Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Financial Services
Manual penetration testing and security consulting scoped against the frameworks financial services firms actually get assessed on, DORA, FCA operational resilience rules, DFSA cyber risk rules, and PCI DSS, across EMEA.
Financial services is the one industry across EMEA where security testing obligations are usually explicit, not implied. In the EU, DORA creates a general ICT testing obligation for nearly every financial entity, plus a narrower threat-led penetration testing regime for regulator-designated firms. In the UK, the FCA and PRA expect firms to evidence operational resilience against real disruption, not just a policy statement. In the Gulf, the DFSA's GEN 5.5 rules require DIFC-regulated firms to run a genuine resilience-testing programme. And PCI DSS applies wherever cardholder data is stored, processed, or transmitted, regardless of which regulator otherwise applies. A generic penetration test report doesn't map cleanly onto any of these, what does is testing scoped from the start against the specific regulatory obligation that actually applies to your firm.
For EU-specific DORA scoping in more depth, including the general-testing-vs-TLPT distinction, see our EU / NIS2 & DORA compliance page.
This runs on the same manual, adversary-emulated methodology behind our core Penetration Testing service, applied with financial services-specific frameworks and reporting expectations in mind.
The financial services-specific regulations our engagements are most often scoped around, across the EU, UK, and Gulf.
The EU's Digital Operational Resilience Act, applying to financial entities across roughly 20 categories. Creates a general ICT testing obligation for everyone in scope, and a separate, narrower TLPT regime under Articles 26–27 for regulator-designated entities only.
EIOPA, DORA overviewUK rules requiring in-scope firms to identify important business services and stay within impact tolerances for disruption, testing is a practical way to evidence resilience against real technical failure modes.
FCA, Operational resilienceGEN 5.5 of the DFSA's General Rulebook, in force since January 2024, requiring DIFC-regulated firms to maintain a cyber risk management programme and a comprehensive resilience testing programme.
DFSA, Cyber Risk SupervisionThe card networks' security standard for any organization that stores, processes, or transmits cardholder data, a recurring requirement for payments, fintech, and banking clients regardless of region.
PCI Security Standards CouncilDORA & PCI DSS, evidenced
Standing privileged access with no MFA, unmasked cardholder data, and an untested payments failover , DORA, FCA, and PCI DSS evidence together.
Reviewing privileged access to the core banking platform
$ query: SELECT * FROM admin_roles WHERE mfa_enabled = false
7 privileged accounts with standing access, no MFA, no session recording
An illustrative walkthrough of how an engagement actually runs, not footage from a real client environment.
Not by default. DORA creates two separate testing obligations, general ICT testing, which most financial entities need and which we regularly deliver, and threat-led penetration testing (TLPT) under Articles 26–27, a narrower program reserved for entities your national competent authority specifically designates. We can help clarify which applies to you.
Yes, we scope engagements for UK financial services clients navigating the FCA and PRA's operational resilience expectations, and can structure findings and reporting to support that context.
Yes, we can scope testing and a resilience-testing programme aligned with the DFSA's GEN 5.5 cyber risk management requirements for firms regulated in the Dubai International Financial Centre.
Yes, we regularly test systems that fall under PCI DSS scope, though formal PCI DSS attestation itself is issued through a Qualified Security Assessor (QSA), not us; our testing can support that process as one input.
Talk to us about scoping an engagement around your specific regulatory context, DORA, FCA, DFSA, or PCI DSS.