UAT sign off checklist for fintech releases: the one we use

What UAT sign off means, by definition

The ISTQB Glossary defines user acceptance testing (UAT) as "A type of acceptance testing performed to determine if intended users accept the system." It defines acceptance testing as "A test level that focuses on determining whether to accept the system." We read both entries on 2026-09-22. Neither says who accepts a payment or lending release, or what proof they keep. Our checklist fills that gap: each row has a pass condition and a retained evidence record.

The glossary defines severity as "The degree of impact that a defect has on the development, testing or operation of a component or system." ISTQB revised that definition on 2026-06-06. A severity label does not state what an open defect costs per affected account, so our defect section asks for the amount and its basis.

Why a fintech UAT pass rate is not enough

A green UAT pass rate hides three failure patterns we check for:

• The screen passes and the ledger fails. A partial refund shows the right app balance and reduces the wrong instalment; reconciling the UAT run against expected postings exposes it. The procedure is in our ledger reconciliation testing guide.
• A fee change ships ahead of its notice window. Regulation E, 12 CFR 1005.8(a)(1), requires a financial institution to "mail or deliver a written notice to the consumer, at least 21 days before the effective date" of a change to a term disclosed under 1005.7(b) that would increase the consumer's fees or liability, reduce the types of available electronic fund transfers, or tighten limits on transfer frequency or dollar amount. Paragraph (a)(2) exempts an immediate change "necessary to maintain or restore the security of an account or an electronic fund transfer system." Regulation Z, 12 CFR 1026.9(c)(2)(i)(A), requires written notice "at least 45 days prior to the effective date" of a significant change on open-end credit plans that are not home-equity plans, "except as provided in paragraphs (c)(2)(i)(B), (c)(2)(iii) and (c)(2)(v)". In the EU, PSD2 Article 54(1) requires changes to a framework contract to be proposed "no later than 2 months before their proposed date of application"; under Article 54(2), interest or exchange rate changes "may be applied immediately and without notice" where the contract agrees that right and the changes follow the agreed reference rates.
• Open defects are ranked without money. A Minor defect that collects 40.00 early on every affected order can cost more than a Major defect on an internal report.

The checklist we use

This checklist is our practice; no regulation prescribes it in this form. Copy the six tables into the release ticket at UAT entry and close each row with a link to its evidence. Test amounts use XTS, the ISO 4217 code reserved for testing, and synthetic data replaces real account data in every row.

A. Business acceptance of money flows

B. Reconciliation of UAT runs

C. Customer-facing disclosures and notices

D. Open defects by severity with financial impact

E. Rollback readiness

F. Who signs, and the evidence retained

How we run the checklist

• Blank rows block sign off. A row that does not apply is marked "N/A" with a one-line reason that the section signer approves.
• One build ID covers all six sections. A fix after sign off reopens B6, D1, and E2 for the new build, and every signer re-signs.
• Defect impact follows the defect log format shown in the sample on our dedicated QA team page.
• The evidence index doubles as audit input. An auditor who later samples the change asks for the same records, which our audit and certification test evidence service builds. Other Regulation E notice rules are on our Regulation E testing requirements page.