Few sectors are tested as relentlessly as financial services. The combination of money, sensitive personal data and systems that customers expect to work every hour of every day makes banks, insurers, payment firms and fintechs a standing target, and the regulators know it. Over the past two years, the rulebook has tightened considerably, with the FCA’s operational resilience regime now fully in force and the EU’s Digital Operational Resilience Act, known as DORA, having applied since the start of 2025.
For anyone responsible for security or compliance in a financial firm, that raises a practical question: what is actually expected of you now, and where does penetration testing sit within it? This guide gives a plain overview of the landscape, draws the important line between the UK and EU regimes, and explains where testing fits into meeting both.
Why financial services is such a target
Before the regulation, it is worth being clear about why the sector attracts this much attention in the first place. Financial firms hold exactly what attackers want, which is money to steal and data to monetise, and they depend on systems whose downtime causes immediate, visible harm to customers. That combination makes the sector both unusually attractive to attack and unusually damaging to disrupt.
Crucially, the threat does not always arrive through the front door. Modern financial firms, and fintechs in particular, are built on a web of third-party providers, cloud platforms and APIs, so an attacker does not need to breach you head-on if they can reach you through a weaker supplier. This is why so much recent regulation looks beyond your own defences to your resilience as a whole, including the parts you do not directly control.
What the FCA expects: operational resilience
In the UK, the centre of gravity is the operational resilience regime set out by the FCA, alongside the Prudential Regulation Authority for the firms it supervises. The FCA’s rules live in its policy statement PS21/3 and in chapter SYSC 15A of its Handbook, and the transition period for full compliance ended on the 31st of March, 2025. In other words, this is no longer something on the horizon. It is a live expectation against which firms are now assessed.
The regime is built around a shift in mindset, which is the assumption that disruption will happen and that the real test is how well you withstand it. In practice it requires firms to do several things. They must identify their important business services, meaning the services whose disruption could cause intolerable harm to customers or threaten market integrity.
They must set an impact tolerance for each one, which is the maximum level of disruption they could tolerate, usually expressed as a length of time. And they must map the people, processes, technology and third parties each service depends on, then test, through severe but plausible scenarios, that they can stay within those tolerances when something goes wrong.
Notably, cyber attack is one of the most plausible scenarios of all, which is precisely where security testing enters the picture. For the largest and most systemically important firms, the Bank of England also runs CBEST, an intelligence-led penetration testing scheme in which tests are driven by real threat intelligence about how that specific firm is likely to be attacked. Most firms will not fall under CBEST, but its logic, which is testing against realistic, tailored threats in place of generic checklists, is a useful standard to aspire to.
What DORA expects, and whether it applies to you
DORA is the EU’s equivalent push, and it has applied since the 17th of January, 2025. It is broader than a cyber rule, setting requirements across ICT risk management, incident reporting, third-party risk and resilience testing, but the part most relevant here is its testing regime. DORA expects regular testing of the systems supporting important functions, and for the financial entities their regulator identifies as significant, it requires threat-led penetration testing, or TLPT, based on the established TIBER-EU framework and carried out at least every three years.
Here, though, is the distinction that causes the most confusion, and it is worth stating plainly. DORA is EU law. It binds financial entities in the EU, and it can reach a UK firm that operates or provides services within the EU, but a firm operating purely in the UK is generally subject to the FCA and PRA regime rather than to DORA directly. Many groups find themselves straddling both, in which case the two need scoping separately because they overlap without being identical. We go into the detail of the regulation itself in our dedicated guide to DORA and what it means for your firm, and the practical first step is always to establish honestly which regime, or regimes, actually apply to you. This is an area where it pays to take proper regulatory advice rather than assume, since the answer shapes everything that follows.
| UK operational resilience (FCA/PRA) | EU DORA | |
|---|---|---|
| In force since | 31st of March, 2025 (end of transition) | 17th of January, 2025 |
| Applies to | UK-authorised firms | EU financial entities, and UK firms operating in the EU |
| Core idea | Stay within impact tolerances for important business services | Digital operational resilience across ICT risk, testing and third parties |
| Testing expectation | Scenario testing; CBEST for the most significant firms | Regular testing, with TLPT at least every three years for significant entities |
Where penetration testing fits
For all the differences in wording, both regimes point to the same underlying need, which is credible evidence that your defences actually hold up under realistic attack. Penetration testing is one of the most direct ways to provide it, and it supports financial firms in several distinct ways.
The most obvious is validating the cyber dimension of your resilience testing. If one of your severe-but-plausible scenarios is a ransomware attack or a breach of a customer-facing service, a penetration test is how you find out if that scenario would actually breach you before you have to claim to a regulator that it would not. In practice, that usually means testing your perimeter through network penetration testing and the customer portals and APIs that sit behind online banking or payments through web application penetration testing. For firms in scope of TLPT or CBEST, the link is explicit, since threat-led testing is itself a form of advanced penetration testing. Even firms well below that threshold benefit from borrowing its central idea of testing against realistic threats, and red and purple teaming is the closest equivalent for firms that want to test detection and response as well as prevention.
Penetration testing also underpins the other compliance obligations financial firms carry. If you handle card payments, PCI DSS requires regular testing outright, and if you hold or are working towards ISO 27001, testing is how you evidence that your controls genuinely work, a point we cover in how penetration testing supports ISO 27001 compliance.
Across all of these, a test on file only has value if it is a meaningful one, carried out by people who understand your business and the way it is actually attacked. That is the case we make for consultant-led penetration testing, and it applies with particular force in a sector where the threats are this targeted and the consequences this visible.
Frequently asked questions
Does the FCA require penetration testing?
Not by name, in the sense of a single rule that says “conduct a penetration test”. The FCA’s operational resilience regime requires firms to test that they can stay within their impact tolerances during severe but plausible scenarios, and since cyber attack is one of the most plausible, penetration testing is in practice how firms generate that evidence for the security dimension. For the most significant firms, the Bank of England’s CBEST scheme makes threat-led testing an explicit expectation.
Does DORA apply to UK financial firms?
DORA is EU law, so it binds financial entities in the EU and can reach a UK firm that operates or provides services within the EU. A firm operating purely in the UK is generally subject to the FCA and PRA operational resilience regime rather than to DORA directly. Many groups fall under both, so the safe approach is to scope your obligations carefully and take regulatory advice rather than assume one way or the other.
What is threat-led penetration testing?
Threat-led penetration testing, or TLPT, is an advanced form of testing in which the attack is shaped by real threat intelligence about how your specific organisation is likely to be targeted, rather than following a generic checklist. It underpins DORA’s testing regime and the UK’s CBEST scheme. The principle behind it, which is testing against realistic, tailored threats, is valuable even for firms that are not formally required to undergo it.
How often should a financial services firm have a penetration test?
The widely accepted baseline is at least annually, and after any significant change to your systems. Firms formally in scope of TLPT under DORA face a requirement of at least every three years for that specific advanced testing, but that sits on top of a regular testing rhythm rather than replacing it. The right cadence depends on how quickly your systems change and how much risk you carry, and we explain why the same annual test can create a false sense of security in our piece on the pentest trap.
Is this guidance legal advice?
No. This article is a general overview to help you understand the landscape, and it is no substitute for tailored legal or regulatory advice. Which regimes apply to your firm, and exactly what they require of you, depends on your specific circumstances, so you should confirm your obligations with a suitably qualified adviser.
Securing a financial services firm?
Fortifi’s consultant-led penetration testing helps banks, insurers, payment firms and fintechs generate the credible, realistic evidence that both the FCA and DORA regimes expect. We scope each engagement around the way your business is actually attacked, and our CREST-accredited consultants deliver findings you can put in front of a regulator with confidence. You can read more about our work in the sector on our financial sector cyber security page, and if you would like to talk through what your firm should be testing, we are happy to start there. Get a quote today.