MOONPAY
Security and trust center evidence
Crypto asset service provider in EU
Summary
MOONPAY has 1 registry-verified row and 4 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is SOC 2: Vendor states SOC 2 Type 2 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
As of 2 Nov 2026, CertReports holds 1 registry-verified row and 4 vendor-stated rows for MOONPAY, drawn from its trust centre (Vanta) and the Visa Global Registry. MOONPAY is listed in the Visa Global Registry of Service Providers for PCI DSS (Listed on the Visa Global Registry as PCI DSS validated through 2027-03-31), dated 23 Jun 2025, assessed by BARR ADVISORY, P.A.. MOONPAY states on its trust centre that it holds a SOC 2 Type II report, an ISO/IEC 27001 certificate, an ISO/IEC 27701 certificate and an ISO/IEC 27018 certificate, captured 21 Sep 2026; these are vendor statements, not independent confirmations. No public evidence was found for HIPAA, GDPR and FedRAMP as of 2 Nov 2026; that is a gap in the public record, not a finding of non-coverage, and the vendor can supply it under NDA.
- PCI DSS: Listed on the Visa Global Registry as PCI DSS validated through 2027-03-31, verified as of 2 Nov 2026
- SOC 2: Vendor states SOC 2 Type 2 on its trust centre, vendor-stated as of 21 Sep 2026
- ISO/IEC 27001: Vendor states ISO 27001:2022 on its trust centre, vendor-stated as of 21 Sep 2026
Facts only, each dated; nothing here is inferred, scored or advised.
Among crypto and web3 vendors
1verified rows
Category median 1, across 63 indexed crypto and web3 vendors. MOONPAY has more verified rows than 19 percent of them.
asset custodycrypto on-rampcrypto paymentsdigital assets
Compare with similar vendors
Pick your own comparisonCompliance grid
SOC 2Vendor-statedVendor states SOC 2 Type 2 on its trust centre
as of 21 Sep 20262 sources
PCI DSSVerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-03-31
as of 2 Nov 20262 sources · BARR ADVISORY, P.A.
ISO/IEC 27001Vendor-statedVendor states ISO 27001:2022 on its trust centre
as of 21 Sep 20262 sources
ISO/IEC 27701Vendor-statedVendor states ISO 27701:2019 on its trust centre
as of 21 Sep 20262 sources
ISO/IEC 27018Vendor-statedVendor states ISO 27018:2019 on its trust centre
as of 21 Sep 20262 sources
Legal artefacts
Subprocessors (39)
Amazon Web ServicesCloud provider · EU- BCBanking CircleFinance and payments · LU
BrazeCustomer support · USA
Checkout.comFinance and payments · USA
CloudFlareCloud monitoring · USA- COCondensData analytics · EU
- CRCross River BankFinance and payments · USA
DataVisor Inc.Finance and payments · USA- EFElement Financial Technology Inc.Engineering · CA
- FRFiat RepublicFinance and payments · UK
- FIFidelity Information Services (Worldpay)Finance and payments · USA
- FIFingerprintFinance and payments · USA
Google CloudCloud provider · EU- HIHiFiEngineering
- IMImmersveFinance and payments · New Zealand
IntercomCustomer support · USA- KIKilnEngineering · France
LaunchDarklyEngineering · USA- LBLead BankFinance and payments · USA
Modern TreasuryFinance and payments · USA- NONotabeneFinance and payments · USA
Nuvei (Safecharge)Finance and payments · Canada
PersonaFinance and payments · USA
PlaidFinance and payments · USA
PPROEngineering · UK
QuantifindFinance and payments · USA- RERedpandaData storage and processing · EU
- RPRevolut PayEngineering · UK
- RIRiskifiedFinance and payments · USA
SegmentData analytics · USA- SESequenceFinance and payments · USA
SiftFinance and payments · USA- SUSumSubFinance and payments · USA
- TATaskUsProfessional services · Philippines
- TITinkEngineering · Sweden
- TGToken GmbHFinance and payments · DE
- UNUnit21Finance and payments · USA
- VEVerifiFinance and payments
Very Good SecurityFinance and payments · USA
Security profile
- Pen test cadence
- annual
Displayed as a security profile from public statements, not as attestations, as of 21 Sep 2026.
Change history
- 18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
- 18 Sep 2026ISO/IEC 27018 evidence addedA ISO/IEC 27018 row entered the index with state Vendor-stated.
- 18 Sep 2026ISO/IEC 27701 evidence addedA ISO/IEC 27701 row entered the index with state Vendor-stated.
- 18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
- 18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Banking CircleBanking Circle appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: BrazeBraze appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Checkout.comCheckout.com appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: CloudFlareCloudFlare appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: CondensCondens appeared on the subprocessor list.
Similar vendors with evidence
Related by product tags and the Crypto and web3 category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
HashWhale
Crypto and web3
HashWhale brings stablecoins closer to everyday
Ethena Pay
Crypto and web3
Ethena is a synthetic dollar protocol built on crypto rails, issuing USDe - a fully backed, dollar-denominated digital asset - alongside
DPT HK
Crypto and web3
DPT (also known as DPT Pay) is a crypto Visa card that lets you spend stablecoins in 150+ countries, access DeFi yield, with assets
Moneytea
Crypto and web3
Scale your business with fiat-to-crypto on ramp
Evidence against regulations
All regulations for MOONPAYHow much of each regulation’s vendor requirements MOONPAY’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read