Answering a bank or payment partner security questionnaire

Forms run from two pages to a spreadsheet with hundreds of rows, and the families stay the same.

• Governance. Who is responsible for security, whether policies are approved, whether risk is assessed.
• Access. Whether multi-factor authentication is enforced, how rights are granted and removed, who holds admin access.
• Data. Where customer data sits, whether it is encrypted, how it is deleted.
• Incidents. Whether a response procedure exists, who notifies the partner and how fast, whether events are logged.
• Suppliers. Which cloud services and vendors process the data and how you check them.
• Continuity. Whether backups exist and whether restoration has been tested.

Partner IT security questionnaire formats

Some banks send their own form. Cloud and SaaS companies often get the Cloud Security Alliance CAIQ, whose version 4.1 came out on 27 January 2026. Most forms overlap with ISO/IEC 27001 and NIST CSF 2.0, so one verified answer base serves several questionnaires.

ISO states that a company implementing ISO/IEC 27001 decides for itself whether to seek certification, and the certificate comes from an accredited conformity assessment body. Under AICPA rules a SOC report is an examination that a CPA firm performs. Without either, your actual controls carry the questionnaire.

Why an optimistic yes costs more later

Questionnaire answers can become representations in the contract, and the bank may test them. For EU financial entities this is written into DORA: where your service supports a critical or important function, the contract grants the bank rights of access, inspection and audit (Art. 30(3)(e)), and the bank sets the audit frequency by risk (Art. 28(6)). An unsupported yes turns into a contract breach on the day of the first audit.

Regulation (EU) 2022/2554 (DORA) requires a financial entity, before it enters into an ICT services contract, to assess the risks of the arrangement and to undertake due diligence on the provider (Art. 28(4)). It may only contract with providers that comply with appropriate information security standards (Art. 28(5)). Each such contract goes into the entity's register of information, which the supervisor can request in full (Art. 28(3)).

What moves from the questionnaire into the contract

Article 30(2) lists mandatory contract terms, and several repeat questionnaire topics: availability, authenticity, integrity and confidentiality of data; the provider's assistance during an ICT incident at no extra cost or at a cost set in advance; the regions and countries where data is processed. Your answers become the basis for those clauses.

Companies outside the EU

DORA addresses EU financial entities and reaches providers through the contract. A company in Canada, the UAE or the UK serving an EU bank gets the same questions. Licensing for the fintech itself sits with our compliance practice.

1. Triage. We group questions by family and flag where the bank expects an attachment.
2. Scope letter. It fixes which systems we look at, which documents we prepare, the timeline and a fixed price. Nothing is checked before signature.
3. Fact check. We review access, MFA, backups, email and cloud services and talk to the people who run them. A person verifies every finding.
4. Answers and evidence. We fill in the form in the bank's format, attach a document or a screenshot of the setting to every yes, and a plan to every partly and no.
5. Closing gaps. Quick fixes we make ourselves or with your IT contractor, then re-check and update the answer.

The answers and the material belong to you. When the questionnaire comes with an account-opening KYC package, our banking practice coordinates the work.