MetaMask

United States · metamask.io · 17 vendors

Resilience scores

Technology vendors

Services catalogue

7 services in catalogue across 4 categories; runs on 17 sub-vendors.

Insights

Last updated 2026-07-07 · revision 2

17 direct vendors, 247 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

MetaMask exhibits high migration readiness due to its highly modern and adaptable tech stack. The use of TypeScript, React Native, Node.js, and monorepo tooling (Yarn, Lerna/Nx) suggests a modular, component-based architecture that is well-suited for cloud-native deployments and microservices. Their deep integration with cutting-edge Web3 technologies like EVM, zkEVM, and Smart Contract Accounts, along with developer SDKs and embedded wallet solutions, indicates a forward-thinking and flexible platform. Key challenges for migration readiness stem from missing data. The regulatory environment and data residency requirements are not specified, which could introduce significant complexities and costs during a migration. Financial stability data (revenue, growth) is also absent, making it difficult to assess the company's capacity to fund a large-scale migration effort. Regarding vendor relationships, while "Total Vendors: 0" is stated, the presence of "Total Services: 27" with providers concentrated in a few geographic locations (United States, Germany for HQ) suggests a moderate risk of vendor lock-in, which could complicate the process of migrating these services or their underlying infrastructure. The specific vendor lock-in risk is unknown.

Compliance

10 in-scope frameworks identified; showing 3.

OFAC Sanctions Compliance — Partially Compliant

MetaMask/Consensys explicitly implements OFAC sanctions screening and blocks access from sanctioned territories and individuals. The Terms of Use require users to represent they are not on sanctions lists (OFAC SDN list, UN, EU, UK lists) and not located in comprehensively sanctioned countries. The Privacy Notice references sanctions compliance as a legal basis for processing IP addresses. However, the decentralized nature of blockchain transactions and the self-custody wallet model create inherent challenges for sanctions enforcement — users can potentially circumvent geographic blocks using VPNs. OFAC has previously taken enforcement action against crypto companies (e.g., Tornado Cash, BitGo, Kraken) for sanctions violations. Risk is High due to: (a) the global scale of MetaMask's user base; (b) the inherent difficulty of enforcing sanctions in a self-custody wallet context; (c) OFAC's active enforcement posture toward crypto companies.

Evidence: https://metamask.io/terms-of-use, https://consensys.io/privacy-notice

US Bank Secrecy Act — Assessment Required

MetaMask/Consensys operates in the US and provides services that may qualify as Money Services Business (MSB) activities under FinCEN regulations. The Buy/Sell crypto features (fiat on/off ramp), Swap, and potentially the MetaMask Card trigger MSB analysis. FinCEN has historically taken the position that certain crypto wallet providers and exchangers are MSBs subject to BSA/AML obligations including registration, KYC/CDD, SAR filing, and recordkeeping. The risk is High because: (a) FinCEN enforcement against crypto companies has intensified; (b) the DOJ and SEC have pursued crypto companies for AML failures; (c) MetaMask's global scale (100M+ users) and financial services features (Buy, Sell, Swap, Card, Perps) create significant AML exposure; (d) the Privacy Notice references AML/KYC as a legal basis for processing personal data, indicating awareness of these obligations.

Evidence: https://consensys.io/privacy-notice, https://metamask.io/terms-of-use, https://metamask.io/buy-crypto

ISO 27001 (source) — Assessment Required

ISO 27001 certification is highly relevant for a company of Consensys/MetaMask's scale and profile — managing security for 100M+ users' wallet interactions, operating blockchain infrastructure (Infura), and processing sensitive financial/cryptographic data. The absence of a publicly disclosed ISO 27001 certification is a notable gap for enterprise trust. Risk is Medium because: (a) the company references security measures and third-party security audits (Coinspect); (b) the self-custody model limits Consensys's direct exposure to user funds; (c) however, the API infrastructure (Infura) and developer platform handle significant sensitive data flows that would benefit from ISO 27001 certification. Enterprise and institutional customers increasingly require ISO 27001 as a baseline.

Evidence: https://consensys.io/security, https://metamask.io/security, https://consensys.io/privacy-notice

Financials

Three-year financials

Financial Resilience Score: 7/10

MetaMask, as a product of privately-held Consensys, benefits from category leadership in self-custodial crypto wallets with 100M+ downloads and a diversified product stack including Infura, Linea, and Consensys Staking. The company raised a substantial US$450M Series D in March 2022 at a reported ~US$7B valuation, providing a significant cash cushion. Multiple monetization vectors (Swaps fees, MetaMask Card interchange, staking rewards, and the newly-launched mUSD stablecoin) scale with users and on-chain activity, and the firm has strong founder pedigree via Ethereum co-founder Joseph Lubin. However, financial resilience is constrained by significant crypto market cyclicality, as evidenced by multiple rounds of layoffs in 2023 and 2024 that reduced headcount from ~1,000+ to ~700+. Regulatory exposure is material—the SEC issued a Wells Notice in April 2024 (subsequently dropped in early 2025), and MiCA and other global regulations pose ongoing risk. Competitive pressure from Phantom, Coinbase Wallet, Trust Wallet, and exchange-embedded wallets is intensifying. The private-company opacity (no audited financials, no segment disclosure) further limits external assessment confidence.

Key strengths: Category leadership: 100M+ downloads, leading self-custodial crypto wallet, Diversified product stack across MetaMask, Infura, Linea, and Consensys Staking, US$450M Series D raised March 2022 at ~US$7B reported valuation, Strong founder pedigree with Ethereum co-founder Joseph Lubin as CEO, Multiple monetization vectors: Swaps fees, Card interchange, staking, mUSD stablecoin, Core contributor to Ethereum protocol upgrades (durable moat), Global reach with support in 134 languages

Risk factors: Crypto market cyclicality drove revenue compression and multiple layoff rounds in 2023-2024, Regulatory exposure including SEC Wells Notice (April 2024) and global crypto regulation (MiCA), Intense competition from Phantom, Coinbase Wallet, Trust Wallet, Rabby, Rainbow, Private-company opacity: no audited financials publicly available, Security and reputational risk from wallet hacks and phishing incidents, Revenue highly correlated to trading volumes and token prices

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report