25 checks, 9 categories, 1 harsh truth: on-chain refunds don't exist 🧾

NOWPayments and BlockSec have jointly published a free Crypto Payment System Security and Technical Compliance Checklist, comprising 25 controls distributed across nine security and technical compliance categories. The Amsterdam-based crypto payment gateway NOWPayments, which supports more than 350 cryptocurrencies and over 30 stablecoins, developed the guide with blockchain security and compliance firm BlockSec to convert general security principles into verifiable checkpoints for security, operations, compliance, and product teams. The checklist can be applied before a business begins accepting crypto payments, during a vendor or architecture review, or as part of a recurring control assessment.

Each item functions as a control to verify rather than a general recommendation, allowing teams to mark it as confirmed, attach supporting evidence, assign an owner, and record next steps. The framework is designed for merchants, marketplaces, gaming and iGaming operators, SaaS companies, and Web3 platforms that need a repeatable security review process. Categories address areas including key management, transaction approval, compliance screening, and incident response, turning a broad security discussion into a working session with clear ownership.

Andy Zhou, co-founder of BlockSec and professor at the Chinese University of Hong Kong, said the most common mistake is to treat a crypto payment like a normal online payment. "On-chain transfers are final, so weak key management, unreviewed transaction approvals, or thin compliance checks can turn one mistake into a permanent loss," Zhou stated. He added that real-time visibility is what makes a fast incident response possible and can determine whether a loss is contained or whether funds move through swaps, bridges, or cash-out points.

If stolen funds are traced to an exchange or crypto service, Zhou recommended that businesses preserve transaction hashes and addresses, trace the fund flow, and contact the exchange through its official security or compliance channel as quickly as possible. The checklist is positioned as an educational resource and is not a certification or formal audit standard, with users responsible for adapting controls to their own operational and regulatory environments.