Why we will never hold your money

Every payments company holds money. It is not an oversight; it is where the business is. Funds sit briefly between the customer and the merchant, and while they sit there they are worth something to whoever is holding them.

At national scale, a few days of float is an enormous amount of money earning interest for somebody who is not the shop. The three-day settlement delay you have got used to is not a technical limitation. It is a business model.

We decided not to have that business model, before writing any code. Here is the reasoning, because it explains most of the odd choices elsewhere in this product.

1. Holding money is a regulated activity, and it should be

The moment you hold customer funds you are in a different legal category, with safeguarding obligations, capital requirements and authorisation to obtain. That regime exists because people have lost money when companies held it badly, and it is broadly a good thing.

We could have gone through it. Plenty do. But it would have added a year and a great deal of money before the first merchant could send an invoice, and it would have bought us a capability we did not want.

2. It makes us a single point of failure

If we held funds, then every merchant using us would be exposed to us. Our solvency, our banking relationships, our competence, our judgement on a bad day.

Businesses have been caught by exactly this. Not by fraud, usually — by a payments company having a problem and everybody's money being inside it while the problem got resolved. The merchant did nothing wrong and was still unable to pay their staff that week.

The best way to make sure we can never lose your money is to build something that cannot reach it.

3. Custody makes you a target

A company holding a large pool of funds is worth attacking. It attracts sophisticated attention, and it means one breach affects everybody at once.

Not holding anything removes that entirely. There is no pool. Compromising us would be bad — a breach of business records is a serious thing and we protect them accordingly — but it would not move a single pound of anyone's money, because there is no route from our systems to your funds.

What it cost us to decide this

Being straight about the downsides, since a page listing only advantages is an advertisement.

• No float revenueThe largest income line in payments is one we have given up. Everything has to come from a subscription, which is a harder sell than a percentage nobody reads.
• No safety net to offerWe cannot reverse a payment, recover a wallet or make anyone whole. A custodial company can absorb a customer's mistake. We can only warn about it beforehand.
• More work for the merchantYou look after your own access, set up your own recovery. Small, but not nothing, and it is real friction at signup.
• A harder story"We hold your money safely" is a sentence people understand immediately. "We never hold your money" takes a paragraph and sounds, at first, like something is missing.

What it bought

A short list, but each item is absolute rather than a promise.

We cannot freeze your funds. We cannot lose them. We cannot be compelled to hand them over, because we do not have them. We cannot go under and take them with us. If this company disappeared tomorrow your wallet would carry on working, because it is an ordinary wallet and the recovery phrase opens it anywhere.

None of those are policies that a future board could revise. They are consequences of the architecture, and changing them would mean building a different product.