Preparation of the Platform for Regulatory Audit

Client:

Mid-sized fintech company

Industry:

FinTech

Focus:

Testing of the KYC module and compliance with AML/KYC, GDPR, and PCI DSS

Main challenge:

Verification reliability testing, and preparation for a regulatory audit

Market:

International – EU and Eastern Europe

Services provided:

API, web, and mobile application pentest (Gray-Box)

Key Takeaways

The risk of KYC bypass was reduced from high to low.

A rate limit and an AI module for deepfake detection were implemented.

A Gray-box pentest of web and mobile applications, KYC, and API was conducted.

12 vulnerabilities were identified: 3 critical, 5 medium, and 4 low.

Critical threats were eliminated in less than 72 hours.

vulnerabilities identified

80%

increase in attack resilience

hours to eliminate threats

Preparation of the Platform for Regulatory Audit

Oct 19, 2025

3 min

The company recorded suspicious attempts to bypass KYC and turned to Datami to verify the reliability of document verification before the regulatory audit. During the pentest, 12 vulnerabilities were identified and eliminated – the platform achieved full compliance with fintech security standards.

The fintech company operates in the international market of the EU and Eastern Europe, providing users with a platform for online payments and digital wallets.

The security of KYC processes is critically important, as the business handles large volumes of personal and financial data and must comply with GDPR, PCI DSS, and AML/KYC standards.

Tasks and challenges

Before undergoing a regulatory audit, the company recorded suspicious attempts to bypass KYC, which could have caused data theft or money laundering.

To verify the reliability of document verification and the protection of personal data, it turned to Datami for comprehensive security testing.

To check the possibility of bypassing KYC through forged documents or photos.
To conduct a Gray-box pentest of the KYC backend API, mobile, and web application.
To provide a report with PoC and recommendations for conformity to security standards.

Verification testing

KYC module testing: documents, selfies and videos (replay, deepfake, biometrics)

Vulnerability discovery

Gray-box pentest of backend API, web and mobile applications for threats

Compliance with standards

PoC report with risk descriptions and technical recommendations for AML, GDPR and PCI DSS

Our approach

To assess the resilience of verification processes, Datami specialists conducted a targeted review of the KYC module: they examined the architecture, test accounts, and APIs using a Gray-box approach.

For this case study, they used automated scanners and manual testing: OCR analysis, deepfake simulations, authorization, and API logic testing using Burp Suite, MobSF, and custom scripts.

Gray-Box

Penetration testing with limited access to test accounts and documentation for realistic attack modeling.

Key stages of work and solutions

To avoid disrupting platform users, Datami specialists worked in a clear sequence. After agreeing on key details, they carried out automated and manual testing.

Based on the assessment results, the client received a detailed PoC report with evidence of vulnerabilities, risk levels, and technical recommendations for compliance with security standards.

Preparation

Analysis of the KYC architecture, agreement on rate limits, creation of test accounts and test data, and planning verification scenarios.
Testing

Scanning the API, web, and mobile applications, manual modeling of KYC bypasses using forged documents, and verification of API logic.
PoC report

Preparation of a report describing vulnerabilities, evidence of their exploitation, and technical recommendations to improve security.

Results and recommendations

During the fintech platform pentest, the Datami team identified 12 vulnerabilities in the KYC module: 3 critical, 5 medium, and 4 low. The most serious issues – document reuse, lack of rate limiting in the KYC API, and weak video verification – were fixed within 72 hours.

Following the cybersecurity assessment, the client received recommendations to:

conduct an annual KYC audit;
implement document uniqueness verification;
maintain API rate limiting;
update security policies;
use AI modules for deepfake detection.

After implementing the updates, the risk of fraud decreased from high to low, and system resilience increased by 80%. The platform achieved full compliance with AML/KYC, GDPR, and PCI DSS standards, avoiding fines and a negative audit outcome.

Key project results

For fintech companies, cybersecurity assessment is extremely important, as vulnerabilities can lead to serious losses: data leaks, fines, theft, or money laundering.

As this case study demonstrates, the pentest allowed the client to proactively eliminate threats, enhance attack resilience, and achieve compliance with security standards. Datami’s recommendations helped the fintech company successfully pass the audit and avoid penalties.

Direction

Before the project

After implementation

Risk level

High – possible KYC bypass, document reuse

Low – threats eliminated, processes secured

KYC security

Insufficient control of documents and video verification

Enhanced document verification, an AI module for deepfake detection added

Vulnerabilities

12 identified, including 3 critical

All eliminated

System resilience

Vulnerable to replay attacks and forgeries

Increased by 80%

Standards compliance

Partial

Full compliance with AML/KYC, GDPR, and PCI DSS

Preparing a smart contract for release on Web3

The code was prepared for certification.
The project was secured against 99% of known threats.

Services:

Smart contract audit (White-box source code review)

Sep 16, 2025

Web3 Project Random Walk: Smart Contract Audit

Secure launch on Polygon mainnet ensured within 5 days
Risk level reduced from medium to minimal

Services:

Smart contract audit (White-Box source code analysis)

Sep 2, 2025

Smart Contract Audit of a Web3 Company

The product was prepared for a secure market launch.
The risk was reduced from high to minimal.

Services:

Smart contract audit (White-box source code analysis)

Aug 20, 2025

Back to all cases

Datami articles

Datami Newsroom

Datami Took Part in CV Summit 2025

CV Summit 2025 brought together leaders in fintech, blockchain, and artificial intelligence in Switzerland. The Datami team participated in the global dialogue on how technology is shaping the new financial landscape.

Oct 10, 2025 3 min

Web Applications Penetration Testing: A Pentest Guide

Oleksandr Filipov: Security engineer at Datami, author of articles

Web Applications Penetration Testing: A Pentest Guide

Web applications are targeted by attacks every day - from simple scanners to deliberate breaches. To understand how vulnerable a web application is and how to protect it from hackers’ actions, a special assessment is conducted - penetration testing (pente

Oct 1, 2025

Microsoft enables email bombing protection

Datami Newsroom

Microsoft enables email bombing protection

Microsoft announced a new update to Defender for Office 365 that automatically detects and blocks email bombing attacks. The rollout started in June, and most users will receive the feature by mid-July 2025.

Sep 12, 2025 3 min

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.