Application Segments
Applicability of the eight crypto domains to four market segments via an M / R / N-A matrix. The level in each segment is set by its own scale metric.
Application Segments
Applicability of the eight crypto domains to four market segments via an M / R / N-A matrix. The level in each segment is set by its own scale metric.
The organization holds clients' private keys under its own control. All 8 domains Mandatory — the strictest segment.
The certification subject is the software vendor or device manufacturer, never the end user. Dual scope: vendor and device.
Only the CCM of the custody infrastructure is in scope. All 8 domains Mandatory, as for C.1.
Only mint/burn keys and related CCM are in scope. Mint multi-sig is mandatory regardless of market cap.
Applicability matrix (8 domains x 4 segments)
M — Mandatory, R — Recommended, N-A — Not Applicable. Applicability is shown in the summary table of each domain B.1-B.8 and consolidated in Section C.
| B.x | C.1 | C.2 | C.3 | C.4 |
|---|---|---|---|---|
| B.1 | M | M | M | M |
| B.2 | M | M | M | M |
| B.3 | M | M | M | M |
| B.4 | M | M | M | M |
| B.5 | M | M | M | M |
| B.6 | M | R | M | R |
| B.7 | M | R | M | M |
| B.8 | M | M | M | M |
Mandatory
Recommended
Not Applicable
Segment definition
C.1 — Custodial wallets and custodians
Segment definition
Organizations that hold client crypto assets under their own control of private keys: exchange custody-side wallets, dedicated custodians, bank crypto-wallets of DFA operators, white-label custody. All 8 domains are Mandatory.
Domain applicability
Level requirements
Level metric:
Level by AUM: < $5M (L1) / $5M-$500M (L2) / > $500M (L3).
Segment-specific requirements
Cold storage % AUM: L1 >= 65%, L2 >= 85%, L3 >= 95%. Cold-storage multi-sig: L1 2-of-3, L2 3-of-5, L3 4-of-7 with geo-distribution. Compromise-detection SLA: L1 <= 5 min, L2 <= 1 min, L3 <= 30 sec. Recovery RTO: L1 <= 72h, L2 <= 24h, L3 <= 4h.
C.2 — Non-custodial wallets (vendor + device)
Segment definition
Software or devices for the user's self-custody of keys: browser-extension, mobile, desktop and hardware wallets, smart-wallet / Account Abstraction. The certification subject is the vendor or device manufacturer; the end user is neither certified nor audited.
Domain applicability
Level requirements
Level metric:
Level by MAU: < 10K (L1) / 10K-1M (L2) / > 1M (L3).
Segment-specific requirements
Code security: open-source preferred, reproducible builds, code signing. Anti-extraction: anti-tampering, anti-screenshot on seed display, jailbreak / root detection, anti-debugging. Bug bounty: L2 pool from $25K, L3 from $100K. Secure Enclave / StrongBox: Mandatory from L2, + remote attestation at L3.
Dual scope. Vendor scope: the developer organization (onboarding, offboarding, SoD, background checks, build-infrastructure security, release management). Device scope: the on-device wallet architecture (on-device entropy, Secure Enclave / StrongBox, signing inside the trusted boundary, recovery UX). Neither scope applies to the user: the vendor provides mechanisms and documentation but does not enforce policy on the user. B.6 and B.7 are Recommended here.
C.3 — Exchanges (CEX, DEX front-ends, OTC)
Segment definition
Trading platforms with respect to the CCM of their custody infrastructure: centralized exchanges (custody-side), DEX front-ends (admin-function signing keys), OTC platforms (hot / warm / cold). All 8 domains are Mandatory, as for C.1.
Domain applicability
Level requirements
Level metric:
Level by daily volume: < $1M (L1) / $1M-$100M (L2) / > $100M (L3).
Segment-specific requirements
Session tokens are protected as Category D CCM. Mandatory 2FA at signing time; step-up for high-value operations (L2+). Hot wallet % AUM: L1 <= 10%, L2 <= 5%, L3 <= 1%. Real-time watch-only monitoring of all hot / warm wallets; SLA: L1 <= 5 min, L2 <= 1 min, L3 <= 30 sec.
Only protection of the CCM of the exchange infrastructure is in scope. Trading-engine integrity, market-manipulation prevention, order-book security, listing standards, fair access — these are business processes and market integrity, out of CCSA scope (§0.2.2).
C.4 — Issuers (stablecoins, RWA, fiat-tokens)
Segment definition
Organizations that issue tokens with respect to the CCM of their issuance infrastructure: stablecoins, RWA tokens, fiat-tokens, security tokens. Only protection of mint / burn keys and related CCM is in scope.
Domain applicability
Level requirements
Level metric:
Level by market cap: < $5M (L1) / $5M-$100M (L2) / > $100M (L3).
Segment-specific requirements
Mint / burn multi-sig is mandatory regardless of market cap: L1 2-of-3, L2 3-of-5, L3 4-of-7 or higher. Mint time-lock: 24h for mint > 1% supply (L2), 72h + governance approval (L3). Mint-key HSM: Mandatory from L2, + geo-distribution at L3. Detection of unauthorized mint / burn; SLA: L1 <= 5 min, L2 <= 1 min, L3 <= 30 sec.
Out of scope: reserve composition, Proof of Reserves, governance, regulatory disclosure, token-holder rights, audit of the issuance smart contract. These are finance, governance, regulatory and code-security domains (§0.2.2).
Critical
For all 8 Critical Requirements carry-over applies in no segment: full CCSA testing via the Defined Approach is required for each in-scope segment.
Cross-segment rules (C.5)
If an organization operates in several segments, the requirements of all applicable segments apply.
Multi-segment: conformance to the union of all Mandatory requirements; shared-infrastructure requirements tested once; a single ROC split by segment.
Overall entity level = max(per-segment levels). The strictest level across segments and metrics is taken. Under per-segment certification, each business unit is issued at its own level.
Carry-over applies per requirement, not per segment: one baseline (e.g. PCI DSS Level 1) can cover the same shared-infrastructure requirements across all segments at once.
For all 8 Critical Requirements carry-over applies in no segment: full CCSA testing via the Defined Approach is required for each in-scope segment.