Scrutineer · By framework

Financial services compliance software for banks, RIAs and credit unions

Banks, credit unions, RIAs and fintechs answer to several security rules at once, and every examiner wants evidence rather than intentions.

Scrutineer maps your controls to each rule and keeps the proof dated and current, so exam prep stops being a fire drill.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Illustrative sample · not an audit attestation

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with financial services compliance software

One control set, mapped to every regulator you answer to

A bank carries the GLBA Interagency Guidelines, the FFIEC IT handbooks and usually PCI DSS. A New York licensee adds 23 NYCRR Part 500. An RIA adds Regulation S-P. The underlying controls barely differ. Scrutineer maps your control set to each regime once, so a single access review or encryption record satisfies all of them instead of being collected three times.

Evidence dated across the exam period, not screenshotted the week before

Examiners test whether a control operated over time, which is why a folder of fresh screenshots reads badly. Scrutineer pulls proof from your cloud, identity and ticketing systems on a schedule and timestamps it, so the exam file shows a year of operation rather than a week of preparation.

You see the gap before the examiner writes it up

Findings are expensive because they arrive with a deadline attached. Scrutineer flags drifted controls, stale evidence and systems nobody mapped while there is still time to remediate quietly, and shows the CISO and the board the same current view rather than two different ones.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Maps one control set to GLBA, 23 NYCRR Part 500, Regulation S-P, SOX 404 and PCI DSS at the same time
Keeps the written risk assessment every one of those regimes requires, dated and versioned
Tracks MFA and encryption coverage with the written exceptions and who approved them
Runs and evidences the periodic user access review examiners sample first
Maintains the asset inventory Part 500 and the Safeguards Rule both now require
Holds third-party due diligence records for the vendors your regulator asks about
Assembles the exam file and the board reporting pack from the same underlying evidence
Shows which requirements a self-assessment framework such as the CRI Profile or NIST CSF 2.0 leaves open

FINANCIAL SERVICES COMPLIANCE SOFTWARE readiness_report

READINESS · 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Example report layout, not customer data

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Scope reference

Which US financial-sector rule binds you, and which kind of compliance software actually covers it

The phrase "financial services compliance software" is sold by three product categories that do not compete with each other: AML transaction monitoring, regulatory change management, and security and IT controls compliance. Buyers shortlist across all three and end up comparing tools that solve different problems. The last column says plainly which category each rule needs, including the rows where the answer is not us.

Rule	Who it binds	What you have to be able to evidence	Which category covers it
GLBA Interagency Guidelines (12 CFR 30 App B, 208 App D-2, 364 App B, 748 App A)	Banks, thrifts and credit unions, through their prudential regulator.	A written information security program, a risk assessment, access controls, encryption, vendor oversight, response programs and board reporting.	Security and IT controls compliance. This is our row.
FTC Safeguards Rule (16 CFR Part 314)	Non-bank financial institutions: auto dealers, tax preparers, mortgage brokers, collection agencies, some advisers.	The nine elements of 314.4, a named Qualified Individual, MFA, encryption, asset inventory, secure disposal and vendor oversight.	Security and IT controls compliance.
23 NYCRR Part 500 (NYDFS)	Any entity holding a NYDFS license, wherever it is headquartered.	Section-by-section controls, an annual risk assessment, universal MFA, an asset inventory, and the dual-signed April 15 filing.	Security and IT controls compliance.
Regulation S-P, as amended May 16, 2024	Broker-dealers, investment companies, registered investment advisers and transfer agents.	A written incident response program, service provider oversight, 30-day customer notification, a 72-hour service provider notification clause, and records kept to each entity type's own retention period.	Security and IT controls compliance.
SOX 404	SEC filers. 404(b) external audit applies to accelerated and large accelerated filers only.	IT general controls behind financial reporting: access, change management, program development, operations.	Security and IT controls compliance for the ITGC half; a SOX program tool for process and entity-level controls.
PCI DSS 4.0	Anyone storing, processing or transmitting cardholder data. Contractual, not statutory.	The twelve requirements, scoped to the cardholder data environment, with quarterly and annual testing evidence.	Security and IT controls compliance.
BSA/AML (31 CFR Chapter X)	Banks, credit unions, money services businesses, broker-dealers.	Customer due diligence, transaction monitoring, sanctions screening, SAR and CTR filing, and an independent AML audit.	AML platform. Not a controls compliance tool, and not us.
Regulatory change tracking	Any regulated institution tracking rule changes across its regulators.	A record of which rule changed, who assessed the impact, and which policy or control was updated in response.	Regulatory change management and policy library tools. Adjacent to us, not the same product.
FFIEC IT Examination Handbook series	Institutions examined by an FFIEC member agency.	A self-assessment against a recognized framework, plus the underlying control evidence examiners sample.	Security and IT controls compliance, run against NIST CSF 2.0 or the CRI Profile.
SOC 2	Voluntary. Requested by your enterprise customers and sometimes by counterparties.	Operating effectiveness of controls mapped to the Trust Services Criteria over a defined period.	Security and IT controls compliance, plus an accredited CPA firm to issue the report.

Citations and scope are current at August 2026 and are given so you can read the source text rather than take a table on trust. Which rules reach your institution depends on your charter, licenses, filer status and card handling, so confirm your own scope with counsel or your examiner. The category assignments describe where each product type genuinely fits; Scrutineer prepares and maintains evidence and does not perform AML monitoring, issue attestations or make regulatory filings.

Good questions

Questions about financial services compliance software

Financial services compliance software is any tool that helps a bank, credit union, broker-dealer, RIA or fintech prove it meets the rules its regulator enforces. In practice the label covers three unrelated product categories: BSA/AML transaction monitoring, regulatory change management and policy libraries, and security and IT controls compliance. Scrutineer is in the third category. Knowing which one you are shopping for saves a great deal of wasted demo time.

Most banks run several tools rather than one. A typical stack has an AML and sanctions screening platform, a regulatory change management or policy tool, a core-adjacent vendor management system, and a security compliance platform that evidences the GLBA Interagency Guidelines and the FFIEC IT handbooks. They are bought separately because they solve genuinely different problems, and a vendor that claims to do all four usually does one of them well.

The core obligation is section 501(b) of the Gramm-Leach-Bliley Act, implemented through the Interagency Guidelines Establishing Information Security Standards. Those are codified at 12 CFR Part 30 Appendix B for the OCC, 12 CFR Part 208 Appendix D-2 for the Federal Reserve, 12 CFR Part 364 Appendix B for the FDIC, and 12 CFR Part 748 Appendix A for the NCUA. Examiners work from the FFIEC IT Examination Handbook series on top of that.

No, and the distinction decides which rule binds you. The FTC Safeguards Rule at 16 CFR Part 314 covers non-bank financial institutions the Federal Trade Commission supervises, such as auto dealers, tax preparers, mortgage brokers and collection agencies. Banks and credit unions answer instead to their prudential regulator under the Interagency Guidelines. Both implement GLBA, but they are different texts with different enforcement.

The amended Regulation S-P made the case much harder to argue with. Since the amendments adopted May 16, 2024, covered institutions, meaning broker-dealers, investment companies, registered investment advisers and transfer agents, must maintain a written incident response program, oversee service providers, notify affected individuals within 30 days of a breach, and keep supporting records. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, so both dates have now passed.

Nothing official. The FFIEC retired the CAT on August 31, 2025 and deliberately did not name a successor, stating that it does not endorse any particular tool. It pointed institutions toward NIST CSF 2.0, the Cyber Risk Institute Profile, CISA Cybersecurity Performance Goals and the CIS Controls. The FFIEC also said expectations for cybersecurity self-assessments have not changed, so the obligation survived the tool.

No, and it is worth being direct about it. BSA/AML is transaction monitoring, sanctions and watchlist screening, customer due diligence and SAR filing, which is a completely different engineering problem from control mapping and evidence collection. If you need AML, buy an AML platform. Scrutineer covers the security and IT controls side: access, change management, encryption, vendor oversight, risk assessment and exam evidence.

It shortens the part of the exam where you look disorganized. Examiners request evidence by control, over a period, and score you partly on whether the program looks managed. A platform that already holds dated evidence per control, a current asset inventory, completed access reviews and vendor due diligence files turns a three-week scramble into an export. It does not change the findings you have earned, only how quickly you can answer.

Substantially yes on information security. NCUA-insured credit unions fall under 12 CFR Part 748 Appendix A, which is the NCUA version of the same Interagency Guidelines, plus Appendix B for response programs and member notification. The examination framework and the FFIEC handbooks are shared. The practical differences are in scale and in the consumer regulations layered on top, not in the underlying security expectations.

The CRI Profile is a cybersecurity framework the Cyber Risk Institute built specifically for financial institutions. It harmonizes a large body of regulatory requirements into roughly 300 control objectives, aligns to NIST CSF 2.0, and scales its scope by an impact tier so a community bank is not assessed like a global one. Version 2.2, released April 30, 2026, carries 40 mappings to regulatory sources and standards. It is the most common CAT replacement in the sector because it was designed for it.

It applies based on your NYDFS authorization, not your address. A bank headquartered in Ohio that holds a New York license is a covered entity under 23 NYCRR Part 500 and owes the same obligations as a Manhattan institution. If you hold no NYDFS license, Part 500 does not reach you, though the Interagency Guidelines and the FFIEC handbooks still do.

Pricing in this category is quoted, not published, and it usually scales on employee count, entity count and the number of frameworks in scope. Security compliance platforms in the wider market commonly land in the mid five figures annually for a mid-sized institution, with AML platforms priced separately and often higher. Treat any number you read, including ours, as a starting point to confirm with the vendor rather than a quote.

For the IT half, yes, and that is where most of the duplicated work sits. SOX 404 relies on IT general controls, meaning access to programs and data, change management, program development and computer operations. Those are the same controls the Interagency Guidelines, Part 500 and PCI DSS test. The financial reporting controls themselves, the process-level and entity-level ones, still belong in your SOX program rather than in a security platform.

No. Scrutineer prepares and maintains the control mapping and the evidence behind it and shows you where the gaps are. Examinations are conducted by your regulator, attestations are issued by accredited auditors, and any regulatory filing is made and signed by your own officers. We are explicit about that line because the accountability sits with the signers.

Read every compliance and risk question

Keep reading

Guides that go deeper on the rules a financial institution carries

What replaced the FFIEC CAT

The Cybersecurity Assessment Tool retired on August 31, 2025 with no official successor. What the FFIEC actually said, and how the four named alternatives compare.

Read the guide

FTC Safeguards Rule requirements

The nine required elements of 16 CFR 314.4, and exactly which four provisions the under-5,000-consumer exemption covers.

Read the guide

IT general controls explained

The four ITGC domains behind SOX 404, and the evidence an auditor samples in each one.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification