Penetration Testing Requirements by Regulation: A Matrix
Quick answer. NYDFS, VARA, PCI DSS and Kenya require yearly pentests. DORA requires yearly tests of critical systems, and TLPT every 3 years for identified firms. MAS, SFC and HKMA expect them; SOC 2 and ISO 27001 mandate none.
Video transcript
Licensed in two places? You may face two pentest calendars. Here is who requires pentests, and how often.
NYDFS, VARA, PCI DSS and Kenya require pentests at least yearly. DORA requires yearly tests of critical systems, with pentesting one listed test.
DORA also requires threat-led testing of live production systems, at least every three years, for firms their authority identifies.
The verb matters. MAS, the SFC and the HKMA say should, not must. SOC 2 and ISO 27001 mandate no pentest at all.
Some rules reach smart contracts. VARA asks for audits where relevant, the HKMA yearly and on every upgrade. MiCA applicants describe a third-party audit if available, and CCSS requires one even at Level I.
In several jurisdictions? Build one plan around the strictest rule. Test at least yearly and after significant change, with a qualified, independent tester. Scope in wallets and custody, and plan for TLPT if DORA or VARA may call for it.
Then keep one evidence file, from scope to retests, mapped to each provision so one report answers several.
Guardian's pentests cover infrastructure, apps, APIs and offchain automation, each closed with a retest. Its Regulatory and Compliance service maps each report to the provisions it answers. Guardian is not a law firm, and works alongside your counsel.
Read the full matrix, or talk to Guardian about one test plan for every rule.
A crypto firm licensed in two places can end up on two pentest calendars. The rules differ on who must test, how often, and how firmly they ask.
This matrix puts them side by side, checked against each text in November 2026.
This article explains the technical and security side of the penetration testing provisions compared below. It is not legal advice; confirm how it applies to you with counsel.
How to Read the Matrix
Each row is one provision. The columns:
- Covers: who the provision reaches.
- Testing: what it asks for, in short.
- Frequency: the minimum cadence the text sets, if any.
- Verb: how firmly the text asks, in its own words where quoted.
- Status: what kind of text it is, and since when.
The verb matters. In the HKMA's guideline, "must" marks a statutory requirement and "should" a regulatory expectation.
Guidelines still count. MAS says the degree of observance of its TRM Guidelines is an area of consideration in supervision.
Europe and the United States
| Provision | Covers | Testing | Frequency | Verb | Status |
|---|---|---|---|---|---|
| DORA Arts. 24 and 25 | EU financial entities, including CASPs | Risk-based program; pentesting is one listed test | Yearly, on systems behind critical functions | shall | Applies since Jan. 17, 2025 |
| DORA Art. 26 (TLPT) | Entities their authority identifies | Threat-led test of live production systems | At least every 3 years | shall | Applies since Jan. 17, 2025 |
| MiCA RTS 2025/305 Art. 9 | CASP applicants | Third-party audit with pentests and contract code review | With the application | shall, "if available" | Delegated Regulation, in force |
| NYDFS 500.5(a)(1) | Firms licensed under NY banking, insurance or financial services law | Inside and outside, by a qualified party | At least annually | shall | In force; current text since Apr. 29, 2024 |
| NYDFS 200.16(e)(1) | BitLicensees | Pentest, plus vulnerability assessment | Pentest yearly; assessment quarterly | shall | In force |
DORA does not name a yearly pentest. Article 24(6) requires "appropriate tests" at least yearly, and Article 25(1) lists penetration testing among them.
The yearly floor applies to financial entities other than microenterprises. For TLPT, the authority may raise or lower the 3-year frequency on the firm's risk profile.
MiCA's application rules ask for a third-party cybersecurity audit "if available". It covers "ideally" pentests and, where the applicant uses smart contracts, a source code review.
Part 500's limited exemption in 500.19(a) reaches 500.5. It covers firms with fewer than 20 employees and contractors, under $7.5 million in revenue in each of the last three years, or under $15 million in assets.
That exemption lists Part 500 sections only; Part 200's rule for BitLicensees is separate. Detail: DORA's testing rules and NYDFS 500.5.
UAE, Asia and Africa
| Provision | Covers | Testing | Frequency | Verb | Status |
|---|---|---|---|---|---|
| VARA Rule I.E.1 | VASPs licensed by VARA in Dubai | Independent pentests; smart contract audits where relevant | Yearly and before new systems | must | Rulebook; current version since June 19, 2025 |
| MAS TRM 13.2 | Financial institutions MAS supervises | Blackbox and greybox tests of online services | Internet-facing: yearly or after major change | should; "is expected to" | Guidelines, January 2021 |
| SFC VATP 12.13 | Licensed virtual asset trading platforms | Independent assessment with pentests and custody code review | Before launch and changes, then periodically | should | Guidelines, June 2023 |
| HKMA 6.5.5, 6.5.17, 6.5.19 | Licensed stablecoin issuers | Pentests, attack simulation, contract audits | Contract audit yearly and on upgrade; tests by risk | should | Guideline, August 2025 |
| Japan FSA policy | Crypto exchanges | TLPT; the FSA will test several exchanges | None set; FSA pilot within 2026 | "need to" | Policy, April 3, 2026 |
| Kenya VASP Regs. 97(4)(a) | VASPs licensed by the CBK or CMA | Vulnerability assessment, risk assessment, pentest | Twice in year one ("bi-annual"), then at least yearly | shall | Legal Notice 134, gazetted July 22, 2026 |
VARA can also require threat-led testing by notice, run by an external tester (Rules I.E.5 and I.E.6).
The SFC's assessment "should at least cover" user apps, wallets, physical security, and network and system security.
The HKMA also expects a qualified third party to audit a stablecoin's smart contracts at least yearly, and on every deployment or upgrade (6.5.5).
Japan's policy says exchanges "need to" find weak points through TLPT, but sets no cadence. Within 2026, the FSA will conduct TLPT on several of them; see Japan's exchange cybersecurity policy.
Kenya also asks for a pentest before licensing. The application must include an independent information systems audit, with a vulnerability assessment and pentest (regulation 6(2)(l)).
Our Kenya post maps the rest.
Standards and Certifications
| Provision | Covers | Testing | Frequency | Verb | Status |
|---|---|---|---|---|---|
| PCI DSS 11.4.2, 11.4.3 | Entities in scope for PCI DSS | Internal and external pentests | Every 12 months and after significant change | "is performed" | Standard, v4.0.1 |
| SOC 2 (Trust Services Criteria) | Firms that choose a SOC 2 | None required; CC4.1 point of focus names pentesting | Not set | None | 2017 criteria; points of focus revised 2022 |
| ISO/IEC 27001:2022 | Organizations certifying an ISMS | No named pentest; A.8.8 and A.8.29 cover testing | Not set; risk-based | None for pentests | 2022 edition |
| CCSS 2.01 | Systems seeking CCSS certification | Level II: independent pentest. Level III: audit with pentest | Level II: regular. Level III: yearly | "has been completed" | Version 9 |
PCI DSS v4.0.1, as reproduced by Cloudaware, wants a qualified tester with organizational independence, who need not be a QSA or ASV.
SOC 2 leaves the choice to the firm. The AICPA says using the criteria "does not require an assessment of whether each point of focus is addressed."
More in does SOC 2 require penetration testing.
ISO/IEC 27001 never uses the term "penetration test", per ISMS.online and TCSA. Both place testing under A.8.8 (technical vulnerabilities) and A.8.29 (security testing in development and acceptance).
CCSS also reaches contracts. Even Level I requires an external audit of production smart contract code, with Medium and higher issues addressed before deployment.
Building One Test Plan
A firm licensed in several places faces several of these rows. Build one plan around the strictest of each.
- Cadence: at least yearly; in Kenya, "bi-annual" in year one, which we read as twice.
- Triggers: test after significant change (PCI DSS, MAS) and before new systems (VARA, SFC).
- Perspective: from outside and inside the boundary (NYDFS, PCI DSS).
- Tester: qualified and independent; a third party where VARA or CCSS applies.
- Scope: wallets and custody systems, which the SFC names.
- Contracts: a smart contract audit where VARA, the HKMA, MiCA or CCSS reach you.
- TLPT: plan for it if DORA or VARA may call for it.
Then keep one evidence file: scope, dates, testers, findings, fixes and retests. Map it to each provision, so one report can answer several.
How Guardian Helps
Guardian's pentests cover infrastructure, web apps, APIs, browser extensions, SDKs and offchain automation, each closed out with a retest.
Its Regulatory & Compliance service maps each pentest report to the provisions it answers.
Its evidence ledger lists NYDFS 500.5 and 200.16(e), DORA Article 25, MAS TRM 13.2, SFC VATP 12.13, VARA Rule I.E.1 and PCI DSS 11.4, among others.
Guardian is not a law firm. It works alongside your counsel.
Frequently Asked Questions
Which regulations require annual penetration testing?
NYDFS Part 500 and Part 200, VARA Rule I.E.1, PCI DSS 11.4 and Kenya's VASP Regulations set pentests at least yearly. DORA requires yearly tests of critical systems and lists pentesting as one such test.
Do SOC 2 or ISO 27001 require a penetration test?
Neither makes one mandatory. SOC 2 names penetration testing in a CC4.1 point of focus, and points of focus are not requirements. ISO/IEC 27001 does not use the term, per ISMS.online and TCSA; they place testing under A.8.8 and A.8.29.
Who may perform a regulatory pentest?
NYDFS accepts a qualified internal or external party. PCI DSS needs a qualified tester with organizational independence. VARA requires a qualified, independent third party, as do CCSS Levels II and III. DORA allows independent internal testers for its yearly program.
Do any rules cover smart contract testing?
VARA covers them where relevant. The HKMA expects yearly contract audits, plus one per deployment or upgrade. MiCA applicants describe a third-party audit, if available, ideally with a code review. CCSS Level I requires external audits of deployed contract code.
Sources
- Official Journal of the EU: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) (December 14, 2022)
- Official Journal of the EU: Commission Delegated Regulation (EU) 2025/305, information in a CASP authorization application (October 31, 2024)
- New York DFS: 23 NYCRR Part 500 as amended by the Second Amendment, DFS unofficial text (November 2023)
- Cornell LII: 23 NYCRR 200.16, Cyber security program (accessed November 6, 2026)
- VARA: Technology and Information Rulebook, Part I.E Testing and Audit (version in force June 19, 2025)
- MAS: Technology Risk Management Guidelines (January 2021)
- SFC: Guidelines for Virtual Asset Trading Platform Operators (June 2023)
- HKMA: Guideline on Supervision of Licensed Stablecoin Issuers (August 2025)
- FSA: Policy Approaches to Strengthen Cybersecurity for Cryptoasset Exchange Services (April 3, 2026)
- Kenya Gazette Supplement No. 185: Legal Notice No. 134, The Virtual Asset Service Providers Regulations, 2026 (July 22, 2026), copy published by the CMA
- Cloudaware: PCI DSS v4.0.1 requirement 11.4.2, internal penetration testing, as reproduced (accessed November 6, 2026)
- Cloudaware: PCI DSS v4.0.1 requirement 11.4.3, external penetration testing, as reproduced (accessed November 6, 2026)
- AICPA: TSP Section 100, 2017 Trust Services Criteria (March 2020 edition, copy hosted by Arpio)
- AICPA and CIMA: 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
- ISMS.online: ISO 27001:2022 Annex A 8.29, Security Testing in Development and Acceptance (accessed November 6, 2026)
- TCSA: ISO 27001 Penetration Testing Requirements (last reviewed July 2026)
- CryptoCurrency Certification Consortium (C4): CCSS v9.0 matrix (accessed November 6, 2026)
- Guardian: Regulatory & Compliance
- Guardian: Penetration Testing
One test plan, mapped to every rule
Guardian pentests your systems and maps each report and retest to the provisions that ask for them.