QA & Testing for UK FinTech — FCA PS21/3 Built In

FCA PS21/3 Operational Resilience Testing

FCA PS21/3 requires firms to test their ability to remain within Impact Tolerances. ClickMasters FinTech QA: chaos engineering tests (simulate AWS availability zone failure — does payment processing continue within tolerance?), load testing at 3× normal peak (FCA expects systems to handle stress), DR failover test (automated quarterly — switch from primary to DR region and verify IBS continuity), and recovery time measurement (document and compare against Impact Tolerance).

PCI-DSS QA Requirements for FinTech

PCI-DSS requirement 6 (secure development): security testing must be part of the development lifecycle. PCI QA: OWASP Top 10 automated scan (OWASP ZAP in CI/CD), static application security testing (SAST — SonarQube or Semgrep), dependency vulnerability scanning (Dependabot + OWASP Dependency Check), and annual CREST penetration test (external + internal). PCI-DSS requirement 11.3: external penetration test at least annually and after significant changes.

FCA Consumer Duty Consumer Understanding Testing

FCA Consumer Duty Consumer Understanding outcome: consumers must be able to understand financial products and services. Testing for Consumer Understanding: plain language testing (Flesch reading ease > 60 for retail financial communications), user testing with representative consumers (do users understand the product terms?), accessibility testing (WCAG 2.1 AA — financial products must be accessible to users with disabilities), and dark pattern testing (FCA specifically monitors for manipulative UI patterns that impede consumer understanding).

FCA Consumer Duty Vulnerable Customer Testing

FCA Consumer Duty: firms must identify and support vulnerable customers. QA testing for vulnerable customer features: cognitive accessibility testing (WCAG 2.1 AAA criteria for cognitive — plain language, clear error messages, no time limits), financial difficulty pathway testing (does the vulnerable customer flag trigger correctly when user indicates hardship?), and carer/proxy access testing (can a carer manage a vulnerable customer's account appropriately?).

FCA PS21/3

FCA Consumer Duty

PCI-DSS

UK GDPR

FCA COBS

Cyber Essentials Plus