Testing requirements by standard
Each of the 23 compliance pages lists the requirements that testing can verify, the evidence each test produces, the artifacts an auditor, assessor, or examiner requests, and the common findings. Testing produces evidence for an assessment. The auditor, assessor, or regulator decides whether a product complies, and FintechAssuranceLabs does not certify compliance.
Global
PCI DSS v4.0.1 testing requirements for payment software: what testing verifies, what a QSA asks for, common findings, and the evidence we produce.
EMV 3-D Secure 2 testing requirements
What EMV 3DS 2.2.0 and 2.3.1 require, which requirements a test verifies, the evidence acquirers and assessors ask for, and the defects found most often.
EMV chip and contactless testing requirements
What EMV Books 3 and 4 and the contactless books require of terminals and acquirer hosts, what testing verifies, the evidence acquirers request, and common defects.
ISO 20022 testing requirements
ISO 20022 and CBPR+, Fedwire, and EPC usage rules: which message rules testing verifies, the evidence networks and banks ask for, and the defects found most often.
Swift CSP testing requirements
Which Swift CSCF v2026 controls testing can verify: back-office flow protection, transaction limits, separation of duties, MFA, and the evidence assessors request.
ISO 27001 testing requirements
ISO/IEC 27001:2022 Annex A controls that testing verifies, the evidence a certification auditor requests, common findings in fintech products, and how we cover them.
Global, US-led
SOC 2 testing against the 2017 Trust Services Criteria: which criteria testing verifies, what a service auditor requests, common findings, and the evidence produced.
EU, UK
PSD2 strong customer authentication (SCA) testing requirements
What PSD2 Article 97 and RTS 2018/389 require for strong customer authentication, which rules testing verifies, the evidence auditors request, and common SCA defects.
Open banking standards testing requirements
Open banking API testing against PSD2 RTS Articles 30 to 36, the UK Open Banking Standard, and Berlin Group NextGenPSD2: testable rules, evidence, common defects.
GDPR testing requirements for fintech products
Which GDPR articles testing verifies in a fintech product: consent withdrawal, access and erasure against AML retention, Articles 25 and 32, breach detection, test data.
EU
PSD3 and PSR testing requirements
PSD3 and the Payment Services Regulation: status verified on 16 September 2026, the agreed articles testing verifies, the evidence requested, and common defects.
DORA and its RTS on ICT risk and TLPT: which articles testing verifies, what a supervisor or internal audit requests, common findings, and the evidence we produce.
EU AML and KYC testing requirements
EU AMLR 2024/1624, travel rule, and FATF rules for KYC, sanctions screening, and monitoring: what testing verifies, what supervisors request, and common defects.
MiCA testing requirements for crypto-asset service providers
MiCA Regulation (EU) 2023/1114 and the crypto travel rule: which articles testing verifies, what a competent authority requests, and common CASP defects.
European Accessibility Act (EAA) and WCAG testing requirements
What the European Accessibility Act requires of consumer banking and e-commerce services, which EN 301 549 and WCAG 2.2 criteria testing verifies, and common findings.
US
GLBA and money transmitter testing requirements
GLBA Safeguards Rule, Regulation P, and state money transmission laws: testable requirements, examiner and partner bank artifacts, and common defects in fintech flows.
Regulation Z (Truth in Lending) testing requirements
What Regulation Z (12 CFR Part 1026) requires for consumer credit disclosures, APR accuracy, card fees, and billing errors, what testing verifies, and common defects.
Regulation B and ECOA testing requirements
Equal Credit Opportunity Act and Regulation B (12 CFR Part 1002): adverse action notice timing and reasons, information requests, retention, and what testing verifies.
Regulation E testing requirements
Regulation E and the remittance transfer rule, 12 CFR 1005: which liability, error resolution, prepaid, and remittance rules testing verifies, and the evidence produced.
Nacha Operating Rules testing requirements
Which Nacha Operating Rules testing verifies: ACH file format, returns and reinitiation, WEB debit account validation, Same Day ACH limits, and 2026 fraud monitoring.
CFPB Section 1033 testing requirements
CFPB Personal Financial Data Rights rule, 12 CFR Part 1033: status verified on 16 September 2026, developer interface and authorisation tests, evidence, common defects.
Canada
RPAA and RPAR testing: which operational risk, incident, and safeguarding rules testing verifies, what the Bank of Canada requests, and common findings.
FINTRAC and PCMLTFA testing requirements
PCMLTFA rules for Canadian MSBs and virtual currency dealers: identity thresholds, $10,000 reports, the 24-hour rule, travel rule data, and the two-year review.
Scope your testing
Send FintechAssuranceLabs your product, segment, money flows, and the standards that need evidence, and get a proposed test scope with its deliverables.
Scope your testing