SOC 2 for fintech
Fintech startups selling to US businesses usually get SOC 2 requests. If you store, process or transmit cardholder data, PCI DSS applies too.
What the sources say
- SOC 2 is commonly the first request from US enterprise buyers; PCI DSS comes into play if you store, process or transmit credit card data. [source]
- PCI DSS is maintained by the PCI Security Standards Council and applies to entities that store, process or transmit cardholder data. [source]
Platforms that list PCI DSS
| Platform | Published frameworks |
|---|---|
| Secureframe | SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR, CCPA, CMMC 2.0, SOX ITGC, CIS and more; 1 framework in Fundamentals/Complete (more as add-ons)source |
| Thoropass | SOC 1, SOC 2, ISO 27001, PCI DSS, HIPAA, HITRUST, NIST CSF 2.0, CMMC Level 1, GDPR, Cyber Essentials and moresource |
| Delve | SOC 2, HIPAA, GDPR, ISO 27001, PCI DSS, HITRUST, FedRAMP, ISO 42001, NIST AI RMFsource |
Based on each vendor's cited framework page. A platform missing here may still support PCI DSS, so ask the vendor.
Other industries: SOC 2 for HealthtechSOC 2 for AI startups · SOC 2 vs ISO 27001
Frequently asked questions
Does a fintech need SOC 2?
It is not a law, but sources describe it as the common expectation when selling to US enterprises and partners.
Does SOC 2 cover PCI DSS?
No. PCI DSS is a separate standard with its own assessment. Controls overlap and can be mapped across both.
Which compliance platforms list PCI DSS?
Among platforms we track, published framework lists mentioning PCI DSS: Secureframe, Thoropass, Delve. Others may support it without listing it on the pages we cite.
Last verified 2026-10-16. Not legal advice.