Financial services and fintech
Cybersecurity and DORA support for financial institutions
Our senior specialists help manage IT risks, meet DORA requirements and respond to supervisory requests. We work with your team on assessments, improvements and security leadership that reflect your financial services.
Our clients in financial services
They are among the 10+ financial sector companies we have worked with.
“Guardera's team enhanced our cybersecurity maturity - from improving incident response and threat visibility to fortifying our overall security architecture. Their pragmatic, real-world approach ensures we stay secure and resilient, not just compliant.”
Mindaugas Vilkelis
CFO, NEO Finance
Relevant regulations and standards
Which rules apply to your type of firm
Your licence decides which rules apply. Some exceptions exist, so we check your licence type first.
| Your firm | Rules that usually apply | Where to start |
|---|---|---|
| Bank | DORA. PCI DSS if you handle card data. | DORA Compliance & ICT Risk Assessment |
| Payment or e-money institution | DORA, with some exceptions. PCI DSS if you handle card data. | DORA Compliance & ICT Risk Assessment |
| Investment firm | DORA. | DORA Compliance & ICT Risk Assessment |
| Insurer | DORA. | DORA Compliance & ICT Risk Assessment |
| Applying for a payment or e-money licence | The regulator reviews your IT and security documents and the people responsible for them. DORA applies once you are licensed. | Fintech licensing: IT and security |
| Lender | DORA only if your licence is one of the types it lists. | A free call to check |
| Crypto firm | MiCA for the licence, and DORA once licensed. | Crypto & digital assets |
| IT or software supplier to financial firms | DORA reaches you through your customers’ contracts. | Technology & SaaS |
| Company in a financial group but outside DORA | NIS2 may apply, depending on its sector and size. | NIS2 Compliance |
ISO 27001 is voluntary for all of these. Firms often choose it when customers or partners ask for a certificate.
- EU lawDORAEU rules for financial institutions on IT risk, incident response, recovery, resilience testing and IT suppliers.
- StandardPCI DSSA security standard for organisations that handle payment card data or can affect the security of the card data environment.
- StandardISO 27001An international standard for managing information security risks, with independent certification of your management system.
Common challenges
Requests your team needs to answer
-
The regulator asks for proof
Your regulator wants recent test results, your IT supplier list and your board’s decisions on IT risk.
-
A licence application needs its IT section
The application must describe the systems you will run and name the people responsible for IT and security.
-
An audit left open findings
Each finding needs an owner, a fix and a record of what changed.
-
Your IT supplier changes its service
You need to know what the change means for payments, customer access and your recovery plans.
How we help
Security support for financial institutions
- Fintech licensing: IT and securityIf you are applying for a payment or e-money licence, we write the IT and security part around the systems you will run. We then help answer the regulator’s questions.
- DORA Compliance & ICT Risk AssessmentOnce licensed, we check your recovery tests and supplier contracts against DORA, then list the fixes in the order to make them.
- PCI DSS ComplianceIf you handle card data, we map where it goes and prepare you for the PCI DSS assessment your payment partners require.
- CISO-as-a-ServiceA dedicated security lead sets priorities, advises your board and coordinates the agreed security work, supported by the wider Guardera team.
- Penetration TestingWe test the apps and systems your customers use to log in and move money, then re-test the agreed fixes.
- NIS2 ComplianceIf a company in your group falls outside DORA, we check whether NIS2 covers it and help meet its duties.
Common questions
Common questions
Free 30-minute call
Plan your next security and compliance priority
Discuss your licence, supervisory request or ongoing security needs in a free 30-minute call to agree where to start and what support you need.
