On September 23, MoonPay signed a definitive agreement to acquire North Capital Investment Technology. The release mentioned a broker-dealer. It mentioned an alternative trading system already sitting on the SEC's ATS list as of June 30. It mentioned that both boards had approved. Then it mentioned — almost as an afterthought — that the deal might not close, and might not happen at all, and that nobody should assume otherwise. What it did not mention: a price, a launch date, an eligibility rule, a client product, or a single number describing how much the thing being bought actually trades.
That silence is the story. Not the acquisition. The silence around it.
I have spent the last several years watching crypto companies pay enormous sums for the word "regulated" without ever showing the auditor's letter behind it. This deal is a cleaner specimen than most, because the buyer is honest about the uncertainty and the seller is verifiable on the public record. What sits between them — a registered broker-dealer, a live ATS, and a payments network with twenty million retail users — is where the real analytical work lives. And the real analytical work is almost entirely absent from the announcement.
Minted in hope, burned in regret. This one was minted in a press release, and the burning has not started yet.
Let me be precise about what MoonPay bought, because precision is the only thing that keeps you solvent in this market.
North Capital, founded around 2004, is not a startup. It is a nearly twenty-year-old private securities shop that built its business serving issuers, professional intermediaries, fund managers, and investors. Through a subsidiary — North Capital Private Securities Corporation — it operates as a registered broker-dealer, which places it under FINRA's supervision. Through another arm, it runs PPEX, an alternative trading system where qualified securities can change hands outside the traditional stock exchanges. It also carries an investment advisory business. On top of that, its operational scope covers investor onboarding, trade processing, custody, and secondary trading. That is not a feature list. That is four separate regulated functions stacked inside one corporate shell.
MoonPay, by contrast, was born in 2019 as a fiat-to-crypto gateway. Its core competence is moving money between a bank account and a wallet at the edge of a card network. The company raised roughly two hundred million dollars across its history, carried a valuation north of three billion at its 2021 peak, leaned on Tiger Global and Coatue for early capital, and announced a further round in 2024. It went through a round of layoffs in 2023, kept its core management intact, and kept shipping. Its CEO, Ivan Soto-Wright, built a payments business, not a securities business. Its executives came largely from PayPal and Stripe, not from Merrill or Citi.
That distinction matters more than any headline about "expanding into tokenized securities."
Here is the industry backdrop, because context is what separates an autopsy from a headline. The real-world-asset narrative — RWA, if you prefer the acronym — has been the dominant institutional story since late 2023. BlackRock launched BUIDL. Fidelity and UBS signaled tokenized product intentions. The pitch was simple and seductive: put traditional assets on-chain, unlock fractional ownership, program settlement, and collapse the settlement window from T+2 to T+0. For a year and a half, that narrative absorbed capital and mindshare.
But the RWA narrative has a structural problem that its promoters rarely state plainly. Tokenizing an asset is easy. Distributing it legally to a wide audience is hard. Trading it in a secondary market without violating securities law is very hard. And custodying the tokenized claim in a way that survives a bankruptcy is nearly impossible without a regulated entity doing the work.
So the honest version of the RWA story is not "assets go on-chain." It is "assets go on-chain, and then a registered broker-dealer, an ATS, a transfer agent, and a custodian have to be assembled around them." Alpaca already learned this the expensive way. As one industry observation put it, crypto once promised to eliminate the stockbroker — and yet ninety-four percent of its tokenized market now quietly depends on Alpaca, a traditional backend execution infrastructure provider. The revolution outsourced itself to the plumbing it claimed to replace. Liquidity flows, but integrity stagnates.
That is the world MoonPay is buying into. And that is why the acquisition, on its face, is strategically coherent. The buyer is not chasing a token narrative. It is buying the four regulated functions it cannot build organically in less than three years.
Now the teardown.
The first and largest problem is that the announcement describes three assets that are not yet a product, and never explains how they become one.
A regulated entity. A trading system. A client interface. The release itself concedes these are "different components of a potential product." Read that sentence again. Not components of a product. Components of a potential product. That is the language of a deal that has been signed but not designed.
For a regulated entity, MoonPay gets North Capital Private Securities Corporation — a broker-dealer subject to FINRA rules on net capital, recordkeeping, supervisory procedures, and — critically — Rule 4511's books-and-records requirements and Regulation SHO's locate and settlement obligations for equity securities. For a trading system, it gets PPEX, an ATS operating under Regulation ATS, which imposes its own fair-access, systems-capacity, and recordkeeping obligations on top of the broker-dealer layer. For a client interface, it gets nothing disclosed. No wireframe. No API spec. No eligibility rules. No launch date. No path by which a MoonPay retail user would ever reach a private securities order book.
I have audited smart contracts where the whole system was laid bare in a few hundred lines of Solidity. This is the opposite situation. Here, the components are real, but the seams between them are invisible. And those seams are exactly where the money leaks.
The second problem is the customer segmentation trap, and it is not a small one.
MoonPay has publicly said it has served more than twenty million users. Those users are overwhelmingly retail crypto buyers. PPEX — like every ATS trading private securities — is restricted to accredited investors under the securities laws that govern private placements. The two populations do not naturally overlap. In fact, they barely touch.
The bull case for this acquisition quietly assumes that MoonPay's twenty million retail users represent a distribution channel for private securities. That assumption has never been validated with data. There is no disclosed figure showing how many MoonPay users would qualify as accredited. There is no disclosed figure showing how many would even want exposure to private securities. And there is no disclosed customer product that would bridge the two.
I watched a version of this exact blind spot play out during the NFT era. I joined the Bored Ape community back in 2021, not for the status, but to study how royalty enforcement actually worked on-chain. What I found was that the ERC-721 standard cannot enforce royalties without external tooling — and that roughly forty percent of secondary sales simply bypassed creator fees entirely. The community believed in royalty payments. The market paid none. The gap between the stated model and the executed model was not a bug. It was a structural feature nobody wanted to price in.
The same gap applies here. A retail crypto user base is not a private securities distribution channel. It is a payment network's customer list. Turning one into the other requires onboarding, suitability checks, accreditation verification, and a legal wrapper around every product touchpoint. That is not a marketing exercise. It is a multi-year compliance build.
The third problem is the numbers that were never published, and their absence is itself a data point.
No acquisition price. No PPEX trading volume. No user count for the venue. No revenue figure. No closing date. When a private company buys another private company and declines to disclose terms, that is normal. When the target operates a regulated trading venue with a public regulatory footprint, the refusal to disclose trading activity is more telling. The SEC ATS list tells us PPEX exists and was already listed before the proposed acquisition. It does not tell us whether PPEX trades fourteen million dollars a month or fourteen dollars a month.
Consider what that means for modeling. An analyst trying to value this deal has three inputs: the buyer's business, the seller's licenses, and the strategic narrative. Two of those are qualitative. The third — the seller's licenses — is real but not monetized in any disclosed way. You cannot build a discounted cash flow model on a press release. You can only build a story. And a story is what the market already has too much of.
The missing price matters for a second reason. The absence of a disclosed purchase number means we cannot infer the buyer's own confidence. A large premium over a small revenue base would signal strategic desperation. A modest price would signal a defensible bolt-on. Without the number, we cannot tell which deal this is. That is not a small analytical problem. It is the analytical problem.
The fourth problem is the regulatory approval, which is binary and which the parties themselves flag.
Before ownership can change hands, the transaction requires regulatory approval and other closing conditions. Two separate review streams matter here. First, FINRA reviews any change of control of a member broker-dealer — its suitability, its net capital adequacy, its supervisory structure, its compliance personnel. Second, the SEC reviews the change of ownership of a registered ATS, evaluating whether the new owner is fit to operate a trading venue and whether it can manage the conflicts of interest that arise when a payments company also runs a securities execution venue.
The parties' own language is unusually hedged. They explicitly warn there is no guarantee the deal completes, or completes on any particular timeline. In merger announcements, that hedge is often boilerplate. Here it reads heavier. When a buyer's entire strategic pivot depends on acquiring a license, and the announcement itself concedes the license transfer might not be approved, the reader is being told something about the probability distribution. Not the mean. The tail.
I sat on the institutional side of this exact kind of review in 2024. An Australian bank invited me in to model Bitcoin ETF exposure, and I spent weeks pulling apart their risk framework against historical custodial failures — Mt. Gox, FTX, the whole grim ledger. What struck me was not that the bank lacked data. It was that the bank's compliance culture read "regulatory approval" as a formality, when in practice it is a gate that opens or does not, with almost no middle ground. The bank eventually adopted stricter frameworks after I delivered a fifty-page report documenting the systemic gaps. But the report only mattered because the gate was real. The same gate is now suspended over MoonPay, and this time the applicant is the one crossing it.
The fifth problem is the technical integration, and the difficulty here is not clever engineering. It is incompatible operating systems.
MoonPay's client infrastructure — its app, its plugins, its SDKs — was built for retail speed. Order creation measured in taps. KYC measured in minutes. Support measured in chat windows. North Capital's infrastructure was built for securities law. Order routing that must respect Reg ATS fair-access rules. Records that must survive an SEC examination. Trade reporting that must clear FINRA's requirements. Custody that must satisfy customer protection rules.
These are not two versions of the same system. They are two different regulatory universes that happen to share a database.
A second technical unknown sits beneath the surface, and it is the one I would push hardest on in diligence: how does a tokenized private security settle? The announcement does not say whether PPEX trades tokenized private securities, tokenized representations backed by traditional custody, or plain traditional private securities. It does not name a chain, a token standard, or a custody arrangement. If the token is purely notional — a database entry wearing a blockchain costume — then "tokenization" is marketing, not architecture. If the token is on-chain but the underlying claim is not enforceable against a bankruptcy remote custodian, then the token is a promise, not an asset. Either outcome is survivable. But neither is what the narrative is selling.
I have made this argument before in a different form. When BRC-20 and Runes arrived on Bitcoin, the pitch was that the world's most secure settlement layer would now carry programmable assets. What actually happened was that Bitcoin's block space got expensive, its fee market got chaotic, and the assets minted on top were largely speculation on the base layer's brand rather than genuine utility. Using a Rolls-Royce to haul cargo insults the car and does not move much freight. The exact same logic applies to tokenizing private securities without a custody answer. A regulated ATS is a Rolls-Royce engine. Hanging tokens off it without a bankruptcy-remote custodian is hauling cargo on the hood.
The sixth problem is the competitive landscape, and it is more crowded than the announcement admits.
tZERO entered securities tokenization earlier. Securitize manages billions in tokenized funds and has partnered with BlackRock on BUIDL. INX runs a regulated exchange for security tokens. And Alpaca, quietly, sits underneath a large share of the tokenized market's backend execution. This is not an empty field that MoonPay is entering with a superior product. It is a field where the incumbents have years of regulatory scar tissue, existing institutional relationships, and — in Securitize's case — anchor partners who move real assets.
MoonPay's claimed differentiation is that it already has a live regulated venue. That is true. PPEX is running, and it was on the SEC ATS list before the acquisition was proposed. But a live venue with undisclosed volume is not the same as a market-leading venue. The ATS list is a registry of existence, not a leaderboard of dominance. And the competitive gap between "running" and "winning" is usually where tokenized asset platforms die — not from fraud, but from illiquidity that compounds quarter after quarter until the order book goes quiet.
Here is where I want to plant a flag that most coverage will miss. The most probable failure mode for this deal is not regulatory rejection. It is regulatory approval followed by commercial silence. The deal closes. The licenses transfer. The product never ships, or ships too late, or ships into a market that has already moved to a competitor. A dead ATS inside a large payments company is worse than a rejected acquisition, because a rejection is clean and a dead venue is a recurring cost.
So what did the bulls get right? Let me be fair, because the cold dissector's job is autopsy, not execution.
First, the regulatory moat is real, and it is genuinely hard to replicate.
A registered broker-dealer, an operating ATS, and an investment advisory arm are not things you can spin up in a quarter. The compliance officers alone take months to hire into roles that require clean regulatory histories. The policies and procedures have to be written, tested, and examined. The supervisory structure has to be demonstrable. Building this from scratch in the crypto industry's current regulatory climate would take years, and the attrition rate on those buildouts is brutal. Buying a twenty-year-old shop with existing licenses is structurally cheaper than building, assuming the price is reasonable — and we do not know the price, so we can only assume.
That is the honest bull case. Regulated real estate inside a securities regime is scarce, and MoonPay bought some.
Second, the acquisition is funded with corporate capital, not a token.
This is worth dwelling on, because it is the single most underrated signal in the entire announcement. MoonPay has no native token. Nothing about this transaction is financed by inflating a supply schedule and selling it to retail. The value capture, if any, flows to equity holders, not to a token holder base being diluted in real time. In an industry where a significant share of treasury strategies still amounts to paying earlier participants with later participants' money, a corporate-funded acquisition is a boring, solvent, adult move.
The stablecoin market offers the sharpest possible contrast. USDT dominates roughly seventy percent of that market, and Tether's reserves have never been subject to a truly independent, unqualified audit. The entire industry has collectively agreed to pretend this is fine because the peg has held and the fees are cheap. That is what token-native value capture looks like at scale: enormous, opaque, and unaudited. MoonPay chose the opposite path. It is buying regulated infrastructure with company money and disclosing that it might not close. There is no token to pump. There is only a balance sheet and a strategy.
Third, if MoonPay ever does issue a token, this deal gives it a compliance and revenue story that almost no competitor can match.
That is a speculative point — there has been no signal of a MoonPay token — but it is worth noting because the industry's pricing mechanism rewards "real revenue plus regulatory posture" far more generously than it rewards "roadmap." A future MoonPay token, if it existed, would be attached to broker-dealer commissions, ATS execution fees, investor onboarding fees, and possibly custody fees. Four revenue lines. None of them dependent on buying the token itself.
Compare that to the overwhelming majority of protocol tokens, where the demand story reduces to "more people must buy this thing or the price falls." The difference is not philosophical. It is mechanical. One is a claim on cash flow. The other is a claim on attention.
Fourth — and this is the part I genuinely respect — the disclosure quality is honest.
Most crypto announcements overstate. This one understated. It admitted uncertainty about completion. It admitted that the client product does not exist yet. It admitted that eligibility rules are undetermined. Reading it, I felt something I rarely feel on-chain: the sensation of a company telling the truth about what it does not know.
I have spent years watching chains claim things that the code did not deliver. Stablecoins claiming audits that never happened. Cross-chain bridges claiming to unify liquidity while actually fragmenting it across a dozen incompatible pools. Every new interoperability protocol promises to solve fragmentation and then adds another pool of stranded capital. The industry's default register is inflation of certainty. MoonPay used the opposite register. That is a small thing in absolute terms and a large thing in relative terms.
Now the forward-looking judgment. This is where I stop describing and start positioning.
The binary variable is regulatory approval, and nothing else matters until it resolves. If FINRA and the SEC clear the change of control, MoonPay gets a genuinely scarce asset. If they do not, the entire strategic pivot resets and the company has burned legal fees and management attention on a deal that never shipped. There is almost no middle outcome. The parties' own language concedes this.
The second variable is time-to-product, and it is where the deal will actually be judged. Approval without a shipped product is a license collecting dust. Illiquid ATS venues do not improve with patience; they decay. Every month without a client-facing product, the venue loses relevance to the competitors who are already shipping. Watch for two signals: a launch date for a client-accessible securities product, and any disclosed PPEX volume figures. Absent both, the market should price this as an option, not an asset.
The third variable is the integration, and it is where the human damage will hide. Merging a twenty-year-old, conservative securities shop into a fast-moving crypto payments company is not a technical problem. It is a cultural one. The compliance staff who currently keep North Capital legal will look at MoonPay's product cadence and see risk. MoonPay's product team will look at North Capital's procedures and see friction. This is the exact fault line where post-merger integrations fail, and it is invisible in the announcement because announcements are written for shareholders, not for the people who have to work inside the merged entity.
History is written in hex, not headlines. The hex here is not on a chain. It is in the FINRA filings, the SEC ATS disclosures, and the trade records that will or will not accumulate on PPEX after the deal closes. The headlines say MoonPay bought a regulated securities venue. The hex will say whether anyone ever used it.
Gas fees were the only truth we paid for — and the cruelest part of this deal is that it does not pay gas fees at all. It is settled in a currency the crypto industry has spent a decade pretending not to need: regulated equity, deployed by a company that does not have a token. That is either the future of the sector or the moment it stopped being the sector it claimed to be. The next twelve months of filings will tell you which.
One more thing, and then I will get out of the way. If you are holding RWA exposure indirectly through listed ecosystem names, or through any token whose bull case depends on "tokenized securities are coming," understand what this deal actually proves. It proves that the winning position in tokenized securities is not the token. It is the license. MoonPay did not buy a token. It bought the right to be the entity that issues and trades them. Every protocol that tried to disintermediate the regulated layer just learned — again, at someone else's expense — that the regulated layer is the product.
The code didn't fail here. Nobody has written it yet.
