Fintech app compliance checklist: PCI DSS, GDPR, PSD2 and KYC

Most fintech apps touch four rule sets: PCI DSS for card data, GDPR for personal data, PSD2 for payments in Europe, and KYC and anti-money-laundering rules for customer checks. Which ones apply to you depends on your product, your markets and your licences, so your legal counsel decides. This checklist shows what to ask and what to build in.

This is general information, not legal advice.

Which rules usually apply?

Rule set	Mainly about	Usually applies when
PCI DSS	Protecting card data	You store, process or transmit card data
GDPR	Personal data of people in the EU	You handle data of EU residents
PSD2	Payment services and open banking in the EU	You initiate payments or access accounts in Europe
KYC and AML	Knowing your customer and reporting suspicious activity	You hold or move customer funds. See the FATF recommendations

How do you keep card data out of your scope?

• Use a payment provider such as Stripe so card numbers never touch your servers.
• Do not log full card numbers or security codes anywhere.
• Confirm with your provider which PCI DSS self-assessment questionnaire fits your setup.

What does GDPR mean for the build?

• Collect only the data you need and record why.
• Let users export and delete their data, and design the database so deletion is possible.
• Encrypt data in transit and at rest, and restrict who can read it.
• List every vendor that receives personal data and sign data processing agreements.

What does PSD2 mean for the build?

• Strong customer authentication for payments, usually two factors.
• Secure APIs and consent records if you connect to bank accounts.
• Clear records of who authorised each payment and when.

What does KYC and AML mean for the build?

• Identity capture and verification through a provider, with results stored safely.
• Risk checks and sanctions screening where your licence requires them.
• An audit trail for every decision, and a way to flag cases for human review.

What belongs in every fintech build?

Access controls by role, an immutable audit log, encrypted secrets, automated backups, dependency scanning and a reviewed release process. Our fintech work is designed for these needs, and we are ISO 27001:2022 certified. We never claim a product is certified unless it has been assessed.

FAQ

Do I need PCI DSS certification?

Not always. If a payment provider handles card data and you never see it, your obligations are usually lighter. Confirm with your provider and your acquirer.

Is GDPR only for European companies?

No. It applies to handling personal data of people in the EU, wherever your company is.

Who decides which rules apply to us?

Your legal counsel and, where relevant, your regulator. We build the controls they specify. See what a fintech app costs.