How a Company Holds and Moves USDC on Arc

There is no corporate USDC account in the sense a bank would recognise. There are addresses, and a decision about who holds the keys that control them — the decision that sets your loss scenarios, your approval process and what your auditor will accept. Settle it first; everything else is downstream.

This page covers Arc in its first weeks of mainnet. Where something is still settling — particularly which custodians have Arc in production — we say so rather than guess, and we revise this page as the ecosystem fills in. Last reviewed: September 2026.

What does a company actually own when it holds USDC?

Control of an address. USDC is a dollar-denominated token issued by Circle, recorded onchain — as a balance in a blockchain, a shared database maintained by many independent computers rather than one institution. Control comes from a private key: a secret number that authorises transfers from an address. Whoever can sign with it can move the funds. A wallet is the software or hardware that stores that key, and custody is the question of who holds it.

Two Arc facts shape operations. Gas — the fee a network charges to process a transaction — is paid in USDC, so a treasury funds one asset rather than two, and settlement is final in under a second, leaving no window in which a mistake can be recalled.

What are the four custody models?

An exchange or fintech account. A regulated company holds the keys, you log in with a password, and recovery is a support ticket rather than a catastrophe. Lowest effort, and where most companies start. The cost is counterparty risk: the balance is that company's obligation.

A qualified custodian. A regulated institution holds the keys under a custody agreement, with insurance, audits and a defined legal relationship. It suits balances large enough to justify the fees, and is often what an auditor or institutional investor expects. The established providers are Fireblocks, BitGo, Anchorage Digital, Coinbase and Fidelity Digital Assets, and more of this activity now sits inside federal supervision than two years ago: Anchorage has held a national trust bank charter from the Office of the Comptroller of the Currency since 2021, and Banking Dive reported in December 2025 that the OCC conditionally approved national trust charters for BitGo, Paxos, Ripple, Fidelity Digital Assets and Circle.

Which of them has Arc in production is a live question. Circle names Fireblocks among the day-one Arc integrations, which is the strongest statement available; beyond that, Arc reached public mainnet on September 16, 2026 and support is landing week by week. We deliberately publish no support matrix here, because it would be wrong within a fortnight. Ask your custodian whether Arc is supported, on what account types, and whether deposits and withdrawals are both enabled — in writing.

Self-custody with a multisig. Your company holds the keys, spread across several people, and transfers need more than one signature. No counterparty can freeze the funds, fail with them or delay a withdrawal. In exchange you own operational security: no reset, no recovery desk, and a lost key is permanent.

A hybrid, which most competent finance teams run. The reserve sits with a custodian or behind a high signing threshold; a smaller operating balance sits in a hot wallet — one connected to the internet, used for daily payments — topped up on a schedule. Same logic as keeping most of the cash on deposit and a float in the current account.

What is a multisig, and why is it the standard answer?

A multisig, short for multi-signature wallet, is a smart contract — a program running on the blockchain — that holds funds and executes a transfer only once a defined number of approved signers have authorised it. A 2-of-3 wallet has three key-holders and needs any two.

It is the standard answer for corporate funds because it maps onto controls a finance team already runs. It removes the single point of failure, so one compromised laptop or one departing employee cannot drain the treasury. It survives loss, since in a 2-of-3 a lost key leaves two working ones. And it makes segregation of duties enforceable in code rather than policy. Most companies use 2-of-3 for operating funds and 3-of-5 for reserves. Wallet options are in the guide to Arc wallets.

How do you avoid a bus-factor problem?

The question is blunt: if one person is hit by a bus, can the company still move its money? For a single-key wallet the answer is no. Spread signers across people who will not be lost in one event — different roles, different devices, never all on one laptop. Store each signer's recovery phrase, the human-readable backup of a private key, offline and physically secured, its location known to a second person. Rehearse the recovery procedure, including how a signer is removed the day they leave — learning a year later that a former CFO can still sign is a finding your auditor will not treat gently.

What does an approval workflow look like?

The shape of your existing payment approvals, expressed onchain. A payment is proposed with an amount, a destination and an invoice reference; a second person reviews it, verifying the destination address independently, because address details intercepted in email are a known attack; it is then signed to the threshold and settles.

Two controls earn their friction: whitelist recurring counterparties so anything novel is visibly exceptional, and test every new address with a small payment first. Paying contractors is covered in how to pay international contractors in USDC; the monthly cycle around it is in treasury operations on Arc.

What does the audit trail look like?

Better than a bank statement in one respect, worse in another. Every transfer is permanently recorded with an amount, timestamp, sender, recipient and a transaction hash anyone can verify independently. What it does not record is meaning: it cannot tell your auditor what the payment was for, or who the counterparty legally is.

So your own record carries the weight. Keep the hash, date, USD value, counterparty legal name, invoice reference and approver for each transaction, and maintain an address book mapping every address to a named entity — an auditor cannot do that mapping and will ask you to. Where amounts are commercially sensitive, Arc supports opt-in confidential transfers that shield amounts while leaving addresses visible, with view keys so an auditor still sees what they need; the limits are set out in confidential transfers on Arc. Tax and accounting treatment differ by jurisdiction and reporting standard, and this is not accounting, tax or legal advice. Agree the classification of a USDC balance with your auditor before your first close rather than during it — in most frameworks it is neither cash nor a cash equivalent, and finding that out at year-end is an avoidable restatement.

Frequently asked questions

Can a company open a USDC account like a bank account?

Not in the bank sense. The closest equivalents are an account with a regulated exchange or a qualified custodian, where a company holds the keys and you get a login and a support line, or a Circle Mint account for businesses that mint and redeem USDC with the issuer.

Is self-custody riskier than using a custodian?

It moves the risk rather than removing it: a custodian eliminates key-loss risk and adds counterparty risk, and self-custody does the reverse. A multisig is what makes self-custody defensible for a company.

Do we need a separate token to pay network fees?

Not on Arc. Gas is paid in USDC, so the treasury funds and monitors one asset rather than holding a second, volatile balance purely to keep payments moving. Fees are a fraction of a cent per transaction, which for most treasuries makes them a rounding line rather than a planning constraint.

Will our auditor accept onchain records?

They will accept them as evidence that a transfer occurred, but still require your records to establish what it was for and with whom. Build the address book and transaction-to-invoice mapping from day one.