Compliance testing lead, PCI DSS, PSD2 and DORA
Pen name. The company does not publish engineers' real names.
Turns regulatory requirements into test scope and audit evidence. Writes about new rules and deadlines and what they change for test plans.
Regulation
The Consumer Financial Protection Bureau (CFPB) sent a proposed rule reconsidering its open banking rule, 12 CFR Part 1033, to the Office of Information and Regulatory Affairs (OIRA) on 4 August 2026. On 22 September 2026, the Federal Register shows no published proposal. Part 1033 test suites keep the published response rate, authorisation, revocation, and data field checks.
Regulation
Verification of Payee (VoP) under the Instant Payments Regulation (EU) 2024/886 has applied to euro-area payment service providers since 9 October 2025 and applies to providers in non-euro Member States from 9 July 2027. European Payments Council VoP rules effective 20 September 2026 add test cases for 11-character Business Identifier Codes (BICs), timestamps, and error formats.
Regulation
The European Accessibility Act, Directive (EU) 2019/882, has applied to consumer banking and e-commerce services since 28 June 2025. EN 301 549 V4.1.1, published 2 September 2026, moves web and app tests from Web Content Accessibility Guidelines (WCAG) 2.1 AA to WCAG 2.2 AA. V4.1.1 was not cited in the Official Journal on 22 September 2026.
Regulation
After the Payment Systems Regulator (PSR) 1 July 2026 evaluation, UK authorised push payment (APP) fraud rules require sending payment service providers (PSPs) to reimburse in-scope claims up to £85,000, minus an optional £100 excess, within five business days unless the clock stops, except first-party fraud or gross negligence. After reimbursing, they can require up to 50% from receiving PSPs.
Regulation
The Nacha 2026 rule changes require risk-based fraud monitoring from originating banks (ODFIs), non-consumer Originators, Third-Party Senders, Third-Party Service Providers, and receiving banks (RDFIs), with Phase 1 from 20 March 2026 and Phase 2 from 22 June 2026. ACH test scope now covers fraud alert rules, R17 return handling, and PAYROLL and PURCHASE descriptors.
Send FintechAssuranceLabs your product, segment, money flows, and the standards that need evidence, and get a proposed test scope with its deliverables.
Scope your testing