A complete card issuing and payment processing infrastructure with direct on-chain settlement, so a bank, a fintech or a retailer can launch and run its own card scheme.
For sixty years, launching a payment card has meant joining somebody else’s card scheme. You get a BIN range, you follow the rulebook, you pay the network, and the network decides which merchants can accept your card. The handful of schemes that exist took decades and billions to build, because the hardest part was never the plastic. It was the network and the settlement behind it.
Blockchains change that one hard part. A public chain is a settlement network that anyone can use, at any hour, in stablecoins or native assets, with finality that does not depend on a scheme’s clearing cycle. What a public chain does not give you is everything else a card scheme does: a card that cannot be cloned, a cardholder who can be identified, an issuer who can enforce rules, a terminal a merchant can trust, and a way to replace a lost card without losing the money.
C-WaaS (Card Wallet as a Service) is Cryptnox’s answer to that gap: blockchain-native card scheme infrastructure that combines card issuance, payment processing and direct on-chain settlement in one stack. It packages the card, the issuer backend, the apps and the point of sale so that a bank, a fintech, a retailer or any other organisation can run its own card scheme on blockchain rails. This article explains what a card scheme actually is, how C-WaaS works, what happens at the POS, and how a dual-technology card lets you keep Mastercard or Visa on the same piece of plastic while you build your own.
A card scheme is a set of rules plus a network. In the classic four-party model the scheme owner (Visa, Mastercard) sits between the issuer, which gives cards to cardholders, and the acquirer, which signs up merchants. The scheme defines the brand, the technical standards, the authorisation and clearing messages, the settlement timetable, the fees, and the dispute process. Three-party schemes such as American Express or Diners collapse issuer and acquirer into one company but keep the same functions.
Launching a new scheme the traditional way means building or renting all of these layers: a licence, an authorisation host, a clearing and settlement bank, certified terminals, and a merchant base that accepts a brand nobody has heard of. That is why so few exist.
A blockchain card scheme keeps the functions but swaps the plumbing. C-WaaS is a blockchain-native alternative to traditional card scheme infrastructure, and the table below shows what moves and what stays.
| Scheme function | Traditional card scheme | C-WaaS card scheme |
|---|---|---|
| Brand and rules | Owned by the scheme, licensed to issuers | Owned by you, the scheme operator |
| Network | Private authorisation and clearing network | Public blockchains (EVM chains, Solana, Tron, Bitcoin) |
| Settlement | Daily net settlement through scheme banks | On-chain, per transaction, in stablecoins or native assets |
| Card | EMV chip personalised in a bureau | EAL6+ certified secure element holding the cardholder’s key, personalised at issuance |
| Authorisation | Issuer host says yes or no to the acquirer | Issuer backend authorises each signature; the card refuses to sign without it |
| Acceptance | Acquirers and processors certify terminals | C-WaaS POS application on standard payment terminals; merchants register with the scheme |
| Disputes | Chargebacks after the fact | Controls before the payment is signed; scheme rules you define |
| Economics | Interchange and scheme fees | A different revenue and cost allocation that you set |
The right-hand column is what C-WaaS supplies. The rest of this article walks through it layer by layer.
Three words describe the stack: issuance (the card and how it is personalised), processing (the issuer backend that authorises every payment, and the point of sale that relays it), and settlement (the public chain). The sections below, and the POS section that follows, walk through each.
Every C-WaaS card contains a Common Criteria EAL6+ certified secure element, the same class of chip used in passports and bank cards. The cardholder’s blockchain key lives inside that chip and never leaves it. There is no seed phrase to write down, no desktop software to install, and nothing for malware on a phone to steal.
Cards are manufactured in Switzerland and arrive pre-initialised, ready to be activated with a QR code scan and a tap. The issuance method is patented (US 12,132,824 B2): the chip generates its own key pairs, the issuer system wraps the cardholder’s key material in an encrypted, signed envelope, and the card verifies the signature before it decrypts, so no party in the logistics chain ever sees a secret. The same method lets an issuer ship a replacement card that carries the same key, so a lost card does not mean lost funds.
This is the part that makes C-WaaS a card scheme rather than a hardware wallet with a logo on it.
A C-WaaS card will not sign a transaction on its own. Every signature needs two things: a cardholder factor (PIN, biometrics in the app, or a tap at a terminal) and an authorisation element from the issuer. The issuer backend receives the transaction, applies the scheme rules, and only then returns the element the card needs to sign. The card checks that element, signs the transaction hash, and the signed transaction is broadcast to the chain.
The rules are yours to define: per-transaction and monthly limits, allowed tokens, allowed recipients and smart contracts, sanctions screening, country restrictions, and an immediate freeze for a lost or stolen card. Because the issuer never holds the cardholder’s key, the issuer cannot move funds alone; because the card never signs without the issuer, the cardholder cannot bypass the rules. Neither key alone can make a payment. The mechanism is protected by US patent 12,719,697 B2, granted in August 2026.
On the Cryptnox platform the issuer backend runs on AWS, with signing keys held in attested Nitro Enclaves and gated by AWS Key Management Service, and with multi-person approval for administrative actions. Cryptnox positions this model as qualifying for self-custody treatment under EU and Swiss frameworks. How a given programme is classified depends on who controls recovery and administrative powers in aggregate, so this is a question to settle with your counsel and regulator during design.
Cardholders get a branded iOS and Android app. Onboarding is two steps: scan the QR code that ships with the card, tap the card on the phone. From then on the app behaves like a banking app with a card attached: balances across tokens and chains, transaction history, PIN or Face ID, card freeze, and, for programmes that want it, WalletConnect and MetaMask compatibility for Web3 use. A kiosk mode lets the card be used without any phone at all, which matters for branches, events and unbanked contexts.
C-WaaS settles on the chains you choose. Today the platform supports EVM chains with ERC-20 stablecoins such as USDC and USDT, Solana, Tron and Bitcoin, which covers six assets across four chain families. Most scheme operators will start stablecoin-first, because a card that is denominated in dollars or euros is what cardholders and merchants expect. Transaction-fee sponsorship lets the operator pay network fees on the cardholder’s behalf so that a payment is simply a payment.
Acceptance is where a new card scheme lives or dies. A card that can only be used through somebody else’s network is not a scheme; it is a product on that network, and the network keeps the rules and the economics. A scheme needs its own way for merchants to accept the card.
C-WaaS comes with its own acceptance layer: a POS application that runs on standard payment hardware. Cryptnox runs it on Linux-based payment terminals, on Android POS devices, and on low-cost NFC readers for kiosks, vending and unattended use. A merchant does not need an acquirer or a processor. The merchant registers with the scheme, enrols its terminals, and is paid in stablecoin to its own wallet.
Here is what a payment looks like at the counter.
Below a threshold that the scheme operator configures, this is a plain tap-and-go: no phone, no passcode, one tap. Above the threshold the cardholder provides a second factor, either by confirming in the app or by entering a POS passcode at the terminal. This mirrors how contactless limits work today, with the difference that the second factor is cryptographically bound to the specific payment. The tap-to-pay flow and its step-up authorisation are the subject of international patent applications filed in 2026, alongside the granted co-signing patent.
On speed: in Cryptnox’s development environment a tap is approved in one to three seconds depending on the terminal, and the transaction is broadcast immediately. Final settlement then depends on the chain, from well under a second on Solana to several minutes on Ethereum mainnet. A scheme operator can choose to guarantee approved low-value payments to the merchant while the chain finalises, which is what card schemes do today with an authorisation, or to show the merchant the chain’s own finality.
On irreversibility: an on-chain payment cannot be charged back. In practice this moves the protection forward. The controls that a chargeback would have enforced after the fact (limits, recipient checks, cardholder confirmation above a threshold) are enforced before the card signs, and the dispute process becomes a scheme rule that you write, not one that a network imposes on you.
Thinking about your own card scheme? See the C-WaaS product page or talk to our team.
Most banks will not replace their existing card product on day one. They want to add a blockchain card scheme next to it, on the same card, and move volume over as acceptance grows. That is what the dual-technology configuration is for.
C-WaaS cards come in three configurations.
| Configuration | What is on the card | Where it works |
|---|---|---|
| Single-tech | C-WaaS wallet application | C-WaaS POS terminals, the app, Web3 (WalletConnect, MetaMask) |
| Dual-tech | C-WaaS wallet application + EMV payment application (Mastercard or Visa) | Everything above, plus any EMV terminal that accepts Mastercard or Visa, through your existing scheme membership |
| Triple-tech | Dual-tech + FIDO2 security key | Everything above, plus passwordless login to e-banking and corporate systems |
A dual-tech card is one card body with two payment applications. At an ordinary payment terminal it presents the EMV application and behaves like any other Mastercard or Visa card, processed by your existing EMV processor. At a C-WaaS terminal, or in the app, the wallet application answers and the payment settles on chain under your scheme’s rules. Depending on the card manufacturer and on scheme approval, the two applications share one multi-application secure element or sit on two chips in the same body. Either way the cardholder carries one card and sees one brand.
The commercial logic is a migration path rather than a bet. Interchange on the EMV side keeps funding the programme. The blockchain side grows merchant by merchant, starting with your own branches, partner retailers and online checkout, with the whole public chain as its network from the first day. The C-WaaS backend is API-ready for EMV processors, so the two sides can share a single cardholder, a single app and a single lifecycle.
The triple-tech option adds a FIDO2 security key to the same chip. The card that pays is also the card that logs the customer into online banking. For a bank, that is one object replacing a card, a token and a password.
Regulation differs by market. In the EU, MiCA governs crypto-asset services and e-money tokens; in Switzerland, FINMA practice applies. C-WaaS supplies the technology; the scheme operator holds the licences that its model requires. Cryptnox’s architecture is designed so that the cardholder’s key stays in the cardholder’s chip, which is the starting point for most favourable classifications.
Cryptnox provides the infrastructure: the cards and the on-card applet, the issuer backend (hosted by Cryptnox or deployed into your own AWS account), the white-label cardholder apps, the POS applications for terminals and kiosks, automated issuance and shipping, SDKs and APIs, and a licence to the underlying patents.
You own the brand, the scheme rules, pricing and fees, compliance and licensing, treasury, the cardholder relationship and the merchant relationship.
That split is deliberate. A card scheme is a business, not a technology, and the business should belong to the operator.
Cryptnox runs this as a gated programme: a scoping workshop first, then a pilot with pass/fail gates before any customer or merchant funds move.
One card, your rules, settled on chain. Learn more on the C-WaaS page, read about the patented technology, or contact us.
Cryptnox C-WaaS is blockchain-native card scheme and payment processing infrastructure that lets an issuer provision cards, authorise transactions and settle payments directly on chain, under its own brand and rules. It includes the secure-element cards, the issuer backend, the cardholder apps and the point of sale application.
A card scheme is the set of rules, standards and network infrastructure that lets a card issued by one organisation be accepted by merchants served by another. Visa and Mastercard are four-party schemes; American Express and Diners are three-party schemes. C-WaaS lets an organisation run its own scheme with public blockchains as the network and settlement layer.
Yes. The network and settlement functions that made a scheme hard to build are provided by public blockchains. C-WaaS supplies the remaining layers: secure-element cards, issuer-controlled authorisation, cardholder apps and a POS application for merchants. You can also keep Visa or Mastercard on the same card with the dual-tech configuration.
A dual-tech or triple-tech card does, through its EMV application and your existing scheme membership. The C-WaaS wallet application itself is accepted at terminals and kiosks running the C-WaaS POS application, in the cardholder app, and in Web3 through WalletConnect and MetaMask.
The cardholder’s key is provisioned into the EAL6+ certified secure element on the card through the patented issuance process, and it never leaves it. The issuer holds a separate authorisation key. A payment needs both, so neither the issuer nor the cardholder can act alone.
The issuer freezes the card immediately by refusing further authorisations. A replacement card carrying the same key is issued through the patented issuance process, so the cardholder keeps the same account and balances.
EVM chains with ERC-20 stablecoins such as USDC and USDT, Solana, Tron and Bitcoin. The scheme operator chooses which assets its cards can hold and spend.
In Cryptnox’s development environment a tap is approved in one to three seconds depending on the terminal. The transaction is broadcast immediately and reaches finality according to the chain, from under a second on Solana to several minutes on Ethereum mainnet.
Start a card scheme pilot. Contact Cryptnox.
Cryptnox SA, Geneva · C-WaaS card scheme infrastructure
