Compliance & Security — Non-Negotiable in Fintech

Why Compliance Isn’t Optional

In fintech, security isn’t a “nice to have.” It’s regulated by law. Build an insecure payment system and your company faces:

• Fines (up to millions of dollars)
• Loss of ability to process payments
• Criminal liability
• Customer trust destroyed permanently

As an engineer, you need to know what rules exist and how they affect your code.

PCI-DSS — The Big One

PCI-DSS (Payment Card Industry Data Security Standard) — 12 requirements for anyone who stores, processes, or transmits card data.

In one picture — PCI scope is every system the raw card number touches. The whole game is shrinking that box. Let a gateway take the card and your own backend falls outside scope:

flowchart LR
    subgraph IN["In PCI-DSS scope"]
        GW["Payment gateway<br/>Razorpay or Stripe"]
        NET["Card network<br/>and issuer"]
    end
    subgraph OUT["Out of scope"]
        B["Your backend<br/>sees only a token"]
        DB["Your database<br/>stores last 4 plus token"]
    end
    C["Cardholder<br/>enters card"] -->|raw card number| GW
    GW -->|authorize| NET
    GW -->|token only| B
    B --> DB

Anything inside the In scope box must meet all 12 requirements and get audited. Anything that only ever sees a token is out of scope — which is why “never let card data touch your servers” is the first design rule in fintech.

The 12 Requirements (Simplified)

PCI-DSS Levels

What This Means for Your Code

// NEVER do this
logger.info("Card number: " + cardNumber); // PCI violation
logger.info("CVV: " + cvv); // PCI violation — CVV must NEVER be stored

// DO this
logger.info("Card ending in: " + cardNumber.substring(cardNumber.length() - 4));
// Or better: don't handle card numbers at all — use tokenization

Best practice: Use a payment gateway (Razorpay, Stripe) that handles PCI compliance for you. Your backend never sees the full card number.

RBI Guidelines (India-Specific)

Security Patterns Every Fintech Engineer Must Know

1. Encryption at Rest and in Transit

At rest:  Data in database → AES-256 encryption
In transit: Data between services → TLS 1.2+
Key management: AWS KMS or HashiCorp Vault (never hardcode keys)

2. Audit Trail — Everything Is Logged

Every financial operation must have an immutable audit trail:

@Entity
@Table(name = "audit_logs")
public class AuditLog {
    @Id
    private Long id;
    private String action;          // "PAYMENT_CREATED", "REFUND_INITIATED"
    private String entityType;      // "Payment", "User"
    private Long entityId;
    private String performedBy;     // User ID
    private String details;         // JSON of what changed
    private Instant timestamp;
    // No UPDATE or DELETE operations allowed on this table
}

Rule: Audit logs are append-only. Nobody can edit or delete them.

3. Secrets Management

WRONG: application.properties
  jwt.secret=mysupersecretkey123

WRONG: Environment variable in Dockerfile
  ENV JWT_SECRET=mysupersecretkey123

RIGHT: External secrets manager
  - AWS Secrets Manager
  - HashiCorp Vault
  - Even just environment variables set at deployment time (not in code)

4. Input Validation — Trust Nothing

// ALWAYS validate at the boundary
public ResponseEntity<?> createPayment(@Valid @RequestBody PaymentRequest request) {
    // @Valid triggers Bean Validation
    // But also validate business rules:
    if (request.amount().compareTo(BigDecimal.ZERO) <= 0) {
        throw new InvalidAmountException();
    }
    if (request.amount().scale() > 2) {
        throw new InvalidPrecisionException(); // No sub-paise amounts
    }
}

5. Rate Limiting on Sensitive Endpoints

OWASP Top 10 — Know These

Interview Questions

1. “What is PCI-DSS and how does it affect your code?”
2. “How would you store sensitive financial data?”
3. “What’s the difference between encryption at rest and in transit?”
4. “Why can’t you store CVV numbers?” (PCI explicitly prohibits it, even encrypted)
5. “How do you prevent SQL injection in a Spring Boot application?”
6. “What’s an audit trail and why does fintech need it?”

Module done? Add it to today’s tracker