OFFICIAL REFERENCE
DORA: Regulation (EU) 2022/2554
Use the official publication and confirm applicability to your entity, jurisdiction and agreed testing objective.
RESOURCES & REFERENCES
Prepare with the
right information.
Practical material for payment platforms, e-money businesses, lending platforms and financial software teams.
Start with primary sources.
OFFICIAL REFERENCE
DORA TLPT RTS: Regulation (EU) 2025/1190
Use the official publication and confirm applicability to your entity, jurisdiction and agreed testing objective.
OFFICIAL REFERENCE
PCI SSC: official standards and document library
Use the official publication and confirm applicability to your entity, jurisdiction and agreed testing objective.
OFFICIAL REFERENCE
GDPR: Regulation (EU) 2016/679
Use the official publication and confirm applicability to your entity, jurisdiction and agreed testing objective.
OFFICIAL REFERENCE
OWASP API Security Top 10
Use the official publication and confirm applicability to your entity, jurisdiction and agreed testing objective.
OFFICIAL REFERENCE
NIST SP 800-115: security testing and assessment
Use the official publication and confirm applicability to your entity, jurisdiction and agreed testing objective.
Practical sector guides
Planning4 min read
Scoping a fintech API penetration test around the product model
Give testers roles, tenants and transaction states as well as an API specification.
Read the perspective
Delivery4 min read
Tenant isolation: proving the API makes the right decision
Use role pairs and object ownership to test cross-tenant access.
Read the perspectiveDelivery4 min read
Payment webhook testing: authenticity is only one control
Examine replay, ordering and state transitions with agreed synthetic events.
Read the perspective