Amsterdam, Netherlands, July 27, 2026 — NOWPayments and BlockSec have released a free checklist covering 25 controls across nine security and technical compliance categories for businesses using crypto payments.

The checklist is available through this form.

Crypto payments can be enabled quickly, but the companies said keeping the full payment flow secure requires controls against risks such as key compromise, suspicious transactions, account takeover and stablecoin freezes. Unlike card payments or bank transfers, many blockchain transactions cannot be reversed once confirmed, making prevention, approval controls and incident response procedures central to day-to-day payment operations.

NOWPayments is a global crypto payment gateway that supports more than 350 cryptocurrencies and over 30 stablecoins. Its services include broad asset support, automatic conversion and flexible settlement options for merchants, online platforms and larger companies handling crypto payments at scale.

NOWPayments developed the Crypto Payment System Security and Technical Compliance Checklist with BlockSec, a blockchain security and compliance firm. The guide is intended to translate broad security principles into practical checks that security, operations, compliance and product teams can review together.

The companies said the checklist can be used before a business begins accepting crypto payments, during a vendor or architecture review, or as part of a recurring control assessment.

A baseline for daily operations

The checklist includes 25 controls across nine areas:

• Private key and wallet security
• Smart contract security
• Transaction verification and signing
• Identity, accounts and operations
• DNS and domain security
• On-chain monitoring and incident response
• AML/CFT technical compliance
• Stablecoin freeze risk management
• Continuous improvement

Each item is presented as a control to verify rather than as a general recommendation. Teams can mark a control as confirmed, attach supporting evidence, assign an owner and record the next required action.

According to the companies, that structure is designed to turn a broad security discussion into a working session with defined responsibilities. It may also help identify gaps between departments before they become operational or financial problems.

The checklist is designed to help businesses answer operational questions, including whether one person can move production funds alone, whether operating wallets are separated from reserve wallets, whether transaction-approval systems are isolated from public infrastructure, whether suspicious transfers or privilege changes can be detected in real time, and whether a tested plan exists for a stablecoin freeze event.

“The most common mistake is to treat a crypto payment like a normal online payment. On-chain transfers are final, so weak key management, unreviewed transaction approvals, or thin compliance checks can turn one mistake into a permanent loss,” said Andy Zhou, co-founder of BlockSec and professor at the Chinese University of Hong Kong.

From security principles to daily workflows

Crypto payment risk is often distributed across multiple departments. Engineering teams may manage the infrastructure used to approve transactions, compliance teams may screen transactions, and operations teams may lead the response when an alert is triggered. That division can make ownership unclear if wallet access, transaction screening, approval limits and escalation procedures are not documented in advance.

The checklist gives those teams a shared record of existing controls, evidence, ownership and next steps. For merchants, marketplaces, gaming and iGaming operators, SaaS companies and Web3 platforms, the companies said it can make security reviews repeatable rather than a one-time exercise.

“Real-time visibility is what makes a fast incident response possible. It can be the difference between containing a loss and losing funds to swaps, bridges, or cash-out points,” Zhou added.

If stolen funds are traced to an exchange or crypto service, the time available to act may be limited, Zhou said.

“Businesses should preserve transaction hashes and addresses, trace the fund flow, and contact the exchange through its official security or compliance channel as quickly as possible,” he said.

The checklist is described as an educational resource, not a certification or a substitute for legal advice. Its principles are intended to remain useful as payment infrastructure and security threats evolve.

Security controls and payout operations

The companies said strong controls should support the expansion of crypto operations without making daily work unnecessarily complex.

NOWPayments also offers zero-fee payouts, allowing businesses to send mass payouts to ChangeNOW Pro wallets at no cost. In a public test, payouts were completed within seconds, with recipients confirming each transfer by email before funds moved.

For affiliate programs, marketplaces, creator platforms, remote teams, gaming projects and Web3 communities, the checklist and payout product address different parts of the same process. The checklist is intended to strengthen controls, while the payout flow is designed to reduce fees, manual wallet-address collection and repetitive work.

About NOWPayments

NOWPayments is a crypto payment gateway supporting more than 350 cryptocurrencies and over 30 stablecoins. Its crypto business ecosystem combines broad asset coverage, automatic conversion and flexible settlement options for merchants, online platforms and global businesses.

About BlockSec

BlockSec is a full-stack blockchain security and crypto compliance provider that combines research with products and services for smart contract auditing, real-time security monitoring, attack prevention, compliance and on-chain investigation.

Media contact: Alexandr Yarovinski, Head of PR, NOWPayments, alexandr.y@nowpayments.io.

Source: CaptainAltcoin