MoonPay has secured PCI DSS 4.0.1 recertification, reaffirming its Level 1 compliance status within the enhanced payment security framework.
In March 2025, MoonPay initially achieved certification under PCI DSS 4.0. The recent version, 4.0.1, does not introduce new requirements but instead clarifies existing guidelines and offers more consistent implementation support for organizations.
Scope and Significance of Compliance
Maintaining Level 1 compliance signifies that MoonPay’s security measures continue to meet the updated standards without necessitating major changes to its compliance program. This certification is particularly stringent, typically reserved for entities processing significant volumes of card transactions.
In addition to PCI DSS Level 1, MoonPay holds several other certifications including SOC 2 Type 2, ISO 27001, ISO 27018, and ISO 27701. These collectively address various aspects of information security management, privacy controls, and cloud-based personal data protection.
A company representative highlighted that upholding this certification amidst evolving standards underscores a continuous commitment to maintaining robust security practices, providing users with assurance as the regulatory landscape shifts.
Context and Industry Relevance
The PCI DSS 4.0.1 standard was released by the PCI Security Standards Council to correct minor errors and ambiguities in version 4.0. Organizations certified under 4.0 were mandated to transition to 4.0.1 to retain valid compliance status.
This standard dictates how entities handling cardholder data must protect it, with its requirements enforced globally through card network rules. For crypto platforms managing fiat on-ramps and card-based transactions, PCI DSS compliance is crucial for integration into traditional payment ecosystems.
As regulatory attention intensifies around crypto-linked payment services worldwide, security certifications like these carry significant operational and reputational importance. MoonPay’s recertification aligns the company with industry requirements as broader standards evolve to prioritize consumer data protection and transaction security.
