About FintechAssuranceLabs

What we test

We test fintech products in the three layers of the segment map. Each layer loses money in a different place, so test scope starts from the money flow.

• Consumer fintech. We test card issuing, KYC onboarding, FX application, interest accrual, and fee rules for neobanks, lending, BNPL, and international transfers. A wrong accrual or late fee reaches every customer in the batch and ends in a refund run.
• B2B finance SaaS. We test payment runs, approval chains, proration, payroll tax withholding, and accounting sync. A duplicate payment run or a wrong invoice lands in the customer's books and tax filings.
• Infrastructure and regtech. We test authorisation, capture, refunds, 3-D Secure, webhooks, open banking consent, and sanctions screening rules. A defect in a payment or card issuing platform reaches every merchant or card programme built on it.

Some segments move money under a licence or through a partner bank. For those segments, test scope adds the evidence that a regulator or partner bank in the US, the EU, or Canada asks for.

How we work

We start from the flows where a defect costs money and deliver artifacts your team keeps. Payment flow testing delivers a payment flow map with every state and failure path, an idempotency and duplicate-request test report, and a defect log with the financial impact of each defect.

When an auditor, assessor, or partner bank reviews the work, we verify the product against the requirements of the standard and produce evidence per requirement. Audit and certification test evidence delivers a requirement-to-test traceability matrix, a test evidence pack per audit scope, a gap report before the assessment, and retest evidence after remediation. The PCI DSS testing requirements page shows which requirements testing can verify and which artifacts an assessor requests.

Automated suites run in your CI, so regression on payment flows runs with each release and does not wait for a manual cycle.

Where we work

Our engineers deliver from the United States, the European Union, and Canada. We agree the delivery locations for each engagement before work starts. You can limit an engagement to one location, for example to keep access to EU personal data inside the EU under Chapter V of the GDPR.

Our headquarters is at Carretera de Fontaneda 50, AD600 Sant Julià de Lòria, Andorra. The legal entity is FintechAssuranceLabs, founded in 2020. The team page shows the testing disciplines that a team of 300 covers.

Security

The security page describes how we handle cardholder and account data, isolate test environments, control engineer access, and keep data in the region where you host it. We test with synthetic or masked data in non-production environments. We sign an NDA for every engagement and a DPA when the work touches personal data.

Each certification or attestation below shows the organisation that verified it and the validity date.

• ISO/IEC 27001

  Verified via SGS Spain, valid until 2030

• SOC 2

  Verified via Deloitte Spain, valid until 2030

• PCI DSS, service provider level 2

  Verified via A2SECURE, valid until 2030