Standards & frameworks
Financial services, payments & AML: standards and frameworks
Financial services compliance frameworks cover card data security, controls reports for clients’ auditors, central bank cyber and resilience regimes, and anti-money laundering programmes. This page groups them, shows how they relate and helps you decide which to address first when an acquirer, a client or a regulator asks.
About this family
What do financial services compliance frameworks cover, and who asks for them?
This family gathers the rules, standards and reporting regimes that banks, insurers, payment firms and the providers serving them must satisfy before a regulator, a card scheme or a client will rely on them. It runs from card security under PCI DSS and the PCI PIN, 3DS and Software Security Framework standards, through SOC 1 reports on controls that reach clients’ financial statements, to central bank regimes such as the SAMA Cyber Security Framework, CBUAE regulations and BSP circulars, operational risk and resilience expectations from the Basel framework and the UK PRA and FCA, anti-money laundering and counter-terrorist financing programmes built on the FATF standards, and readiness for ISO 20022 payment messaging. The demand rarely starts inside the business. An acquirer asks for an Attestation of Compliance, a payroll or lending client’s external auditor wants a SOC 1 Type 2 report, a supervisor sets a date for a maturity level, or an outsourcing contract with a bank passes its regulator’s expectations down to a BPO, a contact centre or a technology provider.
The frameworks overlap more than their different vocabularies suggest. Access control, change management, logging, third-party oversight, incident response and continuity appear in nearly all of them, so one well-run control set can feed a QSA’s sample, a service auditor’s tests and a supervisor’s maturity review, while each still needs its own scope, evidence and report. The routes differ, and that shapes the plan: PCI DSS is validated, SOC 1 is attested by a service auditor, SAMA and other central banks assess, and AML programmes are supervised by the authority responsible for your sector; only ISO 22301, applied to a financial entity, ends in an accredited certificate. Sterling starts with the obligation that carries a date, maps what the others can reuse and builds the programme with your team. You choose the level of support: Design™, where we develop and your people implement under our expert advice and supervision, or Drive™, where we design and build under your approval as a fully managed service. Either way the Effivity platform is included at no additional cost, holding controls, evidence and periodic tasks between assessments.
The frameworks
21 standards, frameworks and schemes in this family
Each card opens the framework’s page: what it asks, who assesses or supervises, and how Sterling helps you prepare.
- SOC 1 (ISAE 3402 / SSAE 18)SOC 1 compliance consulting for service organisations: controls over client financial reporting readied for the service auditor's SOC 1 attestation report.
- SOC 2SOC 2 Readiness and compliance consulting: controls mapped to the Trust Services Criteria and evidence prepared for the CPA firm's SOC 2 attestation report.
- DORADORA compliance consulting for EU financial entities and ICT providers: ICT risk, incident reporting, resilience testing and third-party risk, evidenced.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- PCI PIN / PCI 3DS / PCI SSFPCI PIN, 3DS and Secure Software compliance and requirements: PIN keys, 3DS Core parts, SSF v2.0 transition, QPA and assessor routes, all-inclusive support.
- Basel operational risk / PRA & FCA operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
- MAS TRM & Outsourcing (Singapore)MAS TRM and outsourcing compliance for Singapore financial institutions: TRM Guidelines, outsourcing guidelines and notices, gap assessment, all-inclusive plan.
- CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
- BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
- APRA CPS 230 / 234 (Australia)APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
- GLBA Safeguards Rule (US)GLBA compliance and requirements for US financial firms: privacy notices, opt-outs, the FTC Safeguards Rule, breach notice to the FTC, in an all-inclusive programme.
- ISO 20022 readinessISO 20022 readiness and requirements: structured addresses from 14 November 2026, data quality, change control and governance around your payments migration.
- SFDRSFDR compliance and requirements for asset managers, insurers and advisers: Article 8 and 9 products, PAI statements, RTS and an all-inclusive disclosure programme.
- COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
- SWIFT CSPSwift CSP attestation and requirements explained: the CSCF controls, architecture types, independent assessment, KYC-SA attestation window, cost and timing.
- ISO 32210ISO 32210 implementation for banks, investors and insurers: apply the seven sustainable finance principles to governance, risk and reporting, in one all-inclusive proposal.
- SOX / ICFR readinessSOX compliance and requirements: section 302 certifications, 404 management assessment, auditor attestation under AS 2201, ICFR readiness and timeline.
- PCI DSS v4.0.1PCI DSS compliance consulting for merchants and service providers: scope, the twelve requirements and evidence prepared for your annual validation by a QSA.
- ISO 22301 for financial entitiesISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- SAMA CSF / BCM (Saudi Arabia)SAMA Cyber Security Framework compliance consulting for Saudi financial institutions: governance, controls and maturity evidence prepared for SAMA review.
- RBI guidelines (India)RBI SEBI cybersecurity compliance for banks, NBFCs and SEBI regulated entities: 2026 RBI directions, SEBI CSCRF requirements, cyber audits, cost and timeline.
Four regional regimes, MAS TRM and Outsourcing, the RBI guidelines, APRA CPS 230 and 234 and the GLBA Safeguards Rule, are covered within broader pages, and ISO 22301 for financial entities sits with the ISO 22301 page; their cards take you there. Not sure where to begin? Select the Standard™ and the readiness check point you to the right starting framework.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions financial services buyers ask about these frameworks
Where to start, what can be combined, and what the assessor, auditor or supervisor actually checks.
Which financial services framework should we address first?
Start with the one a counterparty or regulator already requires by a date: your acquirer or card brand for PCI DSS, your clients and their external auditors for SOC 1, SAMA or another central bank for its cyber or resilience regime, and your sector supervisor for the AML programme. Once that date is met, the controls built for it shorten the next framework considerably, so the order matters less than starting with the obligation that has consequences if it is missed.
Can PCI DSS, SOC 1 and ISO/IEC 27001 work be combined?
Yes, as one control environment, but not as one report. Access reviews, change records, logging, provider oversight and incident handling can be designed once and evidenced once in Effivity, then mapped to each framework. Each still has its own assessor and output: a QSA and the Report on Compliance with its AOC for PCI DSS, a CPA firm or ISAE 3402 service auditor and its report for SOC 1, and an accredited certification body and its certificate for ISO/IEC 27001. One never substitutes for another, and Sterling does not validate, attest or certify any of them.
What does the assessor, auditor or regulator actually check?
It depends on the route. A QSA tests each PCI DSS requirement against sampled evidence, or your executive signs a self-assessment questionnaire where the acquirer allows it. A SOC 1 service auditor examines the design of your controls as at a date in a Type 1 report, and their operation over a period in a Type 2 report. SAMA rates cyber security maturity on a scale from 0 to 5 and expects Level 3 as a minimum. AML programmes are reviewed by the supervisor that licenses you, and an ISO 22301 certificate follows a Stage 1 and Stage 2 audit by an accredited certification body.
Talk to a consultant
Plan your payments, controls reporting or AML programme with a Sterling consultant
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice