Rules for card data, financial reporting systems and the IT of banks, insurers, brokers and fintechs. 9 entries, 2 with a full guide.
Financial data carries the strictest rules because fraud and outages cause direct losses. If your software stores, processes or transmits cardholder data, PCI DSS applies through your contracts with acquiring banks and the card brands. Version 4.0.1 is the only active version, and its future-dated requirements became mandatory on 31 March 2025.
Listed companies in the US must test IT controls over financial reporting under SOX. Banks and other financial entities in the EU must meet DORA's ICT risk, incident and third-party rules, which apply to their technology suppliers through contracts. In India, RBI and SEBI issue binding IT and cybersecurity directions for regulated entities and expect the same from their vendors.
Payment Card Industry Data Security Standard, version 4.0.1
Industry standardContractually requiredGlobal
PCI DSS is the security standard for any business that stores, processes or transmits payment card data, or can affect its security. Version 4.0.1 has 12 principal requirements, from network security controls and protecting stored account data to vulnerability management, access control, logging and testing. Compliance is validated annually through a QSA's Report on Compliance or a Self-Assessment Questionnaire, depending on your merchant or service provider level.
Covers, who needs it and key requirements
What it covers
The cardholder data environment and connected systems: network security, secure configurations, protection of stored and transmitted account data, malware protection, secure software, access control, MFA, logging, security testing and security policies.
Who needs it
Merchants, payment service providers, payment gateways, e-commerce and SaaS platforms that handle card payments, and IT service providers with access to cardholder data environments.
Why it matters
Acquiring banks require it, and a breach without compliance exposes you to fraud liability, fines and losing card acceptance.
Sarbanes-Oxley Act of 2002 (IT general controls under Sections 302 and 404)
LawMandatory if in scopeUS-listed companies
The Sarbanes-Oxley Act requires US-listed companies to certify their financial reports and maintain effective internal control over financial reporting (ICFR). Section 302 makes the CEO and CFO certify each report, and Section 404 requires an annual management assessment of ICFR, with auditor attestation for larger filers. For IT, this means tested IT general controls (ITGCs) over access, change management and operations for every system that affects the financial statements.
Covers, who needs it and key requirements
What it covers
Internal control over financial reporting, including IT general controls over financial systems (ERP, billing, payroll, data warehouses), application controls, access, change management, computer operations and outsourced service providers.
Who needs it
SEC-registered public companies and companies preparing for a US IPO, plus the SaaS, ERP, payroll and managed IT providers whose systems support their financial reporting.
Why it matters
IT control failures can become material weaknesses that must be disclosed to investors, and listed clients will ask vendors for SOC 1 reports and evidence.
Applies in
United States; applies to SEC-registered companies worldwide
Obtain and review SOC 1 reports for outsourced services, including complementary user entity controls
Document, test and remediate controls each year for management's assessment and the auditor
SOC 1
SOC 1 report on a service organisation's controls relevant to user entities' internal control over financial reporting (SSAE 18, AT-C 320)
Attestation reportVoluntaryUS / global
A SOC 1 report is an independent CPA examination of a service organisation's controls that are relevant to its customers' financial reporting. Payroll, billing, payments, ERP hosting and fund administration providers commonly need one so that their public-company clients and their auditors can rely on the service for SOX. Like SOC 2 it comes as Type I (design) or Type II (operating effectiveness over a period), and it lists complementary controls the customer must operate.
Covers, who needs it and key requirements
What it covers
Control objectives over transaction processing and supporting IT general controls (access, change management, operations) at a service organisation.
Who needs it
SaaS and outsourcing providers whose services affect clients' financial statements, such as payroll, billing, payments and ERP hosting.
Why it matters
Listed clients and their auditors need it to rely on your service for SOX and financial audits.
Applies in
United States origin; used worldwide (ISAE 3402 is the international equivalent)
Define control objectives relevant to customers' financial reporting
Document the system and complementary user entity controls
Operate ITGCs over access, change and operations
Undergo a Type I or Type II examination by a CPA firm
DORA
Digital Operational Resilience Act, Regulation (EU) 2022/2554
LawMandatory if in scopeEU
DORA is the EU regulation on digital operational resilience for the financial sector, applying since 17 January 2025 to banks, insurers, investment firms, payment and crypto-asset providers and others. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing including threat-led penetration testing for some firms, and strict management of ICT third-party risk with mandatory contract terms. Critical ICT third-party providers are directly overseen by EU supervisors.
Covers, who needs it and key requirements
What it covers
ICT risk management, ICT incident management and reporting, digital operational resilience testing, ICT third-party risk and contracts, information sharing and oversight of critical ICT providers.
Who needs it
EU financial entities, and the IT, cloud and software providers that serve them through contracts (critical providers are overseen directly).
Why it matters
Financial clients must put DORA contract terms, audit rights and exit plans into every ICT service agreement, so their vendors must comply in practice.
ICT risk management framework approved by the management body
Classify and report major ICT-related incidents
Regular resilience testing, with TLPT for significant entities
Register of information on ICT third-party arrangements
Contracts with the mandatory provisions of Article 30, including exit strategies
SWIFT CSP
SWIFT Customer Security Programme and Customer Security Controls Framework (CSCF)
Industry standardContractually requiredGlobal
The SWIFT Customer Security Programme requires every organisation connected to the SWIFT network to implement the mandatory controls of the Customer Security Controls Framework and attest each year, with independent assessment. The CSCF is updated annually and covers securing the local SWIFT environment, controlling access and detecting anomalous activity. IT providers that host or manage SWIFT infrastructure for banks must support these controls.
Covers, who needs it and key requirements
What it covers
Secure environment, access control, detection of anomalous activity and incident planning for SWIFT-connected infrastructure.
Who needs it
Banks and financial institutions on SWIFT, and IT and service bureaus hosting SWIFT components.
Why it matters
Attestation is mandatory for SWIFT users, and counterparties can see your status.
Implement all mandatory CSCF controls for your version
Independent assessment
Annual attestation in the KYC Security Attestation application
RBI IT Governance Directions
RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023 (and Master Direction on Outsourcing of IT Services, 2023)
RegulationMandatory if in scopeIndia
The Reserve Bank of India's Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, effective 1 April 2024) requires banks, NBFCs and other regulated entities to have board-level IT governance, IT and information security risk management, business continuity, and IS audit. A separate Master Direction on Outsourcing of IT Services (April 2023) sets due diligence, contract, audit-rights and exit requirements that apply to IT vendors and cloud providers serving them.
Covers, who needs it and key requirements
What it covers
IT governance structures, IT strategy, information security, cyber risk, change and patch management, BCP and DR, IS audit, and outsourcing of IT services including cloud.
Who needs it
Banks, NBFCs, payment system operators and credit information companies regulated by RBI, and their IT and cloud vendors.
Why it matters
Indian financial clients must flow these requirements into vendor contracts and audits.
Board-approved IT strategy and IT governance committees
Information security policy, cyber risk management and SOC
BCP and DR with regular drills
Annual IS audit
Outsourcing risk assessment, contracts with audit rights and exit plans
SEBI CSCRF
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, 2024
RegulationMandatory if in scopeIndia
SEBI's Cybersecurity and Cyber Resilience Framework, issued on 20 August 2024 with phased compliance through 2025, sets cybersecurity standards for stock exchanges, depositories, brokers, mutual funds, investment advisers and other SEBI-regulated entities. It follows a graded approach by entity category and covers governance, identification, protection, detection, response, recovery and evolution, with cyber audits, a security operations centre for larger entities and incident reporting to CERT-In and SEBI.
Covers, who needs it and key requirements
What it covers
Cyber governance, asset and risk identification, protection controls, SOC and detection, incident response and reporting, recovery, audits and third-party (including cloud) risk.
Who needs it
SEBI-regulated entities and the IT, cloud and SaaS vendors that serve them.
Why it matters
Market entities must audit their vendors and include CSCRF requirements in contracts.
Classify the entity category and applicable controls
Board-approved cybersecurity policy and governance
SOC or managed SOC as required
Periodic cyber audits by CERT-In empanelled auditors
Incident reporting to CERT-In and SEBI
NYDFS Part 500
New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500
RegulationMandatory if in scopeNew York, US
Part 500 requires banks, insurers and other financial services companies licensed by the New York DFS to run a risk-based cybersecurity programme. The second amendment (November 2023) phased in duties through November 2025, including CISO reporting to the board, MFA for all remote and privileged access, asset inventories, stricter controls for larger Class A companies, notification of cybersecurity events within 72 hours and of extortion payments within 24 hours, and annual certification by 15 April.
Covers, who needs it and key requirements
What it covers
Cybersecurity programme and policies, governance, risk assessment, access privileges, MFA, encryption, vendor management, incident response, notification and annual certification.
Who needs it
DFS-regulated financial institutions and the IT and SaaS vendors that serve them (through third-party service provider policies).
Why it matters
DFS enforces actively, and covered entities must assess and contractually bind their technology vendors.
Notify DFS within 72 hours of a cybersecurity event
Annual certification or acknowledgement of non-compliance by 15 April
GLBA Safeguards Rule
Gramm-Leach-Bliley Act and the FTC Standards for Safeguarding Customer Information (Safeguards Rule, 16 CFR Part 314)
LawMandatory if in scopeUnited States
The Gramm-Leach-Bliley Act requires US financial institutions to protect customers' nonpublic personal information. For non-bank financial institutions such as lenders, fintechs, tax preparers and many others, the FTC's amended Safeguards Rule requires a written information security programme with a qualified individual, risk assessment, encryption, MFA, service provider oversight and, since May 2024, notification to the FTC of security events affecting 500 or more consumers within 30 days.
Covers, who needs it and key requirements
What it covers
Privacy notices and the Safeguards Rule: written information security programme, risk assessment, access controls, encryption, MFA, monitoring, training, vendor oversight, incident response and FTC notification.
Who needs it
US financial institutions in the broad GLBA sense, including fintechs and non-bank lenders, and their IT and SaaS service providers.
Why it matters
The FTC enforces the Safeguards Rule against non-bank financial companies, and requires them to oversee their service providers.
