Fintech testing, DORA and payment-security scope

Applicability comes before the label

“Fintech” is a business description, not one regulatory category. DORA applicability depends on the legal entity and regulated activity; TLPT designation is a separate question. PCI DSS scope depends on payment-card data and systems. Product security testing should be planned alongside these obligations, GDPR and customer requirements.

Record the legal entity, services, jurisdictions, data categories and contractual commitments. Confirm the current official text and authority guidance with the responsible legal or compliance team. The same technology may support organisations with different obligations.

What a technical test can contribute

Scoped observations can support security-risk decisions and demonstrate whether selected controls work as expected. Evidence needs dates, systems, identities and limitations. A finding register helps connect remediation to accountable owners; it does not assess every governance, contractual or organisational duty.

Use the relevant primary sources

• DORA: Regulation (EU) 2022/2554
• DORA TLPT RTS: Regulation (EU) 2025/1190
• PCI SSC: official standards and document library
• GDPR: Regulation (EU) 2016/679
• OWASP API Security Top 10
• NIST SP 800-115: security testing and assessment

DORA general testing and statutory TLPT are distinct. PCI DSS scope and assessment expectations should be confirmed with the responsible programme or assessor. A generic penetration test should never be labelled a complete compliance certification.

Keep assurance boundaries explicit

Report what was tested, what was not tested and what relied on a supplied starting point. If authority coordination, an independent assessment or a formal attestation is required, treat it as its own process. The sample report is educational evidence of format, not evidence that a real organisation complies.