CS2 Trade Protection: Who Bears Reversal Risk?

hunbenji

AssetPay team · August 11, 2026

Since late 2025, every CS2 skin that changes hands by trade can be pulled back for seven days. Valve's trade protection was built for players — a scam victim can be made whole — but for a business taking skins as payment it rewrote the core question of the whole model: when is a skin deposit actually final?

We covered the mechanics in our reference on Steam's trade restrictions. This post is the commercial half: how reversal risk gets allocated between you, your provider, and your user — and the questions that expose how a provider really handles it. Ask all six before you integrate anyone, including us.

#Who eats the loss when a trade is reversed?

This is the first question because every other answer depends on it, and because there are only three honest places a reversed deposit can land: the user's balance on your platform, your merchant balance, or the provider's own book. A provider that can't tell you which — or implies reversals don't happen — hasn't priced the risk, which means someone is carrying it unknowingly. That someone is usually you.

How AssetPay allocates it: credit is staged so a reversal unwinds cleanly instead of leaving a hole. The portion still pending simply never lands. The portion advanced early is deducted back from the user's balance through a reverted callback your handler must process — the integration docs treat handling it as mandatory, because ignoring reversals is how balance discrepancies are born. The user who reversed also takes a trust penalty that shrinks or zeroes their future instant credit, and if they're identity-verified, the penalty follows them across every linked account.

#Is "instant credit" guaranteed money or an advance?

It is always an advance. The protection window is a Valve-side rule enforced on Steam's own infrastructure that no gateway can bypass, so any provider crediting CS2 value before day seven is fronting that value against something — the only real questions are against what, and how much.

How AssetPay does it: a deposit splits into preCredit, paid the moment the trade enters its hold, and pendingCredit, paid when the window clears — the two always sum to the full quoted price.

The instant portion is backed by a collateral pool sized by a risk model: the user's deposit history, a trust factor that grows with completed trades, identity verification, and the context you pass about your own user (wager history, KYC level, payment methods). Per-deposit advances are capped — by default $50 for unverified users and $1,000 for verified ones — so exposure on any single reversal is bounded by policy, not by hope. A brand-new anonymous account gets a small advance; a verified regular can see the full value instantly. That's the honest shape of "instant": earned, collateralized, and capped.

Rust, for what it's worth, has no trade protection at all — Rust deposits credit instantly and in full, which is one reason Rust deposits are worth taking seriously.

#What share of an item's value actually reaches you?

"0% fees" is the least informative number in this industry, ours included: the real price of every skin gateway is the spread between an item's market value and what settles to your balance. The only way to compare providers is to quote the same basket of real items through each and divide settlement by independent market value — weighted by item price, since spreads differ between a $3 skin and a $500 one. We published our own basket benchmark and methodology precisely so it can be checked and repeated against anyone, and our pricing page explains where our margin lives.

#How and when can you withdraw your merchant balance?

Settlement currency and payout schedule vary more between providers than any fee does — some settle fiat, some crypto-only, some hold everything until each trade's window clears. That last one matters more than it sounds: a provider that credits you promptly but only releases withdrawals after every underlying trade has cleared its window is effectively running a seven-day float on your revenue, and you will feel it in working capital long before you notice it in fees.

Ask for the withdrawal path in writing: currency, schedule, minimums, and what portion of your balance is spendable while deposits are still inside their protection window. Ask what happens to a withdrawal request that lands mid-window, and whether the amount available to withdraw is ever less than the balance shown in the dashboard — a gap between those two numbers is where reconciliation disputes start.

AssetPay settles a USD merchant balance with no withdrawal fees, and rates are agreed per merchant rather than hidden in a footnote; the pricing page sets out what is and is not billable.

#Will the provider stand behind your business model?

A gateway approving your account is an underwriting decision, not a legal opinion. If you run a case-opening or wagering product, the provider's willingness to process your deposits says nothing about whether your model is lawful in the countries you serve — loot-box and skin-gambling rules differ sharply by jurisdiction and keep moving.

The failure mode worth planning for is not rejection at signup; it is an account review at month six, once you have real volume and your deposit rail is load-bearing. That review tends to arrive with a question your onboarding never asked — a country you started serving later, a game mode that reads differently to a compliance team than it did to a salesperson, a spike that looks like something else.

Get your regulatory position from counsel, then confirm in writing that the provider accepts your vertical and each geography you serve, and ask what notice you would get if that changed. A provider unwilling to put the approved list in writing is telling you the answer is "for now".

#Who runs KYC and AML — you, the provider, or both?

The workable answer is layered, and you should distrust both extremes: a provider that does nothing pushes all compliance onto you; one that claims to handle everything can't see your side of the relationship. They see a Steam account and a trade; you see the deposit history, the wager pattern, the support tickets, and the payment methods behind the account. Neither view catches everything on its own — most abuse is visible only where the two overlap. In AssetPay's model both parties contribute signal — you pass your platform's knowledge of the user (KYC level, wager and payment history) with each session, and AssetPay runs its own identity verification, which raises the user's instant-credit caps and links their accounts so abuse on one follows them to the rest. Who must perform statutory AML duties depends on your license and jurisdictions — that part is a question for counsel, not a checkbox a vendor can tick for you.

#The six questions, in one place

Take this table into every provider call. The middle column is what an unprepared vendor says; the right column is the answer that actually tells you something.

One caveat to hold all of this loosely: trade protection is young and Valve has changed trading rules more than once since it shipped. Verify any specific window or cap — including the ones in this post — against the provider's current documentation before you build logic around it. Ours live in the merchant docs, and we'd rather you check than trust.

Evaluating providers right now? Send us the six questions — we'll answer them in writing, and we're happy to be compared on the answers.