PSD2, SCA and DORA: What Fintechs Actually Have to Prove When They Move Payments to a Hyperscaler

PSD2, its strong customer authentication rules, the EBA outsourcing guidelines, and DORA do not prohibit fintechs from hosting payment systems on public clouds such as AWS, Google Cloud, Azure, or Scaleway; instead, they require firms to retain accountability and demonstrate control over security, outsourcing, resilience, and exit arrangements. Strong customer authentication depends on two independent factors, dynamic linking of payments to a specific amount and payee, protected authentication data, and sound key-management and audit-log practices rather than on-premise infrastructure. DORA, effective from January 2025, adds requirements for ICT risk management, third-party provider registers, incident reporting, resilience testing, concentration-risk management, and documented, tested exit plans for critical services. The article argues that cloud portability is most difficult for proprietary managed services such as event streams, serverless runtimes, and identity systems, while containers, Kubernetes, and infrastructure-as-code can support more credible migration and recovery exercises. It presents bring-your-own-cloud approaches, including Qovery’s platform, as a way to keep contracts, data, encryption keys, logs, and operational control in the fintech’s own account, while emphasizing that such arrangements do not themselves deliver compliance or remove the firm’s responsibility for governance, reporting, testing, and oversight.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.