Fintech operates in the most-regulated corner of the domain-security space. Every framework you must comply with — NIS2, PCI DSS 4.0.1, DORA, MAS TRM, PSD3 — names email authentication and TLS controls explicitly. Failing to deploy them is not just risky, it’s a compliance finding.
The Cost of Getting This Wrong
- Facebook + Google (2013-2015) — $121M wired to a lookalike vendor domain in a BEC attack
- Toyota Boshoku (2019) — $37M lost to BEC
- Orion S.A. (August 2024) — $60M lost to BEC
- FBI IC3 2024 Annual Report — BEC losses of $2.79B in 2024 alone. Cumulative 2022-2024: $8.5B. FBI notes this “represents only a fraction of actual incidents.”
Every BEC attack has the same shape: attacker spoofs an executive domain, sends a wire instruction to accounting, accounting doesn’t verify because the sender looks legitimate. DMARC at p=reject blocks the spoof at the receiving mail server, before accounting sees it.
The Regulations You’re Complying With
NIS2 — Effective October 2024
NIS2 Implementing Regulation (EU) 2024/2690 mandates for in-scope entities:
- SPF — sender authorization
- DKIM — message signing
- DMARC — alignment enforcement
- MTA-STS — enforced-TLS inbound SMTP
- DANE — DNS-anchored TLS pinning
Fines up to €10M or 2% of global revenue, whichever is higher.
In-scope: financial services, digital infrastructure, cloud providers, ICT service providers, all with EU customer touchpoints. If you operate in the EU, assume in-scope.
PCI DSS 4.0.1 Req 5.4.1 — Effective March 2025
Every organization storing, processing, or transmitting cardholder data must implement automated anti-phishing controls. DMARC + SPF + DKIM + MTA-STS are named example implementations.
DORA — Effective January 2025
DORA (Digital Operational Resilience Act) requires financial entities to maintain ICT risk management including monitoring of ICT third-party providers. Domain and DNS infrastructure sit squarely in this scope.
What DomainScan Does for Each Requirement
| Framework | Requirement | DomainScan capability |
|---|---|---|
| NIS2 | SPF deployment | SPF checker + continuous monitoring |
| NIS2 | DKIM deployment | DKIM lookup + continuous verification |
| NIS2 | DMARC deployment | DMARC lookup + p=reject journey tracking |
| NIS2 | MTA-STS deployment | MTA-STS glossary — audit + verify |
| NIS2 | DANE deployment | DANE + TLSA guide — TLSA records validated |
| PCI DSS 4.0.1 5.4.1 | Anti-phishing controls | DMARC p=reject enforcement + evidence |
| DORA | ICT third-party monitoring | Continuous scan of every hosted service, DNS provider, CA |
The Fintech Domain Attack Surface
Beyond the mainstream root domain, fintech operates:
- Customer portals — banking UI, trading UI, wallet UI (SSL, headers, DMARC)
- Partner APIs — inter-bank, payment processor, KYC vendors (SSL, cert pinning, DANE)
- Executive lookalikes — attackers register
yourbank-transfers.com,ceo-yourbank.io, etc. — typosquat monitoring - Compliance domains —
disclosures.yourbank.com,legal.yourbank.com— SSL uptime is regulatory - Support / help-center — phishing target (“your account has been suspended”)
- Marketing subdomains — deliverability of legitimate mail (customer notifications, statements, alerts)
DomainScan tracks every one in one dashboard.
The Audit Evidence Layer
Every DomainScan check runs continuously and logs the result. Export as a compliance report showing:
- SPF/DKIM/DMARC status per domain, per date
- MTA-STS policy publication and validity
- DANE TLSA records active and rotated
- SSL certs and rotation history
- Blacklist listings (and remediation)
- Every alert, timestamped, with the remediation applied
Ready for your QSA. Ready for your NIS2 audit. Ready for the DORA regulator’s ICT risk review.
Related
Read what DMARC is, the MTA-STS glossary entry, and the DANE + TLSA deep dive.