Rules for card data, financial reporting controls and the ICT resilience of financial firms and their suppliers: PCI DSS, SOC 1, GLBA, DORA, SWIFT CSP and more.
Money attracts the most detailed rules in IT. Payment card data is governed by PCI DSS, which the card brands enforce through contracts with acquiring banks and merchants. Financial institutions are governed by financial regulators, and those regulators increasingly reach the technology vendors that banks and insurers depend on.
Card data
PCI DSS applies to every entity that stores, processes or transmits cardholder data, or that can affect its security. It is not a law, but merchants and service providers agree to it in their contracts. The biggest decision for a software team is scope: hosted payment pages, iframes and tokenisation can keep card data out of your systems and shrink what has to be assessed. The PCI Secure Software Standard covers payment software sold to others.
Financial reporting
SOC 1 reports cover a service organisation's controls that matter to its customers' financial statements. They exist because listed customers must maintain internal control over financial reporting under SOX, and their auditors need assurance about outsourced systems.
Financial-sector laws
In the EU, DORA sets ICT risk, incident reporting, resilience testing and third-party rules for financial entities, and brings critical ICT providers under oversight. In the US, the GLBA Safeguards Rule requires a written information security program from a broad set of financial institutions, including many fintechs. SWIFT's Customer Security Programme sets mandatory controls for SWIFT users. Indian banking and securities rules (RBI and SEBI) are covered in the Indian IT laws category.
At a glance
Mandatory or voluntary: payment & financial data security
European Union. Applies directly to EU financial entities and reaches ICT third-party providers worldwide through contracts and, for critical providers, direct oversight.
European Parliament and Council; supervised by national competent authorities and the European Supervisory Authorities (EBA, EIOPA, ESMA)
Global. Applies to software vendors that choose to validate payment-related software under the PCI Security Standards Council programme, often at the request of payment brands, acquirers or customers.
India. Applies to RBI-regulated entities, with separate entity-wise directions for commercial banks, small finance banks, NBFCs, credit information companies, all-India financial institutions and others.
India. Applies to payment system operators authorised by RBI and to the banks, gateways, intermediaries and vendors in their payment chains, including foreign card networks.
Reserve Bank of India, Department of Payment and Settlement Systems
Companies with securities registered with the US SEC, including foreign private issuers, and by extension the service providers whose systems support their financial reporting.
US Congress; implemented by the Securities and Exchange Commission and the Public Company Accounting Oversight Board (PCAOB)
Digital Operational Resilience Act, Regulation (EU) 2022/2554
DORA is the EU regulation on digital operational resilience for the financial sector. Since January 2025 it has required banks, insurers, investment firms, payment and e-money institutions, crypto-asset providers and other financial entities to manage ICT risk, report major ICT incidents, test resilience and manage ICT third-party providers under strict contract rules. Software, cloud and IT service providers to these firms must accept DORA contract terms, and critical providers are overseen directly by EU supervisors.
Gramm-Leach-Bliley Act (1999): FTC Standards for Safeguarding Customer Information (16 CFR Part 314) and privacy requirements
The Gramm-Leach-Bliley Act is the US law governing how financial institutions protect and share consumers' financial information. Its FTC Safeguards Rule requires non-bank financial institutions, a broad group that includes many fintechs, lenders, brokers and tax preparers, to run a written information security program with a qualified individual in charge, risk assessments, encryption, MFA, monitoring, testing, vendor oversight and incident response, and to notify the FTC of certain breaches.
PCI DSS is the security standard for payment card data, published by the PCI Security Standards Council and enforced by the card brands through their contracts with acquiring banks, merchants and service providers. Its 12 requirements cover networks, secure configuration, protection of stored card data, encryption in transit, vulnerability management, secure software, access control, logging, testing and policy. The current version is 4.0.1. Compliance is validated each year by a self-assessment questionnaire or an assessor's report.
PCI Software Security Framework: PCI Secure Software Standard and PCI Secure Software Lifecycle (Secure SLC) Standard
The PCI Software Security Framework replaced PA-DSS with two standards: the Secure Software Standard, which validates the security of specific software products, and the Secure SLC Standard, which validates a vendor's secure software development lifecycle. Version 2.0 of the Secure Software Standard, effective January 2026, takes a principles-based approach focused on protecting sensitive assets, adds a module for SDKs, requires source code access for assessors, and lets Secure SLC qualified vendors self-approve low-impact updates.
SOC 1: report on controls at a service organization relevant to user entities' internal control over financial reporting (AICPA SSAE 18, AT-C 320; IAASB ISAE 3402)
A SOC 1 report is an independent auditor's report on a service organisation's controls that are relevant to its customers' financial reporting. Payroll processors, billing and revenue platforms, fund administrators, payment processors and IT providers running finance systems obtain SOC 1 reports so their customers and those customers' auditors can rely on them, especially for SOX. Type 1 covers control design at a date; Type 2 adds operating effectiveness over a period. ISAE 3402 is the international equivalent.
SWIFT Customer Security Programme (CSP) and Customer Security Controls Framework (CSCF)
The SWIFT Customer Security Programme requires every bank and institution connected to the SWIFT network to secure its local SWIFT environment against cyber attacks. Its Customer Security Controls Framework sets mandatory and advisory controls under three objectives: secure your environment, know and limit access, and detect and respond. Users attest compliance annually, supported by independent assessment, and counterparties can view attestations. CSCF v2026 made back office data flow security mandatory and extended scope to customer connectors.
COSO Internal Control, Integrated Framework (2013) and COSO Enterprise Risk Management, Integrating with Strategy and Performance (2017)
COSO publishes the most widely used frameworks for internal control and enterprise risk management. The 2013 Internal Control, Integrated Framework organises control into five components and 17 principles and is the basis for SOX internal control over financial reporting and the SOC 2 common criteria. The 2017 ERM framework links risk to strategy and performance through 20 principles. In 2026, COSO added guidance on internal control over generative AI.
Reserve Bank of India Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (successor to the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices)
RBI's technology directions set how banks, NBFCs and other regulated entities govern IT, manage cyber and technology risk, run operations, audit systems and recover from disruption. Issued as entity-wise directions on 31 July 2026, they replace the 2023 IT Governance Master Direction and older cyber security circulars. They require board IT strategy committees, a CISO, IT and security policies, vulnerability testing, disaster recovery drills, IS audits, vendor oversight and cyber incident reporting to RBI within six hours.
Reserve Bank of India directive on Storage of Payment System Data (circular DPSS.CO.OD No. 2785/06.08.005/2017-18, 6 April 2018) and FAQs of 26 June 2019
RBI's payment data localisation directive requires the entire data relating to payment systems operated in India to be stored only in systems located in India. Processing may happen abroad, but the data must then be deleted overseas and brought back within one business day or 24 hours, whichever is earlier. It applies to card networks, wallets, payment aggregators, banks and their gateways and vendors, and compliance is verified through audits by CERT-In empanelled auditors.
Sarbanes-Oxley Act of 2002: internal control over financial reporting and IT general controls
The Sarbanes-Oxley Act is the US law that requires public companies to maintain and assess internal control over financial reporting, with executives certifying their reports and, for larger companies, auditors attesting to those controls. For IT, SOX means IT general controls over the systems that produce financial data: access, change management, development and operations. It applies to US-listed companies, including foreign ones, and reaches their software and cloud vendors through SOC 1 reports and contract requirements.
No. It is an industry standard from the PCI Security Standards Council, made binding through contracts with the card brands and acquiring banks. Some laws reference it, but its force comes from those contracts.
If we use Stripe or Razorpay, do we still need PCI DSS?
Yes, but your scope can be much smaller. You still validate compliance, often with a short self-assessment questionnaire, and you remain responsible for the page that loads the payment form.
Does DORA apply to software vendors?
DORA applies directly to EU financial entities. Vendors are affected through the contract terms those entities must include, and the most critical ICT providers can be designated for direct oversight.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
