Getting a licensee ready for the regulator's IT inspection

The request list usually comes with a short deadline, and its content follows your regime's rules.

• DORA. A financial entity provides complete and updated information on ICT risk and its framework when the competent authority asks (Art. 6(3)), the report on the framework's annual review (Art. 6(5)) and the full register of ICT contracts (Art. 28(3)).
• FCA, SYSC 15A. A firm keeps a written self-assessment of its operational resilience, retains every version for at least six years and provides it to the FCA on request (SYSC 15A.6.1R, 15A.6.2R).
• VARA Technology and Information Rulebook. Evidence of tests and audits is documented and made immediately available for VARA's inspection (Rule I.E.3).

EU: DORA

Applies from 17 January 2025 to payment institutions, e-money institutions and crypto-asset service providers authorised under MiCA (Art. 2(1), Art. 64). The ICT risk management framework is documented and reviewed at least once a year (Art. 6(5)).

UK: FCA operational resilience

SYSC 15A covers e-money institutions, payment institutions and registered account information service providers (SYSC 15A.1.1R(3)). Firms had until 31 March 2025 to be able to operate their important business services within impact tolerances. The FCA publishes the CQUEST and ORQUEST self-assessment questionnaires.

Singapore: MAS TRM compliance

The MAS Guidelines on Risk Management Practices – Technology Risk, published on 18 January 2021, address all licensed sectors, payments included. MAS Notice FSM-N13, in force for digital payment token service providers since 6 November 2024, sets hard numbers: notify MAS within 1 hour of discovering a relevant incident, a root cause report within 14 days, a recovery time objective of at most 4 hours for each critical system, and no more than 4 hours of unscheduled downtime per critical system in any 12 months.

Dubai: VARA Technology and Information Rulebook

A VASP appoints a CISO (Rule I.I.1), engages a qualified independent third party for vulnerability assessments and penetration tests (Rule I.E.1) and is regularly audited by independent auditors (Rule I.E.4).

Canada: RPAA

A payment service provider registered with the Bank of Canada maintains a risk management and incident response framework (s. 17(1)) and notifies affected parties and the Bank without delay of an incident with a material impact (s. 18(1)). Frameworks had to be in place from 8 September 2025. Technical work in Canada runs through the group's IT brand itopsi.com.

1. Rule map. We list the requirements that apply to your licence and the documents each implies.
2. Scope letter. It fixes the entities, systems, deadline and a fixed price. Nothing is reviewed before signature.
3. Reality check. We compare documents with settings: access, logging, backups and restore tests, supplier contracts, incident records. A person verifies every finding.
4. Remediation. Quick fixes we make ourselves or with your IT contractor; longer items get an owner and a date.
5. The file. Documents indexed by rule number, with a short plain-language note for management on each area.
6. Rehearsal. We walk the named people through the questions inspectors usually ask about their area.

Notification clocks differ the most. DORA's technical standard asks for an initial notification within 4 hours of classifying an incident as major and no later than 24 hours after becoming aware of it; MAS FSM-N13 gives 1 hour from discovery; the RPAA says without delay. One incident procedure with a notification table per regime keeps those clocks under control.

Licences and corporate structure sit with our licensing practice; the EMI side is covered in the guide on DORA ICT requirements for an EMI licence.