NOWPayments and BlockSec have issued a free, practical checklist intended to help businesses harden the technical and compliance aspects of accepting and handling crypto payments. The Crypto Payment System Security and Technical Compliance Checklist captures 25 distinct controls organized into nine categories, and is designed to be applied before a merchant begins accepting crypto, during vendor or architecture reviews, or as part of ongoing control assessments.
The checklist aims to convert broad security concepts into verifiable actions that multiple teams - security, operations, compliance, and product - can work through together. Each item on the list is presented as a control to confirm rather than a high-level recommendation. Teams can mark a control as confirmed, attach supporting evidence, assign an owner, and log next steps. That structure is intended to turn an abstract security discussion into a concrete working session with clear responsibilities and traceable outcomes.
A focused baseline for daily operations
The guide groups its 25 controls into nine areas:
- Private key and wallet security
- Smart contract security
- Transaction verification and signing
- Identity, accounts, and operations
- DNS and domain security
- On-chain monitoring and incident response
- AML/CFT technical compliance
- Stablecoin freeze risk management
- Continuous improvement
By design, each control is actionable: it can be confirmed, documented with evidence, assigned to an owner, and followed up with a concrete remediation or improvement step. That workflow is intended to reveal gaps between departments while those gaps are still manageable, rather than letting them become operational or financial incidents.
Operational questions the checklist helps answer
The checklist is structured to help teams address operational realities that can expose businesses to on-chain risk. Representative questions the guide helps firms evaluate include:
- Can a single individual move production funds without additional approvals?
- Are operating wallets segregated from reserve wallets?
- Are transaction-approval systems isolated from public infrastructure?
- Can suspicious transfers or privilege changes be detected in real time?
- Is there a tested plan for a stablecoin freeze event?
"The most common mistake is to treat a crypto payment like a normal online payment. On-chain transfers are final, so weak key management, unreviewed transaction approvals, or thin compliance checks can turn one mistake into a permanent loss," said Andy Zhou, co-founder of BlockSec and professor at the Chinese University of Hong Kong. That warning underscores the checklist's emphasis on controls that reflect the finality and irreversibility of on-chain transactions.
Bridging departmental responsibilities
Risk related to crypto payments often spans multiple functions. Engineering teams may operate the infrastructure that approves transactions, compliance teams may perform transaction screening, and operations teams may lead incident response when alerts trigger. The checklist provides a single shared record for these groups to document existing controls, collect evidence, assign ownership, and plan next steps.
The document is pitched at a broad set of businesses that either already accept crypto or are preparing to do so: merchants, marketplaces, gaming and iGaming operators, SaaS companies, and Web3 platforms. For these organizations, the checklist is intended to make security reviews repeatable rather than episodic.
"Real-time visibility is what makes a fast incident response possible. It can be the difference between containing a loss and losing funds to swaps, bridges, or cash-out points," Zhou added. He also emphasized operational steps to take when stolen funds are traced to an exchange or crypto service: preserve transaction hashes and addresses, trace the flow of funds, and contact the exchange through its official security or compliance channel as quickly as possible.
Educational resource, not certification
The checklist is explicitly described as an educational resource. It is not a certification program nor a substitute for legal advice. The authors state that the checklist's principles are intended to remain relevant as payment infrastructure evolves and as security threats change.
Security with minimal added friction
The guide emphasizes that effective controls should not needlessly complicate routine work. NOWPayments highlights complementary product features that aim to reduce operational overhead while strengthening controls. NOWPayments is a crypto payment gateway that supports more than 350 cryptocurrencies and over 30 stablecoins, offering broad asset coverage, automatic conversion, and flexible settlement options for merchants, online platforms, and larger businesses.
In addition to the checklist, NOWPayments offers zero-fee payouts that allow businesses to send mass payouts to ChangeNOW Pro wallets at no cost. In a public test referenced by NOWPayments, payouts were completed within seconds, with recipients required to confirm each transfer by email before funds moved. The company positions the checklist and the payout product as addressing different parts of the payments lifecycle - the checklist to strengthen controls, and the payout flow to reduce fees, manual wallet-address collection, and repetitive tasks.
Who should use the checklist
The guide is intended for teams that already accept crypto, plan to add crypto as a payment method, or want to reassess an existing payments and payouts setup. It is oriented toward identifying control gaps, assigning ownership, and compiling a practical list of next steps before gaps become incidents.
About NOWPayments
NOWPayments positions itself as a crypto payment gateway supporting 350+ cryptocurrencies and 30+ stablecoins, with an ecosystem that combines broad asset coverage, automatic conversion, and flexible settlement options for merchants, online platforms, and global businesses.
About BlockSec
BlockSec describes itself as a full-stack blockchain security and crypto compliance provider that combines research with products and services for smart contract auditing, real-time security monitoring, attack prevention, compliance, and on-chain investigation.
Contact
Head of PR
Alexandr Yarovinski
NOWPayments
[email protected]