When you buy bitcoin through PayPal, you do not receive bitcoin. You receive a right to bitcoin, held by a company that is not PayPal, in an account pooled with other customers' assets. In the United States, that right is not insured by the FDIC or SIPC. In the United Kingdom, the service is not regulated by the FCA and losses are not covered by the Financial Services Compensation Scheme.
None of this is hidden. It is written in PayPal's own terms, in capital letters in the US version. Most articles about PayPal crypto never get far enough into the document to find it.
Every claim below comes from one of three places: PayPal's own cryptocurrency terms and conditions for the relevant country, PayPal's own help centre or newsroom, or a published order from the New York State Department of Financial Services. Where I could not verify something, it is not in this article. Fee schedules change by account, by region and without notice, so I quote no fee figures at all and instead tell you where to read yours.
Checked on 15 September 2026.
The UK terms put it plainly. When you buy, "you will not receive actual Cryptocurrencies in your Cryptocurrencies Hub. Instead you are buying rights in the Cryptocurrencies." Those rights are held through PayPal group companies and what the agreement calls Service Providers, in "an omnibus account, which means they are pooled with the Cryptocurrencies of other customers."
PayPal UK Ltd states it "act[s] for you as trustee" over those rights and holds them separate from its own assets. The version issued by PayPal (Europe) S.à r.l. et Cie, S.C.A. uses a different legal concept, describing PayPal as a "fiduciary agent," a Luxembourg law construct that gives you rights similar to a trustee. Same group, different entity, different legal wrapper for the same economic arrangement.
The practical consequence sits one layer down. Your claim runs against the entity named in your agreement and against the custodian behind it, not against a coin sitting at an address you control.
PayPal's UK help centre answers this in one sentence: "Your crypto is held by a 3rd party service provider, Paxos Trust Company LLC."
The US structure has changed recently and most coverage has not caught up. The current US Cryptocurrency Terms and Conditions, last updated 19 May 2026, are between you and PayPal Digital, Inc., described as "a New York Limited Purpose Trust Company doing business as PayPal Digital and Venmo Digital." Those terms state they supersede the earlier PayPal, Inc. and Venmo cryptocurrency terms. Your old Cryptocurrencies Hub became a Crypto Account.
Within that new structure, custody has not moved in-house entirely. The terms say some custody, trading and transfer services "are performed for us by Paxos Trust Company, N.A., ('Paxos') or other appropriately licensed or otherwise authorized service provider." Paxos is also the issuer of PayPal USD, and PayPal's UK announcement of 17 November 2025 describes PYUSD as "issued and held in custody by Paxos Trust Company, LLC."
PayPal, Inc. itself holds NMLS ID 910457 and is licensed by the New York State Department of Financial Services to engage in virtual currency business activity.
This is the part that belongs in any honest assessment of PayPal crypto and appears in almost none of them. On 6 August 2025, NYDFS Superintendent Adrienne A. Harris announced a settlement with Paxos Trust Company. Paxos agreed to pay a penalty of $26.5 million to New York State and to invest a further $22 million in remediating its compliance programme under a plan approved by the department. The total is $48.5 million.
Two findings drove it. First, Paxos failed to conduct sufficient due diligence of its former partner, Binance. The department found Paxos had no effective controls to monitor for significant illicit activity occurring at or through Binance, and failed to escalate red flags to senior management and the board. In reviewing Binance transactions between 2017 and 2022, DFS concluded that $1.6 billion in transactions flowed to or from the Binance platform involving illicit actors, including entities that kept transacting after OFAC had sanctioned them.
Second, Paxos ran a deficient compliance programme in its own right. NYDFS cited an unsophisticated know-your-customer process that let customers sharing addresses, corporate documents, beneficial owners and behavioural markers open multiple accounts undetected, plus a transaction monitoring system that failed to catch obvious money laundering patterns.
Some context on the same regulator's earlier action. In February 2023, DFS ordered Paxos Trust to cease minting Paxos-issued BUSD, and describes itself as the first regulator in the world to address safety and soundness concerns related to Binance. Paxos was chartered by NYDFS in 2015 as a limited purpose trust company and authorised for virtual currency business, the first in New York to hold a limited purpose trust charter for digital assets.
Read that accurately. The order concerns failures in compliance systems and in vetting a counterparty. It does not allege that Paxos lost or misappropriated customer assets, and a penalty is not the same thing as a custodial failure. What it does establish is that the custodian behind your PayPal balance was, on its regulator's own findings, running controls that did not work for years.
The US terms open with a block that is hard to miss once you know it is there:
"CRYPTO ASSETS ARE NOT INSURED BY THE FEDERAL DEPOSIT INSURANCE CORPORATION (FDIC), THE SECURITIES INVESTOR PROTECTION CORPORATION (SIPC) OR ANY OTHER PUBLIC OR PRIVATE INSURER, INCLUDING AGAINST CYBER THEFT OR THEFT BY OTHER MEANS. CRYPTOCURRENCY ACTIVITY IS NOT A REGULATED ACTIVITY IN MANY U.S. STATES AND TERRITORIES."
Eligibility is narrow: an individual must reside in the United States or one of its territories and be at least 18, or the age of majority in the state or territory.
On PYUSD, the terms say reserves are fully backed by an equivalent amount of US dollar denominated bank deposits, US Treasuries and US Treasury reverse repurchase agreements, and that you can redeem PYUSD at $1.00 directly with Paxos. Then comes the sentence worth reading twice: "PayPal does not guarantee Paxos's performance or obligations."
PayPal UK Ltd is authorised and regulated by the FCA as an electronic money institution under firm reference number 994790, for regulated consumer credit activities under 996405, and for the provision of cryptocurrency services under 1000741. Its company number is 14741686 and its registered office is 5 Fleet Place, London, EC4M 7RD.
Having an FCA reference number for cryptocurrency services is not the same as the service being FCA regulated. The same document says so: "Our Cryptocurrency service is not regulated by the UK Financial Conduct Authority. It is not within the jurisdiction of the UK Financial Ombudsman Service and it is not subject to protection under the UK Financial Services Compensation Schemes."
PayPal's UK help page repeats it in plainer language. The FCA considers this investment high risk. The FSCS does not protect it because it is not a specified investment under the UK regime. Protection from the FOS does not cover poor investment performance.
The feature set is narrower too. Under the UK terms you currently cannot send crypto to family or friends, use it to pay for goods or services, transfer it out to an external wallet, or transfer it in from one. A great many guides describe "checkout with crypto" as a PayPal feature without noting that it is not available to UK users at all.
PayPal reintroduced cryptocurrency services in the UK on 17 November 2025. Eligible consumers can buy, hold and sell seven tokens: Bitcoin, Ethereum, Litecoin, Bitcoin Cash, Solana, Chainlink and PayPal USD. PayPal says UK users are the first outside the US able to purchase PYUSD directly from PayPal. Availability is subject to eligibility checks, risk warnings and appropriateness assessments, along with all other FCA requirements.
| Item | US (PayPal Digital) | UK (PayPal UK Ltd) | Self-custody wallet |
|---|---|---|---|
| Counterparty named in the agreement | PayPal Digital, Inc., a New York limited purpose trust company | PayPal U.K. Ltd | None, you hold the asset |
| Who holds the private keys | Paxos Trust Company, N.A. or another licensed service provider | Service providers, named by PayPal as Paxos Trust Company LLC | You |
| What you own | Crypto assets in a Crypto Account | Rights in crypto, pooled in an omnibus account | The on-chain asset |
| Transfer out to an external wallet | Offered, subject to terms | Not currently available | Always available |
| Deposit or investment protection | None: not FDIC or SIPC insured | None: outside FSCS | None |
| Who regulates the crypto activity | Not a regulated activity in many US states and territories | Not regulated by the FCA | No regulator |
| Where a complaint goes | PayPal Digital support, then arbitration on an individual basis | PayPal, then no FOS jurisdiction over the crypto service | No venue |
Read the table as a set of trade-offs rather than a ranking. Self-custody removes counterparty risk and replaces it with the risk that you lose your own seed phrase, from which there is no recovery of any kind.
Both sets of terms address insolvency directly. The UK terms say that although the Service Provider keeps the crypto separate from its own assets, if it became insolvent "there is a risk that our and your ability to access and sell those Cryptocurrencies could be delayed, time-consuming, costly and ultimately unsuccessful." On private keys, PayPal says it will assist you to the extent reasonably possible in seeking recovery, but there is "a material risk that part or all of those Cryptocurrencies will not be recovered."
One sentence in the source article for this rewrite needs to be withdrawn. It said holding with PayPal carried lower risk because PayPal is "a major publicly traded company." Size does not change the legal structure. In an omnibus arrangement your claim is that of an unsecured creditor against whoever holds the assets, and the entity's market capitalisation has no bearing on it.
The mitigations available are ordinary ones: two-factor authentication on the linked account, withdrawal of long-term holdings to a wallet you control where your region permits it, and not treating a payments app as a storage location.
Each of those is answerable from your own account or from the registers listed above.
PayPal's crypto service is genuinely convenient, and it is also a service where you hold a claim rather than an asset, against a custodian that its own regulator found to have run ineffective controls for years. Both are true and neither cancels the other.
You do not need an opinion on whether that trade is acceptable. You need three answers you can source: which legal entity is on your agreement, which company holds the private keys, and what happens to your claim if that company fails. If you cannot get all three from primary documents, the size of the brand on the app is not a substitute.