One ungoverned open-source component in a payment stack. Three financial consequences.
The risk is the same everywhere. The regulatory consequence depends on which markets you operate in.
PCI DSS 4.0: Serious or unresolved noncompliance can lead to contractual penalties or loss of card-processing privileges — the primary revenue mechanism for payment platforms, lending software, and FinTech infrastructure.
EU DORA: In force January 2025. Article 9 requires financial entities to protect and manage ICT systems, protocols and tools. Non-conformity can bring supervisory action by EBA, ESMA, or EIOPA.
EU CRA: CRA reporting begins September 11, 2026 — early warning within 24 hours. Full product conformity applies December 11, 2027. Non-conformity carries up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
X-DLM™ governs the open-source risk once. The evidence satisfies all three.
and
Three regulatory consequences. One root cause. One program that governs it.
One governed workflow — Black Duck and Siemens Polarion connected by X-DLM™ — produces the PCI DSS 6.3.2 software inventory, DORA ICT evidence, EU CRA vulnerability disclosure records, and SOC 2 change control documentation simultaneously.
PCI DSS consequence: serious or unresolved noncompliance can lead to contractual penalties or loss of card-processing privileges. For a payment platform, wallet, or lending FinTech, that is the primary revenue mechanism going offline.
EU DORA non-conformity consequence: supervisory action and public naming by EBA, ESMA, or EIOPA. For FinTechs competing on trust in financial markets, public regulatory action is a material business event.
EU CRA maximum non-conformity penalty: up to €15 million or 2.5% of worldwide annual turnover, whichever is higher. Continued non-conformity can also put EU market access at risk.
Sources: PCI DSS v4.0. EU DORA Regulation (EU) 2022/2554. EU CRA Regulation (EU) 2024/2847.
The board question is the same across all three frameworks: is any single consequence acceptable?
- 01
PCI DSS 4.0 — card-processing privileges at stake, not a fine
PCI DSS is not a regulatory fine framework. Serious or unresolved PCI DSS noncompliance can lead to contractual penalties or loss of card-processing privileges. For a payment platform, wallet provider, or Buy Now Pay Later lender, that is the primary revenue mechanism going offline. PCI DSS 6.3.2 requires an inventory of bespoke and custom software and its third-party components. Black Duck produces it. X-DLM™ keeps it current and links every component to Polarion release governance.
- 02
EU DORA — supervisory action and public naming, in force January 2025
DORA applies to financial entities within its defined scope — banks, payment institutions, electronic money institutions, investment firms, and crypto asset service providers — and oversees designated critical ICT providers. It entered into force January 17, 2025 — not a future deadline. Article 9 requires financial entities to protect and manage ICT systems, protocols and tools, including ICT supply chain risk from third-party software dependencies. Non-conformity can produce supervisory action and public naming by EBA, ESMA, or EIOPA. For FinTechs raising capital or expanding enterprise sales, public supervisory action is a material due diligence flag.
- 03
EU CRA — reporting from September 2026, full conformity December 2027
FinTech software products sold in the EU are Products with Digital Elements under EU CRA — payment platforms, lending engines, crypto wallets, RegTech systems. CRA reporting begins September 11, 2026: early warning within 24 hours, vulnerability notification within 72 hours, and a 14-day final report. Full product conformity applies December 11, 2027. Non-conformity penalty: up to €15 million or 2.5% of worldwide annual turnover, whichever is higher.
- 04
Board risk register — three line items, one source
The open-source component that triggers any one of these consequences is the same component — ungoverned in your payment stack. X-DLM™ governs it once. The evidence it produces satisfies all three frameworks and holds up in any investor or acquirer due diligence process.
See how Siemens Polarion and Black Duck become one governed software risk workflow.
X-DLM™ turns Black Duck software supply chain intelligence into Siemens Polarion work items, requirements links, approvals, escalation paths, and continuously maintained evidence.
Brand authority buyers recognize
Backed by Siemens lifecycle governance and Black Duck AppSec intelligence.
Siemens Polarion ALM
Polarion provides the lifecycle system of record for requirements, tests, approvals, traceability, workflow automation, audit evidence, and regulated software delivery.
Black Duck Software Composition Analysis
Black Duck identifies open source and third-party components across source, binaries, containers, firmware, snippets, AI-generated code, and C/C++ environments without package managers.
FinTech companies answer to more than one framework — simultaneously.
PCI DSS 4.0 is the floor, not the ceiling. EU DORA, EU CRA, FAPI 2.0, MiCA, SOC 2 Type II, and NIST SSDF run in parallel — each with its own evidence requirements, its own deadline, and its own consequence for missing components.
View PCI DSS, DORA & All Regulations →Turn software risk evidence into FinTech trust.
Download the brochure or book a discovery call to see how X-DLM™ connects Siemens Polarion and Black Duck for governed software supply chain evidence.