ISO 27001 readiness for FX, prop trading and fintech brokers
Your broker is not a normal SaaS company. Stop preparing for ISO 27001 like one.
Client money workflows, KYC documents, trading accounts, partner portals, IB networks, PSP integrations, withdrawal controls, admin permissions, vendor exposure, and audit pressure from every direction. A generic template pack will not understand that.
Kellwick prepares FX brokers for ISO 27001 with readiness reviews, evidence mapping and gap remediation built around how broker operations actually work. Just a clear answer to one brutal question: can your broker prove control when someone asks?
CySEC-regulated? DORA is in enforcement - see broker readiness →
Your real environment
Nine systems. Each one creates access, data, change, supplier and evidence risk. One evidence map, or nine blind spots.
Explore the systems →Every broker says the same thing. Access is handled. KYC is handled. Withdrawals are handled. Vendor access is handled. Client data is handled. Fine. Show the evidence.
That is where weak readiness shows up. Not in the policy. In the proof.
Regulatory - DORA
The Digital Operational Resilience Act has applied to EU financial entities - including CySEC-regulated brokers - since 17 January 2025, and supervisors are now actively checking. ISO 27001 is a strong foundation, but it is not DORA. The gap is where the regulator looks: incident-reporting timelines, an ICT third-party register, and mandatory resilience testing. Certification proves your controls exist. DORA asks whether you can report, test and recover under real supervision.
Pillar 01
A governed framework for identifying, protecting, detecting and recovering ICT systems - board-owned, documented and tested, not just an IT checklist.
Pillar 02
Classifying ICT-related incidents and reporting major ones to your regulator inside strict timelines. ISO 27001 asks you to manage incidents; DORA dictates when and how you report them.
Pillar 03
A programme of resilience testing - from vulnerability assessments to scenario-based tests - proving you can keep operating through disruption, not just that controls exist on paper.
Pillar 04
A register of ICT providers with contractual, monitoring and exit requirements. Your PSPs, cloud, liquidity and platform vendors are in scope - concentration risk included.
Pillar 05
Where you take part in threat-intelligence sharing, the governance and safeguards around it are in place and documented - not improvised.
| Area | ISO 27001 | DORA |
|---|---|---|
| Nature | Voluntary certification against a standard. | Binding EU regulation for financial entities. |
| Incident reporting | Manage and learn from incidents. | Classify and report major ICT incidents to the regulator within set deadlines. |
| Resilience testing | Recommended; scope is yours to define. | Mandatory testing programme, with threat-led testing for significant entities. |
| Third-party risk | Supplier controls in Annex A. | Prescribed ICT third-party register, contract terms, monitoring and exit plans. |
| Enforcement | Certificate withdrawn by the certification body. | Supervisory action by your competent authority - a licence matter. |
FX audit risk is operational
Most ISO 27001 prep treats a broker like a clean SaaS app with a simple user table. It is not. Each layer creates access, data, change, supplier and evidence risk.
Trading platform
A policy can say access is reviewed. That means nothing if:
That is not readiness. That is exposure with nicer formatting.
Broker readiness check
If the answer is not clear, you are not ready. You are hoping.
What actually blocks a certification - or a regulator
These are the blockers we find most often. None of them are exotic - which is exactly why they are missed until an auditor is in the room. The same gaps fail ISO 27001 Stage 1 and leave you exposed under DORA.
We do not guarantee outcomes and we are not a certification body. What we do is find these before the auditor does - while there is still time to fix them cheaply.
Not ready for a full review?
Start with a 2-day Mini Gap Review.
Scoped and priced on a short call. We hand back your top Stage 1 blockers and the single next step that matters most.
What we check
Who has access to what, why, and when it was last reviewed.
Where client data lives, who can access it, and how it moves.
Who touches your environment or client data.
How critical changes get approved, tested, released and recorded.
Can your team show what happened, who responded and what changed after.
Can leadership prove the ISMS is reviewed, funded and improved.
What you receive
A direct view of your current ISO 27001 readiness.
A practical evidence map built around broker systems and ISO 27001 expectations.
A ranked list of issues that can hurt readiness. No academic noise, no fake maturity model.
A short execution plan for the next 2-6 weeks.
A direct walkthrough with your team: what is weak, what is defensible, what needs action before audit pressure starts.
FX evidence map preview
| Area | Evidence expected | Common broker gap | Kellwick output |
|---|---|---|---|
| Trading platform access | MT4 / MT5 admin access review | Manager access shared, no review | Owned access list + review cadence |
| KYC documents | Access trail + retention evidence | Files in shared drive, no log | Controlled KYC access trail |
| PSP integration | Vendor review + access owners | Shared logins, no supplier review | Tiered vendor review + owners |
| Withdrawals | Change approval trail | Support changes settings, no approval | Approval workflow evidence |
| IB portal | Role docs + change approvals | Terms changed with no record | Documented IB roles + change log |
| Leavers | Timely access removal proof | Ex-staff retain tool access | Joiner / mover / leaver evidence |
The regulatory picture
ISO 27001 readiness has moved from a differentiator to a prerequisite. The pressure is not only from auditors. It is coming from regulators, counterparties and infrastructure providers simultaneously - and the evidence base that satisfies ISO 27001 is the same base that answers most of their questions.
CySEC-regulated Cyprus Investment Firms are subject to ongoing ICT and cybersecurity obligations under the Investment Services and Activities and Regulated Markets Law and associated circulars. CySEC expects firms to maintain documented information security frameworks, conduct regular risk assessments and demonstrate that access to client data and critical systems is controlled and reviewable. ISO 27001 readiness directly maps to these expectations: access reviews, incident records, supplier risk assessments and change control are exactly what examiners look for. A firm that can produce broker-specific ISO 27001 evidence is in a materially stronger position during a CySEC inspection or thematic review.
DORA applies to EU financial entities and their critical ICT third-party providers from January 2025. It introduces binding requirements across five pillars: ICT risk management, ICT-related incident classification and reporting, digital operational resilience testing, ICT third-party risk management and information sharing. The overlap with ISO 27001 controls is substantial. ICT risk management under DORA maps directly to ISO 27001 risk treatment. Third-party ICT provider risk management mirrors Annex A supplier controls. Incident reporting timelines require exactly the kind of incident records ISO 27001 demands. Firms with mature ISO 27001 evidence are not starting from zero on DORA - they have the operational foundation already in place.
MiFID II requires investment firms to maintain adequate operational resilience and to keep records that allow regulators to verify compliance with conduct and organisational requirements. This includes records of orders, transactions, client instructions and communications - all of which depend on controlled, auditable access to systems. ISO 27001 controls for access management, change control and information classification provide the underlying evidence layer that makes MiFID II record-keeping defensible. Weak access control over back-office systems is both an ISO 27001 gap and a MiFID II operational risk.
Liquidity providers and correspondent banks have tightened third-party risk requirements. In practice, ISO 27001 certification - or demonstrable readiness for it - is increasingly a condition of onboarding or maintaining a relationship. This is driven by their own regulatory obligations: banks subject to DORA and banking supervisory expectations must conduct due diligence on the operational resilience of their counterparties. An FX broker that cannot show controlled access to client data, a functioning incident process and documented vendor risk introduces a risk exposure that LPs and banks are not willing to carry. ISO 27001 readiness is the clearest signal that these controls exist and can be verified.
ISO 27001 readiness as a unified evidence base.
The evidence that satisfies an ISO 27001 auditor - access reviews, change approvals, incident records, supplier assessments, risk treatment decisions - is the same evidence a CySEC examiner, a DORA ICT risk assessment, a MiFID II compliance review and an LP due diligence questionnaire will ask for. Building this evidence base once, built around actual broker operations, is more efficient and more defensible than maintaining separate responses for each audience.
Before Kellwick
Nobody has one evidence map. That is the problem.
After Kellwick
No guessing.
Typical starting points
Final pricing is confirmed after a readiness call.
Scoped on a call
FX brokers and trading firms that need a fast external view before certification, surveillance, customer review or board pressure.
Scoped on a call
Firms preparing seriously for ISO 27001 certification or surveillance.
Scoped on a call
Teams that need support through remediation, audit preparation and evidence improvement.
This is for you if
This is not for you if
Why Kellwick
Kellwick is built for practical ISO 27001 readiness in high-risk technology environments. We understand SaaS, fintech, product operations, security, delivery, and the operational pressure inside broker environments.
ISO 27001 is not only about policies. It is about how access, data, vendors, changes, incidents and ownership work in the real company. FX firms need readiness support that understands the business model, not just the standard.
Independent advisory for regulated technology teams
Fixed-scope, evidence-based delivery, with a clear separation from certification bodies. We prepare you for the audit; we do not run it.
Kellwick is an independent advisory practice, not a certification body.
FAQ
No. Kellwick does not issue ISO 27001 certificates. Certification comes from an accredited certification body. Kellwick helps you prepare before that stage.
No. Nobody serious should guarantee that. We reduce avoidable audit risk by finding weak evidence, unclear ownership and missing control proof before the audit.
No. We support your team with structure, review, evidence mapping and readiness planning. Control ownership should stay inside the company.
Usually no. Most readiness work starts with documents, screenshots, exports, access review evidence, system owner input and structured interviews. Sensitive access should stay controlled.
No. It works for companies preparing for first certification, surveillance audit, customer security review or internal readiness pressure.
That is common. Weak documents are fixable. The bigger issue is weak evidence - that is what we find and map.
From the blog
Evidence, access control and operational risk for regulated trading firms.
A backup that has never been restored is a hope, not a control. Here is what auditors actually want to see for continuity and recovery.
Read →Credit & Collections GRCRegulators and ISO 27001 auditors both want to see the same things when it comes to DSAR handling and data retention in credit and collections: an audit trail, a working schedule, and destruction evidence. This guide covers what that looks like in practice.
Read →Supplier RiskGame providers, KYC engines, and payment aggregators all sit in the supplier risk perimeter of an iGaming ISMS. This guide covers how to classify critical vendors, set a due-diligence cadence, and produce the evidence an auditor expects.
Read →Not ready to talk?
Start with the evidence checklist - a practical list of what ISO 27001 expects from a broker, mapped to the controls auditors check first.
Certification is issued by accredited certification bodies; DORA supervision is performed by regulators. Kellwick prepares you for these processes; it does not perform them and cannot guarantee their outcome.
Find the gaps before the auditor, bank, PSP, customer or board does.
Kellwick is an independent advisory practice. We are not a certification body and do not issue ISO certifications. Certification decisions are made only by accredited certification bodies.