WSTA is an open industry alliance bringing together the world's leading exchanges, custodians, and wallet infrastructure providers to co-create the Wallet Security Standard — built by practitioners, designed for regulators.
The digital asset industry operates some of the most complex security environments in the world — yet no unified, practitioner-validated security standard exists. Existing frameworks such as CCSS, ISO 27001, and SOC 2 were not designed for modern wallet architectures: MPC, threshold signatures, account abstraction, or cross-chain operations.
WSTA was founded to close this gap. We bring together institutions that actually run wallet infrastructure at scale — and turn their operational experience into a standard that regulators can reference and the industry can implement.
Every WSS provision originates from the real operations of member institutions — not theoretical security models or academic frameworks.
MPC/TSS, smart contract wallets, AI-assisted monitoring, supply chain integrity, proof of reserves — technologies CCSS v3 does not address.
WSS maps directly to MiCA Art. 70, Dubai VARA, MAS TRM, and FATF R.15 — giving regulators a reference they can cite and practitioners can execute.
Phase 1 produces the standard. Membership does not imply security endorsement, audit outcome, or compliance approval of any kind.
WSTA operates a structured three-tier model. Each tier carries distinct eligibility criteria, rights, and responsibilities. No membership tier constitutes a security assessment or compliance endorsement.
Primary authors of the WSS. Members contribute first-hand operational knowledge and hold voting rights on standard provisions.
Technical contributors providing implementation depth — MPC protocols, HSM infrastructure, and cryptographic feasibility input.
Independent reviewers providing professional expertise, academic rigour, and regulatory perspective — without voting on final provisions.
Covering Asia-Pacific, Middle East, and global institutional markets — with additional members in active discussion.
A unified framework synthesising CCSS v3, ISO/IEC 27001:2022, SOC 2 TSC, EU MiCA, Dubai VARA, and MAS TRM into a single operationally-grounded standard for all VASPs.
WSTA operates under a formal three-document legal framework governing member admission, membership terms, and alliance governance. All documents are subject to ongoing legal review prior to public release.
A structured two-year path from founding the alliance to publishing WSS v1.0 and establishing global industry adoption.
Alliance intent formed among founding institutions. WSS initial draft completed. Governance framework defined.
Completed22 founding members confirmed. GitHub repository established. Legal framework (NDA, MOU, Charter) finalised.
CompletedNDA/MOU execution. Alliance formally constituted. Website live. Coordinated press release across member organisations.
In ProgressMonthly working group sessions. Module ownership assignments. WSS domain drafts developed through structured member contributions.
UpcomingFull standard integration. Observer statements incorporated. WSS v1.0 officially published.
UpcomingWSS adopted as industry protocol. WAA audit authorisation programme launched. Regulatory recognition outreach to VARA, SFC/HKMA, and MAS.
FutureApplications are open for Phase 1 founding membership. Positions are limited and require an internal recommendation or direct alliance invitation. Membership is a substantive commitment — not a symbolic affiliation.
Important Notice: WSTA Phase 1 membership does not constitute, and shall not be represented as, any form of security certification, compliance endorsement, audit outcome, or Trust Mark award. All members are required to acknowledge this in writing before admission is confirmed. See the Admission Procedure (WSTA-ADM-001) for full terms.