No KYC. Same Rails.

We examined the live apps, legal terms, fee tables, privacy policies and issuer disclosures behind eight cards marketed as “no KYC”. The label survives only in a narrow sense: fewer documents at the front, while custody, screening and control move elsewhere.

Eight Web3 cards were circulated as a simple proposition: spend crypto anywhere without handing over a passport. We checked the current products behind that claim. Standard xHype and PintoPay now verify identity, KardPay does not publish enough evidence to substantiate a no-KYC route, and every remaining service reserves some combination of wallet screening, sanctions checks, freezes or later document requests.

That does not make the category fake. People can believe in crypto, hold most of their savings on-chain and still need to buy food, book a hotel or pay a company that wants pounds, dollars or euros. A card that turns USDT, USDC, SOL, BTC or XMR into spendable Visa or Mastercard value solves a real problem.

What the audit reveals is what these products actually sell. No-KYC cards do not eliminate trust. They relocate it from the visible onboarding form to the less visible issuer, BIN sponsor, processor, AML engine and refund desk. By the time the payment reaches the merchant, the crypto has normally become fiat.

For Nexus, that is the decisive test: not simply whether a passport appears at the front door, but who controls the balance after top-up, who can connect the transaction to the user, who can stop the card, and what remedy survives when it fails. This investigation follows the money and the power through all eight products.

How Nexus checked the claims

We gave priority to live application text, operative terms, privacy policies, fee tables, issuer documents and company registries. Provider marketing was treated as a claim, not proof; directories and community reports were used only as leads or corroboration. Where a legal issuer, BIN sponsor or cardholder agreement could not be established, the finding is unknown rather than an inferred answer.

Trust Nothing • Verify Everything does not mean assuming every provider is dishonest. It means refusing to let a logo, directory badge or missing passport form substitute for evidence.

TODEY deserves credit for surfacing the original list. It remains a discovery index rather than legal due diligence: its own xHype listing is marked unverified and now carries stale KYC, pricing and product information. These programmes also change quickly, so every fee and product detail below was checked on 2 August 2026. All dollar figures are USD.

What happens when crypto reaches a card network

A crypto card looks familiar at the checkout because the difficult work has been hidden before the payment reaches the merchant. In the usual model, the user sends crypto or stablecoins to a provider or designated address. Conversion timing varies: some programmes convert at top-up, while others convert at authorisation. When the card is used, the merchant’s acquirer sends a request through VisaNet or Mastercard’s network to the issuer, which checks the balance, limits and fraud rules. The merchant is normally settled in fiat.

The typical trust path: self-custodied wallet → conversion partner → issuer-controlled card balance → Visa or Mastercard authorisation → fiat merchant settlement.

Visa’s own material describes the authorisation request travelling through VisaNet to the issuing bank, while Mastercard describes calculating the net positions of issuers and acquirers for settlement. Even MaxSwap’s own explainer says its customer’s crypto is converted and the merchant receives fiat. The product is therefore crypto at the entrance and conventional card money at the exit.

This distinction also exposes a loose use of “non-custodial”. A wallet can remain self-custodial until the user presses top up. Once the value becomes prepaid card balance, it is controlled by an issuer, processor or programme partner. The user may still control the keys to the remaining wallet funds, but not the money already loaded onto the card. That portion is an enforceable claim within somebody else’s system, subject to their reserves, terms, fraud models, merchant restrictions and continued access to a Visa or Mastercard BIN.

Nor do Visa and Mastercard automatically make document-free prepaid cards impossible. Mastercard’s own BIN documentation recognises anonymous prepaid programmes with limited or no identity verification at issuance. Low-value, fixed-load or specially structured programmes can exist under applicable rules. The trade-off may be lower limits, no reloads, restricted use and weaker protections. Visa, for example, says its Zero Liability policy may exclude certain anonymous prepaid and commercial-card transactions.

Industry programmes can also use a KYB-verified commercial account that treats the end user as an authorised spender rather than a retail cardholder. This can remove an individual document upload without removing the programme owner, issuer or its power to monitor and terminate the card. No evidence reviewed establishes that any of these eight uses that exact structure.

This is the Zero Trust Network lens. Trust is not absent because the front end asks fewer questions; it is distributed across dependencies. Each dependency should be named, bounded and testable. In this market, the institution with the strongest power over the user’s money is often the one the public disclosure does not name.

The right question is not “Can a no-ID card exist?” It can. The right questions are: what kind of prepaid programme is this, which institution stands behind it, what data are collected, when can verification be imposed, and what rights remain when something goes wrong?

The Nexus verification snapshot

This snapshot separates routine document requirements from the much wider trust surface. “No routine ID” means exactly that. It does not mean no AML screening, no records, no later KYC or no power to freeze funds.

• SolCard: The base Virtual card normally requires no identity document, although later KYC is possible and SolCard explicitly says the product is not anonymous. The published economics are a $10 issue fee, 5% top-up, $0.30 per purchase and 2% FX. Its issuer and BIN are not public, while its own pages conflict over the monthly limit.

• xHype / xKard: Current standard cards require outsourced ID, liveness checks and issuer review. Essential starts at $10 for the first year, with a 2.1% top-up fee and $50,000 annual load limit. The issuer remains unnamed, while an older official page still advertises a no-KYC product that no longer describes the standard card.

• Laso Finance: Fixed-load cards normally require no identity document, but wallet, device and sanctions screening remain. US and Canadian variants can carry no deposit fee, while the international card charges 3.8% plus roughly 2% FX on non-USD spending. The limit is $1,000 per card. The issuer is not public, and expiry, freezes and contradictory refund language reduce recourse.

• Trocador: Checkout normally requires no document, but activation can require personal details and downstream partners can demand KYC. Its page quotes 3% plus $2 depending on the provider. Obsidian adds $0.60 per purchase, $5 monthly and 2.75% FX. The listed $1,000 is per card, not per day.

• PintoPay: The current product is explicitly KYC and AML controlled. The headline card cost is $35, while many fees and limits sit inside the interface. Its issuer is not public, and the terms allow broad data collection, custody and freeze powers.

• KardPay: Public sources conflict, so a no-KYC route cannot be verified. Core is $29, with a 5% top-up fee and $10,000 annual limit. The issuer and claimed licensing route are not substantiated in the public material reviewed.

• OffGrid: The service directly promises no government ID, but permanent transaction records remain. Edge costs $49 yearly, with a 1.5% top-up fee, $1,000 daily limit and $2,000 monthly limit. Its public terms name no company, issuer or governing country, and termination can forfeit card balance.

• MaxSwap: There is no mandatory KYC at ordinary entry, but later verification can be triggered. Issuance is $50, the minimum initial balance is $25 and top-up costs 4.5% plus $1. The service is custodial, the issuer is not public, refunds depend on reserves, and its own fee disclosures conflict.

SolCard: no document at the front, plenty of control behind it

SolCard’s base Virtual product is one of the stronger examples of a card that normally avoids documentary verification. Its current fee table shows a $10 issuance fee, 5% top-up fee, $0.30 successful-transaction charge and 2% cross-border or FX fee. It is an online virtual card rather than a cash-access product. However, its own About page now says identity verification may be required for certain tiers, features or spending limits and that the product is neither anonymous nor untraceable.

The privacy policy explains why. SolCard can process email, wallet addresses, top-up and withdrawal history, card transactions, IP address and device identifiers, then share relevant data with issuers, networks, verification providers and authorities. Its terms identify SC Payments Limited as programme manager, but do not publicly identify the issuer. Without the issuer, BIN country or cardholder agreement, safeguards and complaint routes cannot be independently checked.

The public disclosures also need basic housekeeping. SolCard’s main product page says the Virtual card has a $5,000 monthly limit, while a July 2026 help page says $10,000. Its marketing promotes merchants that another support page lists as potentially blocked, sometimes with repeated attempts risking card cancellation. Geographic pages conflict over US access. Most importantly, SolCard has previously acknowledged that a legacy provider problem left more than 200 users unable to access $54,675.50. It promised reimbursement and reported 44% processed at the time of that update. This does not prove the current programme will fail. It proves provider risk is not theoretical. SolCard is document-light at entry and issuer-opaque after top-up.

xHype: the old “email only” line no longer describes the standard card

The current xHype Superwallet flow is materially different from the xKard page still circulating in directories. Standard card buyers select an ID country, pay for a tier, complete document and camera verification through a service xHype calls Verinex, then face a separate issuer review. xHype says it receives only a result rather than the raw KYC file. That could reduce one exposure point, but it is outsourced KYC, not no KYC. The live app text observed on 2 August 2026 places payment before verification; if verification fails, it directs the user to support to complete KYC or arrange a refund, while the formal terms do not guarantee refund of membership fees.

The current Superwallet prices Essential at $10 for the first year, with a 2.1% top-up fee and $50,000 annual limit. Premium is $58 a year with a 1.8% top-up fee and $250,000 annual limit. Whale is $70 a year, 1.2% and $1 million. A $0.30 authorisation charge and possible cross-border costs also apply. Yet the older, still-live xKard marketing page claims a zero-knowledge, no-KYC model and shows $108, $228 and $588 annual pricing with older limits and higher top-up fees. Its cookie page admits analytics and third-party cookies while the marketing page says there is “no tracking”.

The current terms are frank that XHYPE FZCO is not a bank, electronic-money institution, issuer or card-programme manager. The underlying issuer remains unidentified. They also allow chain analytics, source-of-funds checks, holds and termination, while limiting xHype’s liability largely to platform or membership fees rather than sums held in third-party card products. The current frontend advertises a separate no-verification physical-card presale with very high limits, but its price and availability are backend-controlled and no named issuer or public cardholder agreement was found. The original “only email is needed” summary is no longer reliable for the standard card. Its real privacy proposition is privacy-minimised KYC, not no KYC.

Laso Finance: the most coherent no-document model, with sharp boundaries

Laso is closer to what many readers imagine they are buying. A user connects a wallet and purchases single-load, non-reloadable prepaid value with stablecoins. Normal card ordering does not require an identity document. That design resembles buying a fixed-value prepaid card rather than opening a reloadable bank-like account, which helps explain how the low-information route can operate.

The details matter. According to Laso’s current fees, US and Canadian variants can carry no deposit fee, while the international card charges 3.8%, with approximately 2% FX for non-USD spending. The maximum single card load is $1,000. The user agreement describes $1,000 daily POS/PIN spending and a larger aggregate daily prepaid-access purchase ceiling, so the tweet’s simple “$1,000 daily” line misses the structure. Cards are non-reloadable, have no ATM or transfer function, and can expire after six months with remaining value lost.

No documents does not mean no compliance. Laso describes blockchain risk screening, sanctions controls, device fingerprinting, location checks and transaction monitoring. Suspected restricted-region or high-risk activity can lead to cancelled orders, held funds, verification or reporting. Laso is listed in the US FinCEN MSB database as a seller of prepaid access, but FinCEN itself warns that registration data are supplied by the registrant and do not amount to approval, licensing or endorsement.

The largest practical concern is recourse. The public agreement does not identify the bank or custodian behind a specific card. Its refund policy says issued cards are final, yet the fee page advertises a 14% withdrawal/refund route “if possible”, and another interface describes a manual process that may involve the Laso team spending or reselling an unused card. Laso also published an issuer-change account explaining that a previous international reloadable partner abruptly stopped serving crypto-card clients without stringent KYC. That candour is useful, and the episode makes the point: Laso has a coherent fixed-value model, but its availability still depends on the programme above it.

Trocador: buying prepaid value, not opening a crypto debit account

Trocador is best understood as an aggregator. Its current prepaid-card page sells Reward Visa and MyPrepaidCenter Mastercard products for US use, plus an international Obsidian Mastercard. The user pays crypto, and in return receives fixed fiat prepaid access. The currently listed denominations top out at $1,000. That is a per-card value, not the daily spending limit repeated in the original list, and Trocador says there is no limit on the number of cards.

The fee shorthand is also incomplete. Trocador’s page quotes 3% + $2 depending on the provider, not merely a $2 registration fee. Obsidian then charges $0.60 on each purchase, $5 monthly after the second month and 2.75% FX. Its redemption instructions reject VPNs, proxies, Tor and some ad blockers. The US-only products obviously carry their own location restrictions.

Ordinary checkout requires an email and normally no identity-document upload. Activation can still require a truthful name, email, phone number and address. Trocador’s terms say partners conduct AML screening and may demand KYC when funds are flagged. Acceptance at 3-D Secure merchants or merchants that reject prepaid cards is not guaranteed, and the products are generally non-refundable. Trocador also does not publish the issuer bank or complete cardholder agreement before purchase for each live programme.

There is a material legal inconsistency: Trocador’s general terms say partner users must not be in the United States or EEA, while the sale page offers two products that are US-only. Its privacy policy is stronger than many competitors on short retention for swap data, but it is largely written for exchanges, not card activation. The card provider, issuer and network keep their own records. “Email at checkout” is therefore not the same thing as an anonymous card, and the aggregator model adds another dependency rather than removing one.

PintoPay and KardPay: two claims that no longer withstand scrutiny

PintoPay’s current homepage visibly advertises “KYC 3D Secure” and “ISO AML/KYC”. An older test site still carries a “without KYC” line, while the live service has moved on.

Its April 2026 terms allow onboarding and continuing identity checks, source-of-funds requests, transaction review, suspension and termination in response to issuer, payment-system, regulator or AML requirements. The privacy policy covers names, date of birth, citizenship, contact details, identity documents, sanctions information, source of funds, activity, IP and device data, with sharing across issuers, custodians, verification and anti-fraud providers. The $35 headline card cost may still be current, but many fees and limits sit inside the interface. The actual issuer is not clearly named. PintoPay may be useful, but it is not presently a no-KYC card.

KardPay is murkier rather than cleaner. Its current pricing page has moved from the quoted $28 to a $29 Core tier with a 5% top-up fee and $10,000 annual limit. Pro costs $99 and Elite $299, with higher limits and lower top-up percentages. The site calls the product regulated and refers to Visa/Mastercard principal membership, but does not identify the issuer, licence or bank that makes those claims auditable.

Public sources conflict. TODEY’s KardPay record appears in no-KYC discovery material while its own data field says KYC is required. The current official site does not clearly specify the onboarding standard, and terms naming ROSSCAPITAL US LLC still do not identify the issuer. Until KardPay publishes the onboarding rule, issuing institution and operative cardholder agreement together, it cannot be verified as no-KYC.

OffGrid: genuine no-ID language, weak legal transparency

OffGrid’s April 2026 privacy policy makes an unusually direct promise: no government ID, no biometric collection and no KYC. A passkey can replace an email at account creation. That is meaningful.

It still is not anonymity. The same policy says OffGrid records the chosen cardholder name, 3DS contact, wallet addresses, transaction hashes, deposits, withdrawals, top-ups, merchant names, timestamps and associated IP addresses. Financial ledger records are retained permanently for compliance and audit. The unnamed card-issuing partner receives cardholder, 3DS and transaction data. “No identity document” and “no financial record” are two entirely different propositions.

The current application shows the $49 Edge plan at 1.5% per top-up, $1,000 daily, $1,500 weekly and $2,000 monthly. The $97 Prime plan raises those limits to $2,500, $3,750 and $5,000. The terms say crypto is converted to a USD-denominated OffGrid wallet, and funds loaded to the prepaid Visa cannot be withdrawn. Accounts can be suspended and investigated. On termination, the remaining card balance may be forfeited and wallet funds may be returned only at OffGrid’s discretion.

What those terms do not say is just as important. The public text reviewed names no operating company, address, issuer, governing country or specific arbitration body. Its dispute clause refers to the jurisdiction of OffGrid’s registered entity without identifying it. The no-ID promise is meaningful at onboarding, but omitting the contracting party and institution holding the balance leaves the legal disclosure incomplete. OffGrid’s privacy proposition is weakened by the absence of a named contracting party and issuer. Load only what you can afford to have trapped.

MaxSwap: high limits do not compensate for missing foundations

MaxSwap markets a custodial crypto wallet with a virtual Mastercard. Its FAQ lists $50 issuance, at least $25 initial balance, 4.5% + $1 on top-ups and a generic $0.25 + 0.4% transaction fee. Its card policy instead lists 0.4% on successful transactions, 0.6% for non-USD settlement and $0.25 on rejected transactions. The FAQ also lists a $200,000 maximum card balance, $200,000 monthly top-up limit, $50,000 single transaction, $200,000 daily transaction limit and both a $2 million monthly and $2 million cumulative transaction ceiling. The duplication and fee conflict need clarification.

That scale makes the legal gaps more significant. MaxSwap’s card policy reserves the right to require KYC after service-rule triggers. Loaded funds normally cannot be withdrawn except by closing the card back to MaxSwap spot USDT, and a refund depends on sufficient reserve funds. The issuer is not identified in the public material reviewed. The English card page and its Spanish version also disagree on issuance and top-up fees.

The general terms name UK company MW Profit Limited, but display an October 2023 effective date. Companies House says that company was incorporated in March 2024, and its first accounts described it as dormant through March 2025. That does not by itself prove misconduct. Companies change structure and adopt documents. It does leave an unexplained clash with marketing claims that MaxSwap was founded in 2022, has tens of thousands of customers and employs 150 people. Combined with an unnamed issuer, reserve-dependent refunds and inconsistent fee pages, the right description is “no mandatory KYC at first use”, not “trustless” or “safe at high limits”.

The Nexus test: six questions before funding

Before putting money into any of these cards, ignore the logo for ten minutes and answer six questions.

1. Who is the issuer? Get the legal name, BIN country and actual cardholder agreement. “Licensed partner” is not an answer.

2. What does no KYC exclude? Look for later verification, source-of-funds requests, sanctions screening, device fingerprinting, IP retention and issuer review.

3. When does custody change? Determine whether crypto is sold at load or purchase, who holds the resulting fiat balance, and whether it can be withdrawn.

4. What is the full fee stack? Add issuance, subscription, top-up, spread, FX, authorisation, decline, inactivity, refund and network fees. A small advertised registration fee can be the least important number.

5. What breaks the card? Check countries, 3DS, merchant-category codes, prepaid acceptance, mobile-wallet rules, refund timing, expiry and maximum decline rate.

6. What happens when the BIN dies? Find the complaint route, chargeback rights, balance-return terms and whether the provider has survived a previous issuer change.

Use honest eligibility information. Do not assume a VPN turns a prohibited country into a supported one; several programmes say the opposite and reserve the right to cancel the card or hold funds. Start small, test the merchant type you need, save the terms and fee quote shown at funding, and do not park savings on a spending card.

The bridge is not the destination

None of this makes cards useless. People have lives. Rent, taxes, emergencies, children, travel and ordinary enjoyment do not wait for ideological purity. A user can reasonably take profit, pay a bill or buy a flight without betraying a thesis. The mistake is to count the resulting Visa or Mastercard settlement as on-chain adoption.

A bridge can help people enter an economy. It is not the economy.

When a holder loads stablecoins onto one of these products, the merchant does not receive crypto. The merchant does not open a wallet, learn to manage keys, price goods on-chain, pay a supplier with the asset or keep any balance in the network. The provider sells, redeems or transforms the crypto into prepaid fiat value, while the issuer, acquirer and card network retain the transaction relationship and its fees. The user has gained access to the old economy. The old economy has not adopted the new one.

Crypto does not literally disappear when it is transferred or sold. Depending on the asset and provider, conversion may be a market sale, stablecoin redemption, internal treasury transfer or hedge. The deeper leak is that merchant demand, settlement, fees, data and customer relationships remain on legacy rails. The merchant has no reason to accept or retain the asset, and the chain never develops the dense loop that makes a monetary network useful. The more crypto becomes inventory to liquidate invisibly at checkout, the less pressure there is for the surrounding economy to accept it directly.

A blockchain does not win merely because its token pumps or its total value locked looks impressive. It wins when people can earn on it, save on it, borrow on it, price on it, pay on it and receive payment on it without every useful action terminating in a bank-controlled unit. The merchant then pays a supplier on-chain, the supplier pays staff, and those staff spend again. That circularity is the difference between an asset people speculate on and an economy people inhabit.

It need not be one universal chain in a literal sense. Different regions and purposes will use different networks, and interoperability matters. The simpler point is that at least one chain, or a small connected set, needs enough liquidity, stability, low-cost settlement, privacy and merchant tooling that people want to stay. Endless fragmentation creates thousands of exits without creating a destination. A payment network becomes powerful when the next recipient wants the asset, not merely when an intermediary can liquidate it.

Crypto cards are useful precisely because the surrounding economy still refuses crypto. They are adapters at the network edge, and easy exit can make entry feel safer. But if every “crypto payment” ends in a forced conversion and card settlement, crypto has improved the funding source while conceding the monetary network.

Zero Trust does not mean refusing every bridge or pretending people no longer need fiat. It means knowing exactly where control sits, reducing unnecessary dependencies and refusing to mistake a marketing claim for a security property. Use these cards when they solve a real problem. Disclose as little as lawfully necessary, load only what you need, verify the issuer and recourse, and assume the balance is custodial once it leaves your wallet.

The standard worth building towards is more demanding: assets that can be earned, saved, priced, paid and received on-chain, with enough liquidity and merchant tooling that the next holder chooses not to exit. A no-KYC card can remove one checkpoint. It cannot remove the institution behind the card. Crypto wins when value has somewhere on-chain to stay.

Veritya Thalassa