Safeguarding the Future of Finance: MoonPay CISO Doug Innocenti

As crypto transforms global payments, MoonPay is leading the adoption of this new financial frontier, prioritizing security and customer protection

Cryptocurrency adoption is accelerating worldwide. Today, one in five Americans owns some form of crypto. In 2024, stablecoin transfers reached $27.6 trillion — outpacing the combined transaction volume of Visa and Mastercard. Global financial hubs are rapidly developing regulatory frameworks for digital assets, and the United States recently established a Bitcoin Strategic Reserve. These milestones make one thing increasingly clear: What was once dismissed as a speculative experiment is now emerging as a driving force in the financial ecosystem.

As crypto gains broader acceptance among individuals and institutions alike, one company is leading the charge in onboarding millions into this new frontier: MoonPay. Founded in 2019 as a solution to purchase crypto with a debit or credit card, MoonPay set a new standard for access to digital assets. Six years later, it is the world’s leading crypto on- and off-ramp, providing users in over 180 countries with a frictionless way to buy, sell, and swap crypto using all of the most convenient and familiar payment methods. MoonPay serves more than 30 million customers and partners with over 500 crypto companies and global enterprises including Mastercard, PayPal, and Venmo.

Doug Innocenti

With millions of customers worldwide relying on MoonPay to engage with digital assets each day, user protection and security are paramount. At the helm of these efforts is Doug Innocenti, MoonPay’s Chief Information Security Officer.

Doug leads the IT and security services for MoonPay’s worldwide enterprise operations, overseeing IT and Security strategy, architecture, and governance as well as the implementation and integration of SaaS, Endpoints, and infrastructure platforms. With over 30 years of information technology and security expertise — the majority in banking — he joined MoonPay in 2021 and has served as CISO since 2023.

Technology was front and center during Doug’s 20-plus-year tenure at financial services company Wells Fargo, and it played an even greater role during his time at software development platform Navan (formerly known as TripActions). Leading security transformation for a fast-growing startup like MoonPay was a compelling next step, offering Doug the opportunity to spearhead the integration of IT and security in an emerging area of the financial technology (FinTech) industry.

“In the wild world of crypto, where speed and agility rule, building a solid cybersecurity program can feel like fixing a plane mid-flight,” Doug wrote in a recent blog post. “Building a culture of security, embracing automation, and taking a risk-based approach to key priorities is the winning formula for startups to keep both their data and reputation safe while maintaining a competitive advantage.”

Doug and his team work diligently to ensure that MoonPay’s security program remains both stringent and agile in the fast-paced, ever-evolving crypto sector. Amid shifting regulations and persistent risk – challenges commonly faced throughout the financial industry – he prioritizes a strong security foundation that upholds the highest levels of compliance and customer protection.

Notably, Doug plays a leading role in MoonPay’s multi-faceted certification initiative. He recently guided the company through PCI recertification, SOC 2 Type 2 certification (a globally respected benchmark for information security management), ISO 27001 certification (an internationally recognized standard for information security management), and ISO 27018 certification (a leading global standard for cloud privacy protection).

In addition to reinforcing MoonPay’s credibility and commitment to exceeding industry standards, these certifications enable the company to earn key licenses and registrations worldwide – demonstrating to regulators that MoonPay appropriately protects consumers and securely manages sensitive data. Most recently, they supported MoonPay’s successful acquisition of Money Transmitter Licenses in Texas and Wisconsin, further expanding its reach among users in the U.S.

Under Doug’s leadership and collaboration with MoonPay’s compliance team, the company also became one of the first to secure approval under the Markets in Crypto-Assets (MiCA) regulation in December 2024. The MiCA framework establishes a unified regulatory environment for digital assets, and approval enabled the company to expand its offerings and drive innovation across the European Economic Area.

“Our certifications are the foundation of securing the environment,” he noted. In March, MoonPay also earned the Payment Card Industry Data Security Standard (PCI DSS) 4.0, a globally recognized, independently audited benchmark for securing payment card data.

“All the defenses for protecting endpoints and our systems are integrated into MoonPay’s features and product lines. Security is at the cornerstone of these initiatives as well,” he said. While ensuring that security is optimized, Doug stressed the importance of viewing it as an enabler rather than a barrier to innovation.

“That means everything we do on the security side needs to be fully transparent. Explaining why our security restrictions are necessary allows people to truly understand, and play a role in, the protection process,” he said.

That goes for transparency in policies, too. “(Policy) cannot sit in a black box off to the side that no one talks about,” he added. “It needs to be at the forefront. We make a consistent effort to communicate policy updates across all aspects of the company in ways that are genuine and responsive.”

Communication sharing and transparency have established a “security-first” culture at MoonPay, helping the team understand the importance of security and feel equipped to help protect the organization. “That means we’re going to keep MoonPay secure, our customers secure, and most importantly, our customers’ financial information secure.”

MoonPay’s strong security standards and industry certifications are essential not only for global expansion but also for core business activities such as M&A. In 2025, the company has already completed two significant acquisitions: Helio, a crypto commerce solution, and Iron, an API-first stablecoin infrastructure platform. As both companies joined forces with MoonPay, its core security program was already equipped to seamlessly support their unique operational needs without compromising the overall framework — ensuring consistently high security across all operations.

Doug has built a strong team of security and IT experts at MoonPay, prioritizing a fresh perspective and innovative problem-solving when bringing on new colleagues. “While candidates we consider all possess the necessary technical skills in either IT or security, the decision to hire goes beyond just those qualifications. We look for individuals who bring an inherent drive to learn, a flexible approach to challenges, and a spark of creativity. These qualities are what truly elevate a team, allowing them to contribute far beyond the defined scope of their roles,” he added.

Alongside his team, great partnerships have been essential to MoonPay’s security evolution. Take data loss prevention, for instance. Many current solutions use standard defense mechanisms such as content inspection, keyword matching, and basic rule-based access controls. “While these are foundational, they often fall short of truly empowering a fast-growing, dynamic organization like MoonPay,” Doug pointed out. He selected DoControl’s automated security solutions to secure their SaaS data while keeping the business operating at its optimal speed. “DoControl provides a nuanced layer of control that goes far beyond simple Role-Based Access Control. It allows us to define granular policies based on how data is being used, why it’s being shared, and the legitimate business purpose behind it.”

In addition, MoonPay partners with the havenX, security intelligence advisors, for concise yet comprehensive augmentation of its security posture. The havenX expertly synthesizes extensive open-source intelligence into actionable insights, proactively identifying threats, assessing risks, and informing rapid incident response. This focused delivery of critical intelligence and tailored security solutions empowers MoonPay to confidently navigate intricate challenges, capitalize on opportunities, and ultimately fortify its platform and user trust with maximum efficiency.

MoonPay also partners with Mobilen, a key vendor enabling mobile communication security. More than just a basic security measure, Mobilen provides sophisticated tools such as end-to-end encrypted communication channels, real-time threat detection and prevention specifically tailored for mobile devices, and granular control over data access on the go. This proactive approach ensures that company information remains shielded, empowering MoonPay’s remote teams to operate with confidence. “They are a pivotal partner for us to protect our data. We’re a remote-first company because that’s the world we live in today. Everyone works on a 24/7 clock, so knowing that mobile device security is at an elevated level is important,” Doug emphasized.

Doug and his team revel in being part of a pinnacle of innovation. “We’re at the forefront of something that hasn’t been explored before, and we’re crafting and designing a new set of standards for the industry. Every day is a new opportunity to try to do something that’s not been done,” he said. “Knowing that I work alongside a team that feels the same way is invigorating.”

When asked to give a single piece of advice about entering and succeeding in the cybersecurity space, Doug responded, “Don’t box yourself in. Cybersecurity isn’t just about one skill or one way of thinking. Embrace collaboration with your peers, really listen to different perspectives and strategies. There’s almost always more than one path forward – it’s about understanding the risks and figuring out the right controls.”

“Remember, security isn’t black and white – there’s definitely an art to it,” he concluded.