Holyheld calls itself non-custodial. The biometric scans, frozen accounts, and Cyprus EMI tell another story.

How it works

Holyheld pairs a non-custodial wallet integration with a Mastercard issued by Unlimit, a Cypriot electronic money institution. Users connect an EVM wallet, leave their crypto on-chain, and pre-load fiat to the card; the smart-contract layer converts crypto to euros at point of spend. The card is available as a virtual instance immediately after KYC and as a physical Mastercard for EU residents. Apple Pay and Google Pay are supported. A personal IBAN allows SEPA transfers in and out, including for rent and salaries. The platform claims gasless approvals and on-chain coverage of up to $50,000 per transaction. Over 1,200 tokens are routed through swap aggregators, with cashback paid in USDC.

KYC & privacy

KYC is mandatory. Identity verification is performed by Sumsub and Idenfy at signup and includes full name, date of birth, address, government ID, photo, and face geometry. The privacy policy lists IP addresses, device identifiers, payment-method data, and full transaction logs as collected. Data is retained for the lifetime of the account. The card issuer Unlimit is regulated in Cyprus and is bound by EU AML directives — meaning balances can be frozen by regulatory or sanctions screening regardless of whether a user has done anything wrong. The "non-custodial" framing applies to the crypto wallet, not to the fiat balance held with Unlimit.

Strengths and limits

The genuinely interesting design point is that crypto stays in the user's wallet until tap-to-pay, which removes the deposit-and-trust step every centralised card requires. Gasless approvals and the wide token list are real conveniences. But Holyheld is EU-only, capped at €1,000 per day and €5,000 per month at ATMs, and the cashback (0.5–1% in USDC) is paid only on the active tier. Trustpilot reviewers report accounts being frozen without warning and customer-service silence — a four-figure freeze case has been escalated to CySEC. The audit claim made on the homepage names no firm and links to no report. None of this rules Holyheld out, but it forces a category-honest reading: this is a regulated EU fintech wrapped in DeFi UX, not a no-KYC rail.

Verdict

Holyheld solves a real friction for EU crypto holders who want to spend without first selling on a centralised exchange. It does so by collecting a level of personal and biometric data that places it firmly outside this site's trustless and anonymous tiers, and by routing fiat through an issuer that has frozen at least one user's balance with no public resolution. Useful tool, not a privacy tool.