Crypto Gateway Indemnity 2026: Yours Has No Cap
We read the indemnity clause in 12 crypto payment gateway contracts in October 2026. Every one runs one way, none caps what you owe, none returns it.
Brian OrmondKey Takeaways
- All twelve contracts put third-party losses on the merchant. None of the twelve indemnifies the merchant back. Eight of the twelve cap what the gateway owes you. Zero cap what you owe the gateway.
- Eight of twelve indemnities trigger on nothing more than your use of the service — no breach, no fault, no error. CoinGate's clause 19.7 is one sentence and that is its only limb.
- Five gateways can take it out of your money before anyone argues. Triple-A's set-off clause 12.1 names "indemnities" outright; NOWPayments applies your assets "without notice or demand"; Cryptomus liquidates "without prior notice and without any liability".
- Triple-A promises mutuality in clause 14.2 and withdraws it in clause 15, which makes the merchant indemnify it for "consequential and indirect damages" that 14.2 had just excluded for both sides. Confirmo makes the same promise and keeps it.
- The statute protects the half you were already protected on. Under Singapore law, which governs two of the twelve, the reasonableness test on indemnity clauses is in UCTA s.4 and applies only to a consumer. A merchant gets s.3, which bites on the gateway's cap.
Two days ago we published what twelve crypto gateways cap their own liability at, and the worst figure in the set was one hundred dollars. The crypto gateway indemnity clause is the same contract read in the other direction, and it has no figure in it at all: a customer sues, a regulator fines, a trade mark holder objects, and the merchant pays the gateway's costs with no ceiling, no window and no deductible.
So we read the indemnity section of the same twelve hosted gateways on 30 October 2026. Twelve of twelve take an indemnity from the merchant. None of the twelve gives one back. Eight of them need no wrongdoing by you to fire, five can collect from the balance they are already holding for you, and the strongest cap in the set sits in a contract whose set-off clause lists indemnities among the things it may deduct from your settlement money.
The clause with no ceiling
A limitation of liability tells you what the gateway owes you when it fails. An indemnity is the opposite instrument: a promise that if somebody else comes after the gateway over anything connected to you, you will pay the claim, the settlement and the lawyers. It is not a share of the loss. It is the whole of it.
Two features make it the more expensive clause of the pair. It is uncapped in all twelve documents, because the cap each gateway writes is drafted as a cap on its liability to you and nothing else. And it survives: the indemnity is named in the survival clause of five of the twelve and falls under "provisions that by their nature survive" in the rest, so closing your account ends your access and not your exposure.
Twelve contracts, and not one indemnity runs your way
Here is every indemnity in the set, with what sets it off and what each gateway caps on its own side for comparison. The fourth column is the one to read first: it asks whether you have to have done something wrong.
| Gateway | Indemnity clause | What sets it off | Fault by you required? | Their cap on themselves |
|---|---|---|---|---|
| Triple-A | cl. 15, limbs (a)–(g) | Breach, regulatory action, misuse, claims by your customers, IP, taxes, a breach of your systems | Partly — limb (d) needs none | Greater of 6 months' fees or USD 50,000 |
| BitPay | Merchant Terms s. 15 | An "actual or alleged" breach of your representations, warranties or obligations | Yes — an allegation is enough | 6 months' fees |
| OpenNode | ss. 16.1 (7 limbs) and 16.2 | Your use of the service, your content, a dispute with your own customer, a breach of your systems, your staff | No | 12 months' fees |
| CoinGate | cl. 19.7 (one sentence) | Any claim "related to your use of our Services" | No | 3 months' fees |
| Confirmo | cl. 15.6, limbs (a)–(d) | Breach of law or contract, your instructions and addresses, claims by your customers, IP | Partly — limb (c) needs none | 12 months' fees, plus a statutory remedy |
| B2BinPay | Indemnification (5 limbs) | Breach, use or misuse by you or your End Users, unfinished KYC, third-party claims, your own errors | No | 3 months' fees, less costs incurred |
| NOWPayments | ss. 1.9, 19.1, 23.2, 24.3 — four separate indemnities | Your use of the account, your goods "(actual and consequential)", data-law breaches, tax | No | None stated |
| PassimPay | s. 10, limbs (a)–(e) | Your use and access, feedback you send, third-party content, breach, any law | No | USD 100 |
| Blockonomics | Indemnity, limbs (i)–(iv) | Your use of the services, your content, third-party materials, breach | No | USD 100 |
| BlockBee | Indemnification (5 limbs, reversed) | Your use and access, breach, third-party rights, any law, negligence | No | None stated |
| Plisio | "Damages" (5 limbs, website scope) | Your use of the Site, your content, breach, others' rights, "your behavior in connection with the site" | No | None stated |
| Cryptomus | cl. 9.6 only — no general indemnity | A shortfall after it has already seized your assets | Yes — your default | None stated |
Eight of twelve need no fault on your part
The amount is not the variable here, because there is no amount. The variable is the trigger, and it ranges from one tight condition to none at all.
CoinGate sets the floor for drafting effort. Clause 19.7 is a single sentence: you indemnify, release and hold harmless CoinGate, its affiliates and their officers "from any claim, liability, loss, expense or demand, including legal fees, related to your use of our Services". There is no breach limb, no fault limb, no exclusion. A customer who sues the gateway over your refund policy is covered by it, and so is a claim that turns out to be groundless: the clause is keyed to the claim, not the outcome.
OpenNode, PassimPay, Blockonomics, BlockBee, Plisio, B2BinPay and NOWPayments all carry the same no-fault limb inside a longer list. That makes eight of twelve where the sentence "your use of the services" is enough on its own. Triple-A and Confirmo need fault for most of their limbs but not all: both reach claims brought by your customers about your goods, which you can attract without doing anything wrong.
Only BitPay requires a breach, and even then not a proven one. Section 15 of its Merchant and Donee Terms is keyed to "any actual or alleged breach of your representations, warranties, or obligations". An allegation starts the obligation to pay the defence; a merchant who is eventually vindicated has still funded the vindication. Cryptomus is the twelfth and the odd one: it has no general indemnity clause at all, only the shortfall promise in clause 9.6 described below.
The limbs that reach past your own conduct
Seven of the twelve go further than your own acts and omissions. These are the limbs worth pricing, because they turn the indemnity into cover for risks you do not control.
| Gateway | Limb | Whose conduct or claims it reaches |
|---|---|---|
| OpenNode | 16.2 | Your affiliates, subsidiaries, employees "or any third party" you let touch the service |
| OpenNode | 16.1(4) and (5) | "A dispute between You and any end-user or customer of Yours"; a security breach of your own computers |
| Triple-A | 15(d) and (g) | Claims by your customers, payment networks or regulators about your goods, marketing or business practices; a compromise of your IT systems |
| NOWPayments | 19.1.4 | Your goods and services, including "damages (actual and consequential), suits, judgments, litigation costs of every kind" |
| Confirmo | 15.6(c) | "Claims by your customers or recipients relating to your goods or services" |
| B2BinPay | Indemnification, limb 2 | "Any use or misuse of B2BINPAY Services by you or your End Users" |
| Blockonomics | Indemnity (iii) | "Third Party Materials" — content it did not write and you did not either |
Who you are covering matters as much as what for. OpenNode's "Indemnified Parties" include its own "Users, customers, providers, licensees", so a merchant indemnifies OpenNode's other merchants; PassimPay's list reaches its "suppliers, and contractors", Plisio's its "independent contractors, service providers and consultants". None of them signed anything with you.
Mutual until one clause later
Triple-A has the best cap in the directory and the sharpest reversal in it. Clause 14.2 is a model of even-handedness: "Neither Party shall be liable to the other … for any indirect, incidental, special, or consequential loss or damage", with lost profits, revenue and data spelled out on both sides. Clause 15, the next clause down, then requires the merchant to indemnify Triple-A against "claims, actions, proceedings, investigations, losses, damages (including consequential and indirect damages), liabilities, costs, fines, penalties, regulatory sanctions".
The parenthesis is doing the work. Consequential damages are excluded between the parties by 14.2 and restored against the merchant by 15, which means the mutual promise holds only for claims the gateway brings in its own name and fails for everything routed through a third party. Nothing in clause 15 is subject to the USD 50,000 cap either, because 14.3 caps "Triple-A's total aggregate liability to the Merchant" and says nothing about the reverse.
Confirmo shows this was a choice, not a convention. Its clause 15.3 is headed "Excluded heads of loss (mutual)" and carries the same list; its indemnity at 15.6 adds no parenthesis taking it back, and closes with a carve-out no other contract in the set has: "For clarity, this indemnity does not apply to losses caused by our breach of the Agreement." One drafter kept the symmetry; the other unwound it in the next clause.
Your balance is the first place they look
An uncapped promise is only as frightening as the mechanism behind it, and five of these gateways do not need to sue you. They are holding your settlement money, and the contract lets them keep it.
| Gateway | Can it take it from your balance? | Who runs the defence | Indemnity named in the survival clause |
|---|---|---|---|
| Triple-A | Yes — cl. 12.1 lists "indemnities"; 12.2 bills the shortfall on demand | You defend | Yes (cl. 15 and 17.5) |
| NOWPayments | Yes — s. 1.9, your assets applied "without notice or demand", you owe any deficiency | It may assume "exclusive defense and control"; your obligation stands either way | By nature (s. 18.4) |
| Cryptomus | Yes — cl. 9.6 liquidates, withholds, converts and sets off "without prior notice and without any liability" | Not stated | By nature (cl. 16.5) |
| Confirmo | Yes — set-off against your Balance, listed among the rights that outlive termination | Not stated | Yes (named expressly) |
| B2BinPay | Yes — set-off of amounts owed against your account and wallet balances | It may control defence and settlement; you may not settle without its consent | By nature — the named list covers its own cap, not this |
| OpenNode | Not stated | You defend — except a regulator's claim, which it need not hand you | Yes (s. 16) |
| Plisio | Not stated | It controls the proceeding and decides the settlement terms | Not stated |
| BitPay, CoinGate, PassimPay, Blockonomics, BlockBee | Not stated | Not stated | BitPay s. 15 and Blockonomics named; CoinGate by nature; the other two silent |
Triple-A's clause 12.1 is the one to quote at a lawyer: it may "set off, deduct, or withhold from any amounts owed or payable to the Merchant … (including Settlement amounts) any sums owed by the Merchant to Triple-A, including but not limited to Fees, refunds, penalties, or indemnities". The word appears in the mechanism, not just in the obligation. NOWPayments gets to the same place through self-help: you "remain liable … for any deficiency" after it has applied your assets, which is a hold on your funds with a bill attached.
Two clauses that do not say what they mean
BlockBee's indemnity opens: "You agree not to hold BlockBee harmless from and against any and all claims …". Read literally, the merchant promises the opposite of an indemnity. It was still live on 30 October 2026 in terms dated 2 October 2026, and we flagged the same sentence in the cap comparison two days earlier. A court would almost certainly read the obvious intention into it, but a clause that needs rescuing is not a clause to rely on, and a gateway that has not noticed it has not had the document reviewed.
Plisio's problem is scope rather than typing. Its indemnity sits under a heading called "Damages", and every limb is about the website: "Your use of the Site", "Your behavior in connection with the site". The document says in its own first lines that it applies to "your access to and use of the Plisio.net website", and it is dated 12 March 2019. What a Plisio merchant has signed is a website indemnity doing duty for a payment contract, and whether that helps or hurts the merchant is genuinely unclear.
What the statute controls, and what it leaves alone
Two of the twelve are governed by Singapore law: Triple-A and Blockonomics. That makes Singapore's Unfair Contract Terms Act 1977 the one general statute in the set that speaks to clauses like these, and what it does is the finding of this piece.
| UCTA 1977 (Singapore) | What it controls | Does it reach a merchant's indemnity? |
|---|---|---|
| s. 2(2) | Excluding liability for negligence, other than death or personal injury, subject to reasonableness | No — it governs the gateway's exclusion |
| s. 3(1)–(2) | Applies where one party deals as consumer or on the other's written standard terms of business; that other cannot exclude liability for its own breach except so far as reasonable | No — but it reaches the gateway's cap, and a merchant on standard terms is inside it |
| s. 4(1) | A person "dealing as consumer" cannot be made to indemnify another for its negligence or breach except so far as reasonable | Only if you are a consumer. A merchant is not |
| s. 11(5) | Whoever relies on the term must prove it was reasonable | Useful on the cap, where the burden sits with the gateway |
| s. 26 | Carves international supply contracts out of ss. 3 and 4 — but only contracts for the sale or transfer of goods | No carve-out here: a payment service is not goods |
The shape is exactly backwards from what a merchant needs. Section 3 catches you in a good way: because you signed the gateway's written standard terms, its attempt to limit liability for its own breach has to be reasonable, and under s. 11(5) the gateway carries the burden of showing that. Section 4, the provision written specifically about being made to indemnify somebody else, applies only to a person "dealing as consumer" — and a merchant taking payments is not one.
So the statutory argument runs against the cap, which is already the smaller number, and not against the indemnity, which is the unlimited one. We checked the obvious escape: s. 26 removes international supply contracts from ss. 3 and 4, but only where the contract is for the sale of goods or the passing of possession or ownership of goods, which a payment-processing agreement is not. Confirmo remains the exception in this set for the reason it was the exception on the cap: it is an authorised Irish firm, so EU law reaches parts of its contract that no general unfair-terms statute would.
Four lines to read before you integrate
Four questions settle the exposure, and all four are answerable in ten minutes from a published document.
One: is the trigger keyed to your breach or to your use? "Arising from your use of the Services" means a groundless claim still costs you the defence. Two: does the set-off clause mention indemnities? If it does, as Triple-A's 12.1 does, the gateway is paid out of your settlement before you have formed a view. Three: whose conduct is in the limbs? Your employees, your end users, your customers' disputes and breaches of your own systems all appear in this set, and each is a risk you price differently.
Four: who runs the defence, and can you settle? B2BinPay may take control and forbid you from settling without consent; Plisio decides the terms of settlement; NOWPayments can assume exclusive control while your payment obligation continues. The worst combination is an uncapped indemnity you must fund, in a proceeding you do not control, collected from a balance you cannot withdraw — and nothing in these twelve documents prevents it. A self-hosted processor avoids it structurally, because there is no operator in the chain to indemnify, which is one reason BTCPay Server keeps turning up in our risk comparisons.
Eight of these twelve gateways cap what they owe you. Not one caps what you owe them.
We read fees, custody, KYC and contract terms for every processor in the directory. Confirmo is the only one whose indemnity excludes its own breach; Triple-A names indemnities in its set-off clause; BTCPay Server puts no operator in the chain to indemnify at all.
Compare Crypto Payment Gateways →Affiliate disclosure: Payyd earns a commission if you sign up to some providers linked on this page. It changes none of the clauses or findings reported here, all of which come from the providers' own published documents and are linked below.
FAQ
Do I have to indemnify a crypto payment gateway?
In all twelve contracts we read, yes. Eleven have a general indemnity clause and the twelfth, Cryptomus, has a narrower one covering the shortfall after it has seized your assets. None gives the merchant an indemnity in return, though the reverse is common in card acquiring and in the standard templates lawyers work from.
Is a merchant's indemnity to a payment gateway capped?
Not in any of these documents. Each cap is drafted as a cap on the gateway's liability to you — Confirmo's is literally headed "Aggregate cap (our liability to you)" — and no clause in the set applies a ceiling, a window or a deductible to the merchant's side. Triple-A excludes consequential damages mutually in clause 14.2 and then requires you to indemnify it for them in clause 15.
Can a crypto gateway take an indemnity out of my settlement balance?
Five of twelve say so. Triple-A's clause 12.1 lists "indemnities" among the sums it may deduct from settlement amounts; NOWPayments applies your assets "without notice or demand" and bills you for the deficiency; Cryptomus liquidates and sets off "without prior notice and without any liability"; Confirmo and B2BinPay both reserve a set-off against your balance. The other seven are silent, which is not the same as a promise not to.
Which crypto gateway has the narrowest indemnity clause?
BitPay. Section 15 of its Merchant and Donee Terms fires only on an "actual or alleged" breach of your representations, warranties or obligations, so ordinary use of the service is not a trigger. Confirmo's is the best drafted rather than the narrowest: four limbs, and the only express carve-out in the set for losses caused by the gateway's own breach.
Does the indemnity end when I close my account?
No. Triple-A, BitPay, OpenNode, Blockonomics and Confirmo name the indemnity in their survival clauses, and the rest keep provisions which "by their nature" survive. Closing an account ends your access, not your exposure to a claim brought later about the period when you used it.
Can a court strike out an indemnity clause in a gateway's standard terms?
Under Singapore law, which governs Triple-A and Blockonomics, the reasonableness test on indemnity clauses is in s. 4 of the Unfair Contract Terms Act 1977 and applies only to a person "dealing as consumer". A merchant falls outside it. Section 3 does cover a party dealing on the other's written standard terms of business, but it controls the gateway's exclusion of its own liability rather than the indemnity it takes from you.
Sources
Indemnity, set-off and survival clauses read and quoted 30 October 2026; cap figures from the same documents read 28 October 2026:
- Triple-A General Terms and Conditions — version date 20 April 2026; cl. 12.1–12.2, 14.2–14.4, 15, 17.5
- BitPay Merchant and Donee Terms of Use — effective 1 April 2026; ss. 15, 17, 18
- OpenNode Terms and Conditions — last update 29 August 2024; ss. 8, 16.1–16.3, 17
- CoinGate Merchant Terms of Service — published 6 February 2024; cl. 19.2, 19.7, 28.12; UAB "Decentralized"
- Confirmo Limited Terms and Conditions (PDF) — 2 October 2026; cl. 15.3, 15.5–15.8, 23.6
- B2BinPay Terms of Use — 26 June 2026; Limitation of Liability, Indemnification, Indemnity process, Survival
- NOWPayments Terms of Use (PDF) — 19 October 2026; ss. 1.9, 18.4, 19.1–19.3, 23.2, 24.3; FD Transfers LLC
- PassimPay Terms — 11.05.2026; ss. 09 and 10; NILESPAY FINANCE INC.
- Blockonomics Terms of Service — undated; Termination, Indemnity, Limitation of Liability; OneByZero Tech Pte. Ltd., Singapore law
- BlockBee Terms and Conditions — effective 2 October 2026; Indemnification
- Cryptomus Terms of Use — 17 August 2026; cl. 9.6, 11.6–11.8, 16.5
- Plisio Terms of Use (PDF) — last updated 12 March 2019; Damages
- Unfair Contract Terms Act 1977 (Singapore), Singapore Statutes Online — ss. 2, 3, 4, 11 and 26
- Monetizely, "Crypto Reset: What contract terms should you add before customers ask to pay on new rails?" — 26 February 2026; the nearest page in the SERP to a merchant-side treatment, and it does not discuss indemnity