How virtual accounts and offramps really work

You send a dollar-backed coin out of your wallet, and euros land in your bank account a minute later. Almost nothing about that minute happened on a blockchain: that leg took two seconds and cost almost nothing. Everything else was banking, and banking is where cashing out actually breaks.

What is a virtual account, really?

A virtual account is a set of permanent bank deposit details, issued to you by a licensed financial company, wired so that any money arriving is automatically converted into a stablecoin and sent to a wallet address. Send a bank transfer to those details and a token shows up on-chain. That is the whole trick.

The details look like the real thing, because on the network they are. Bridge, the stablecoin company Stripe acquired, issues six flavors: a US account and routing number for ACH and wire, a euro IBAN for SEPA, a UK account number for Faster Payments, a Mexican CLABE for SPEI, a Brazilian key for Pix, and a Colombian number for Bre-B. Its documentation is blunt about the gate in front of all of it: customers must be onboarded and KYC-approved before a virtual account can exist.

What it is not is a bank account. You do not have a bank. You have a pointer, reserved for you, inside somebody else’s bank. That distinction is invisible when everything works and it is the only thing that matters when it does not.

Why does the name on the account suddenly matter?

For years the standard design was one big pooled account plus a reference code in the payment message. Your money arrived in a company account shared with thousands of other people, and a string of characters told the ledger it was yours. It was cheap, and it was fragile: strip the reference, and the money is an orphan sitting in a pool.

Then a European payments law that has nothing to do with crypto quietly rewrote the architecture. Since 9 October 2025, payment providers in the euro area must run a check called verification of payee: before you can authorize a transfer, your bank compares the name you typed against the name actually on that IBAN, and warns you if they do not match. The service has to be free. Providers outside the euro area have until 9 July 2027.

Run that rule against a pooled account and every single incoming transfer throws a mismatch warning, because the account belongs to the provider, not to you. So the market moved. Bridge now states that deposit details are issued in the customer’s name. BVNK draws the line explicitly between accounts issued in the platform’s own business name and customer accounts issued in the end customer’s name, and reserves the second kind for platforms that are themselves fully licensed financial services providers.

The same law forced the other half of the change: euro-area banks have had to be reachable for instant transfers around the clock since January 2025, able to send them since October 2025, and forbidden from charging more for an instant transfer than for a slow one. Instant euro payouts stopped being a premium feature and became a legal floor.

What does Europe’s banking regulator make of this?

Not much, as it turns out. The European Banking Authority ran a fact-finding exercise on virtual IBANs through 2023 and 2024 and published the result in May 2024. It is not a flattering document.

It opens by noting there is no legal definition of a virtual IBAN at all, then describes them in a line worth quoting: they “have the same functionality and format as standard IBANs, which makes them indistinguishable by third parties from standard IBANs,” while being linked to a different account, the master account, which has its own IBAN. Your bank cannot tell the two apart. That is exactly what the product is for, and exactly what worries a supervisor.

From there the report lists ten risks. National regulators do not agree on basic questions: whether an IBAN must be matched one-to-one to a payment account, or whether issuing a virtual IBAN carrying another country’s code requires a branch in that country. Supervisors said they often discover these programmes only during inspections. Those who had actually reviewed a provider’s controls rated them “poor or very poor,” while cautioning that the sample was not representative.

The EBA also saw the name problem coming. Among its ten risks is one about the verification-of-payee service “where the payee using a vIBAN is not the master account holder.” The regulator flagged the collision between named-payee checks and pooled accounts a year and a half before the deadline landed.

What actually happens when you cash out?

An offramp is the conversion of a stablecoin back into ordinary money in a bank account. It runs in four steps, and only the first one is on-chain.

1. You send the coin. It goes to an address the provider controls. On a low-fee network like Base this is seconds and cents.
2. The provider credits you in its own books. From this moment the number you care about lives in a private ledger, not on a public one.
3. It converts. Some providers route through market makers, some redeem directly with the issuer of the coin.
4. It pays out on a local rail. SEPA or SEPA Instant in Europe, ACH or wire in the US, Pix in Brazil, and so on.

The load-bearing detail is that the blockchain leg and the bank leg are two separate settlements with nothing binding them together. No single transaction moves your coin and your euros at once. The provider’s own cash bridges the gap. That is the real reason an instant offramp still has cut-off times, daily limits and the occasional compliance hold: the token moved, but a company had to decide to move its money after it.

Who is holding your money in the middle?

Between step one and step four you are not a wallet holder. You are a creditor of a payments company, which is a different legal animal entirely. The EBA puts a sharper edge on it: where the end user is not the master account holder, they “may not have a payment account, within the meaning of PSD2, and therefore they may not benefit from all the safeguards and rights in PSD2 associated with having a payment account.”

Safeguarding is the protection that does exist. BVNK, to take a provider that documents it clearly, operates in the UK through System Payment Services Limited, an e-money institution regulated by the Financial Conduct Authority, and has to keep customer funds separate from its own in a dedicated safeguarding account at a bank. Read its guide, though, and two limits are stated plainly: safeguarding covers the e-money in your wallet and does not cover crypto assets, and the UK deposit compensation scheme does not apply to e-money at all. The EBA found the same fog across the market, listing consumer risk from unclear disclosure about which deposit guarantee scheme, if any, actually covers you.

It is worth looking at who those banks are, because the answer punctures the mystique. Kraken’s euro withdrawals are settled through Bank Frick, Banking Circle and ClearJunction. Even the crypto exchange has a bank. The stack does not escape the banking system; it rents a lane in it.

Segregation is a genuine protection, and it protects against exactly one thing, the provider going bust. It does nothing about a freeze. A compliance flag stops the payout while your money is already out of your wallet and inside their system.

And there is a second freeze switch further upstream that has nothing to do with your provider: the issuer of the coin can blacklist an address directly. On 23 March 2026 Circle froze sixteen unrelated business wallets holding USDC, acting on a US civil case whose details were not disclosed; the affected addresses belonged to exchanges, casinos and forex platforms with no visible link between them. The on-chain investigator ZachXBT asked publicly how that had happened, and Circle unfroze one of the sixteen three days later without an explanation. Whatever the merits of that particular case, the switch exists, and it sits above every offramp in the market.

Which licenses does any of this require?

Two, usually, and this is the part most explanations skip. Under Europe’s MiCA rules, swapping a token for money is a regulated service in its own right, and the firm doing it needs authorization as a crypto-asset service provider.

But those rules stop at the euro. The moment a company holds or moves ordinary money on your behalf, it falls under payment services law and needs a second license: a payment institution or an electronic money institution. That is why the offramp firms look the way they do. Ripple got preliminary approval for its European crypto license from Luxembourg’s regulator in June 2026, and already held an e-money license there; it sells the eventual pair as a single integration. BVNK holds e-money authorization in the UK alongside its EU crypto registration.

Which reframes the whole category. An offramp is a payments company that happens to accept tokens, and its hardest asset is a license, not a smart contract.

So what does it actually cost?

Rarely what the fee line says. Kraken charges 1 euro for a SEPA withdrawal and 1 euro for an instant one, on a 2 euro minimum. As a transfer cost that is close to nothing.

The money is made on the conversion. Redeeming directly with the issuer is the clean path, one coin for one dollar with no spread, but that door is institutional: Circle describes its Mint product as being for exchanges, institutional traders, wallet providers, banks and consumer-app companies. An individual does not get an account there. So a normal person’s coins become euros at somebody’s quoted rate, and the margin lives in the gap between that rate and the interbank one. Read the rate, not the fee.

Why it matters

The direction of travel is clear enough. Cashing out is being absorbed into regulated payments infrastructure, and infrastructure gets boring, then cheap, roughly in that order. The named-account shift is a good early sign: crypto plumbing is now being shaped by consumer payment law rather than by what was convenient to build.

There is a sharper point underneath, though. Every conversion is a fee, a spread, a compliance check and a delay. The best offramp is the one you do not use, because the money was already spendable where it sat. It is the same logic behind settling a shared tab in a dollar-backed coin with Spliz: friends square up in seconds, and an offramp only enters the picture when somebody genuinely wants euros in a bank. If the coins themselves are new to you, our plain-language explainer starts one step earlier.

Cashing out was never a crypto problem. It is a banking problem wearing a crypto label.

Sources

• Bridge, virtual account documentation: supported currencies and rails, accounts issued in the customer’s name, KYC prerequisite.
• BVNK, virtual accounts overview: business-name versus customer-name accounts, segregation, licensing conditions.
• EUR-Lex, Regulation (EU) 2024/886 on instant credit transfers: verification of payee, reachability and pricing, with the 2025 and 2027 deadlines.
• European Banking Authority, Report on virtual IBANs (EBA/Rep/2024/08, May 2024): the missing definition, the ten risks, the PSD2 and deposit guarantee gaps.
• FSMA, the Belgian regulator’s list of the crypto-asset services that require MiCA authorization, including exchange of crypto-assets for funds.
• BVNK, guide to safeguarding: the regulated entity, what segregation covers, and why the deposit compensation scheme does not apply.
• crypto.news and BanklessTimes, the March 2026 freeze of sixteen USDC business wallets and the first reversal.
• Ripple, on pairing a European crypto authorization with an existing e-money license.
• Circle, Circle Mint documentation: who is eligible to mint and redeem directly.
• Kraken, euro withdrawal fees, minimums, processing times and banking providers.