MoonPay has expanded the scope of its annual SOC 2 Type 2 certification, adding Privacy as a new audit category and bringing three more products under independent review as the company continues growing beyond crypto on-ramps.
The latest audit now covers Virtual Accounts, MoonPay Trade and MoonPay Commerce, extending the same security and privacy standards already applied to MoonPay’s core payments business.
The company received a clean opinion, the highest outcome available under a SOC 2 Type 2 audit, confirming that its controls operated effectively throughout the review period.
Why It Matters
Unlike a SOC 2 Type 1 audit, which reviews whether controls are properly designed at a single point in time, SOC 2 Type 2 evaluates how those controls perform over several months in real-world operation.
This year’s audit also added Privacy to the review, meaning MoonPay is now certified across four of the five Trust Services Criteria defined by the American Institute of Certified Public Accountants (AICPA): Security, Availability, Confidentiality and Privacy.
As MoonPay expands its product suite, the company says the additional coverage gives customers and partners greater confidence in how sensitive personal and financial information is managed across the platform.
“Adding Privacy to our SOC 2 Type 2 scope reflects how seriously we take the responsibility that comes with handling sensitive data at scale,” said Doug Innocenti, MoonPay’s Chief Information Officer and Chief Security Officer.
“For our customers and partners, this report is a way to independently verify that commitment rather than take our word for it.”
Beyond the On-Ramp
The recertification continues MoonPay’s broader push toward enterprise-grade compliance. The company first achieved SOC 2 Type 2 certification in 2024 and also maintains ISO 27001, ISO 27018, ISO 27701 and PCI DSS certifications covering information security, privacy and payment data.
Those standards are becoming increasingly important as crypto infrastructure providers compete for banks, payment companies and enterprise customers that require independent security verification before integrating third-party services.
MoonPay says future audit cycles will continue expanding the certification as newly acquired businesses are integrated into the platform.
As crypto companies mature into financial infrastructure providers, certifications and regulatory compliance are becoming competitive differentiators alongside pricing, liquidity and product features. For enterprise customers, security is increasingly part of the product itself.
