read the safeguarding clause. It should say where customer funds are held and on what basis. Vagueness here is meaningful.
  4. Check what happens to crypto specifically, which is usually a separate section with different language from the fiat balance section.

A provider that makes any of these four steps difficult has told you something. Our rating method weights this heavily, which is why transparency affects our scores as much as features do.

Account security: where the realistic threat is

For most people, the provider failing is not the likely loss. Account takeover is. The practical defences are unglamorous and effective.

Use an authenticator app rather than SMS for two-factor authentication. SIM-swap attacks specifically target accounts holding crypto, and SMS is the weakest common second factor. Set a device passcode, because a virtual card visible in an unlocked phone is a card in somebody's hand. Enable transaction notifications so an unauthorised payment is visible in seconds rather than at month end. Use a unique password, since credential reuse is how most takeovers start. And learn where the freeze button is before you need it — every mainstream programme has one, and using it is faster than calling anyone.

For virtual cards specifically, the ability to regenerate a number instantly is a genuine security advantage — with the caveat that regeneration breaks phone wallet tokens and recurring payments, as our virtual card guide explains.

What protection you do have

It is worth ending on the positive side, because it is real. Card transactions run on network rails, which means the network's dispute framework applies. If a merchant fails to deliver, you can raise a chargeback through your issuer exactly as you would with a bank card, and the crypto element is irrelevant to that process.

That is a meaningful advantage over paying a merchant on-chain, where a mistaken or fraudulent payment is simply gone. It is one of the strongest arguments for spending crypto through a card rather than directly, and it applies to custodial and self-custodial cards alike — see our payment card explainer for how the process works.

What no framework protects you against is the volatility of the asset, a provider you chose without checking, or a balance larger than you could afford to have frozen for six months. Those three are yours to manage, and the first step is knowing which of them applies to you.

Frequently asked questions

Are crypto card balances insured like bank deposits?
No. In the EEA and the UK, e-money balances behind these cards are safeguarded — held in segregated accounts — rather than covered by a deposit guarantee scheme. In the US, state money transmitter law imposes permissible investment requirements rather than FDIC insurance. Crypto held on the provider's exchange side is usually treated differently again.
What is the difference between custodial and self-custodial crypto cards?
With a custodial card the provider holds your balance and the card spends against their ledger entry for you. With a self-custodial card such as Gnosis Pay, funds sit in a smart contract wallet you control and the card spends against an allowance. The first carries counterparty risk; the second carries key management and smart contract risk.
How do I find out who actually issues my card?
Read the card terms and conditions rather than the marketing page. The issuing entity is named there, usually as a bank or electronic money institution, and often differs from the crypto brand on the front of the card. Then look that entity up on its regulator's public register.
What should I do if my card provider suspends withdrawals?
Document everything immediately — balances, transaction history, support tickets — and identify the licensed issuing entity from your card terms. Your escalation path runs through that entity and its regulator, not through the app's support queue. Acting in the first days matters more than acting loudly.
Is two-factor authentication enough to protect a crypto card account?
It is necessary but not sufficient. Use an authenticator app rather than SMS, because SIM-swap attacks specifically target accounts of this kind. Add a device passcode, enable transaction notifications, and keep the card balance small relative to your total holdings.