Certification levels
Three levels — L1 Foundation, L2 Standard, L3 Advanced — and a binary assessment methodology with no numeric scoring.
CCSA defines three certification levels. A level is not a score; it records the share of applicable requirements that are met: the higher the level, the higher the required In Place ratio and the lower the allowed share of compensating controls. At every level, Not in Place among mandatory requirements is 0%, and all 8 Critical Requirements must be met through the Defined Approach.
Level thresholds
Minimum requirements per level. Source: Section D of the standard.
Foundation
Level 1 — Foundation
Baseline compliance level for early stage and small assets under management.
In Place ratio / Max CC
In Place ratio >= 90%
Compensating Control <= 10%
Not in Place = 0%
Critical Requirements
All 8 Critical Requirements In Place via the Defined Approach
Recommended
Startups, MVPs, pilots and small projects: AUM or market cap below $5M (C.1, C.3, C.4) or fewer than 10,000 MAU (C.2)
CCSA Foundation
Compensating controls are approved by the CCSAC.
Standard
Level 2 — Standard
The main working level for regulated market participants.
In Place ratio / Max CC
In Place ratio >= 95%
Compensating Control <= 5%
Not in Place = 0%
Critical Requirements
All 8 Critical Requirements In Place via the Defined Approach
Recommended
Mature exchanges, wallets with a large base (10K–1M MAU), most custodians and issuers ($5M–$500M AUM); the minimum required level for regulated VASPs
CCSA Standard
Compensating controls are approved by the CCSAC with peer review by another CCSAC.
Advanced
Level 3 — Advanced
An enhanced level for systemically important infrastructure.
In Place ratio / Max CC
In Place ratio 100% (or <= 2.5% CC with mandatory Council Chief QA Officer approval)
Compensating Control <= 2.5%
Not in Place = 0%
Critical Requirements
All 8 Critical Requirements In Place via the Defined Approach
Recommended
Systemically important players (top-10 exchanges, the largest custodians), regulated VASPs in strict jurisdictions, large stablecoin issuers (market cap > $100M)
CCSA Advanced
Compensating controls are approved by the Council Chief QA Officer.
| Level | In Place ratio | Max CC | Not in Place | Critical Requirements |
|---|---|---|---|---|
| L1 | In Place ratio >= 90% | Compensating Control <= 10% | 0% | All 8 Critical Requirements In Place via the Defined Approach |
| L2 | In Place ratio >= 95% | Compensating Control <= 5% | 0% | All 8 Critical Requirements In Place via the Defined Approach |
| L3 | In Place ratio 100% (or <= 2.5% CC with mandatory Council Chief QA Officer approval) | Compensating Control <= 2.5% | 0% | All 8 Critical Requirements In Place via the Defined Approach |
Binary assessment methodology
A CCSA-QSA assigns each applicable requirement one of five statuses. Numeric scales (5-point scores, weighted averages) are not used. No intermediate status ("Partially In Place", "50% implemented") exists: any gap means Not in Place.
In Place — full compliance via the Defined Approach; all Testing Procedures pass with no findings.
In Place with Customized Approach — the Customized Approach Objective is met and verified by the auditor.
Not in Place — not implemented or with critical gaps.
Not Applicable — out of scope per Applicability Notes and the segment matrix (requires justification in the ROC).
Compensating Control — an alternative protective measure; the CC procedure is passed.
Unlike PCI DSS, CCSA has no "Not Tested" status.
How compliance is computed
In Place ratio = (In Place + In Place with Customized) / applicable mandatory requirements
CC ratio = number of Compensating Controls / applicable mandatory requirements
Certification at level L is granted if: In Place ratio >= threshold(L) AND CC ratio <= limit(L) AND Not in Place = 0 AND all 8 Critical Requirements In Place.
Compensating-control limits and approval
Maximum share of CC of mandatory requirements and the approval authority by level.
| Level | Max CC of mandatory | Approval authority |
|---|---|---|
| L1 | <= 10% | CCSAC |
| L2 | <= 5% | CCSAC + peer review by another CCSAC |
| L3 | <= 2.5% | Council Chief QA Officer |
CC is fully forbidden for B.1.1, B.1.2, B.5.2, B.7.3. CC is restricted (L1 only, with Council approval) for B.2.1, B.3.1, B.4.1, B.8.1.
Re-assessment cycles
A full audit is performed annually at every level. The two-year cycle from early drafts has been removed.
| Level | Full audit | Interim checks |
|---|---|---|
| L1 | A full audit is performed annually at every level. | Full audit annually; interim SAQ every 6 months (SAQ-1 at month 6, SAQ-2 at month 12 of the cycle). |
| L2 | A full audit is performed annually at every level. | Full audit annually; the ROC is submitted to the Council for QA review (10% sampling of L2 certifications per year); quarterly compliance review with the CCSAC and review of compromise-detection logs. |
| L3 | A full audit is performed annually at every level. | Full audit annually; unscheduled Council reviews (100% random sampling of L3 certifications per year); continuous monitoring, quarterly review and log review; re-audit no later than 90 days before the certificate expires. |
Certification mark
After passing the audit, an organization receives the mark for its level and is listed in the LVCS registry.
Certification mark
CCSA defines three certification levels. A level is not a score; it records the share of applicable requirements that are met: the higher the level, the higher the required In Place ratio and the lower the allowed share of compensating controls. At every level, Not in Place among mandatory requirements is 0%, and all 8 Critical Requirements must be met through the Defined Approach.