In regulated fintech, your engineering team is a filing, not just a decision.

The Fintech Engineering Team maps what changed across four regimes. The EU’s DORA has applied since January 2025: ICT third-party arrangements go into a register submitted to your supervisor every 31 March, with subcontracting chains assessed and conditions in the contract. New York’s Part 500 reached its final phase in November 2025, requiring MFA for any individual accessing any system, contractors included, at any risk level. PCI DSS moved 51 of its 64 new requirements from best practice to mandatory. Bank partners now pass their third-party obligations straight down.

The pattern is not really about security controls. It is about evidence. Every regime asks a version of the same four questions: who touched the system, under what authority, reviewed by whom, and can you reconstruct it later. That is better news than it sounds: geography is rarely the regulated variable and traceability always is. A distributed team with named accounts and enforced review sits in a stronger position than a co-located team with shared credentials. The paper supplies the scoping triage and the contract terms. Read it before your next engagement touches the ledger.