Testing for payment, banking and fintech APIs.
Money-moving systems fail in specific ways: duplicate charges, reconciliation drift, payday traffic, and third-party APIs that time out at the worst moment. That's where I focus testing.
Test evidence for DORA, PSD2 and UK operational resilience
DORA
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies from 17 January 2025. Article 25 lists test types for the resilience testing programme, including performance testing, end-to-end testing and scenario-based tests. Performance, load and end-to-end test reports from Assertwise can serve as evidence within that programme.
PSD2 & open banking
Under the RTS on strong customer authentication and secure communication (Delegated Regulation (EU) 2018/389), an ASPSP's dedicated interface must offer the same availability and performance as its customer interface. I test Berlin Group NextGenPSD2 and UK Open Banking style APIs for functional correctness, consent flows, error handling and performance under load.
UK operational resilience
UK firms are outside DORA but work under the FCA and PRA operational resilience rules: important business services, impact tolerances and scenario testing, with full compliance required from 31 March 2025. Load and failure-scenario tests can produce evidence for that scenario testing.
Assertwise provides testing, not legal or compliance advice. I don't certify DORA or PSD2 compliance and I don't perform threat-led penetration testing (TLPT). Your compliance function decides how test evidence is used.
Failure modes specific to money movement
Idempotency & duplicates
Concurrent retries with the same Idempotency-Key, client timeouts followed by retries, replayed webhooks. Goal: one payment, one ledger entry, whatever the network does.
Race conditions on balances
Parallel debits against the same account, double-spend attempts, lost updates. Tested with synchronised concurrent requests, not just sequential scripts.
Reconciliation
Do your ledger, PSP reports and bank statements agree after a test run with failures and retries injected? Mismatches are reported per transaction.
Payday & month-end peaks
Workload models built from your traffic: salary days, month-end batch runs, card-scheme cut-offs, campaign launches. Arrival-rate load tests, not just concurrent users.
Third-party dependencies
PSP, KYC and banking-partner APIs that slow down or fail. Timeouts, circuit breakers and retry storms tested against stubs and sandboxes.
API security
Object-level authorisation across customers and accounts, token handling, rate limiting and excessive data exposure, mapped to the OWASP API Security Top 10.
Shipping a payments feature or a banking integration?
Start with the free check-up: short written findings on your API, no load against production.
Related reading: Idempotency and race conditions in payment APIs