Compliance Overview

Drop Compliance Status

Last updated: 2026-03-1002-13 Source: legal/ directory (16 regulatory docs)documents), docs/SECURITY-COMPLIANCE/security/ directory (85 detailedsecurity framework docs)documents), legal/drop-gap-analysis-v2.md

Detailed compliance documentation: See, docs/SECURITY-COMPLIANCE/legal/drop-regulatory-map-v2.md for the full regulatory framework, DORA self-assessment, data encryption policy, and other documents required for Finanstilsynet PI licence application.

---

Overall Compliance Readiness: ~30/8/100

Drop is an MVP-stage application using a PSD2 pass-through model (AISP reads bank balances via Open Banking,balances, PISP initiates payments from user's bank — Drop never holds customer money).

SinceRegulatory Febcompliance 2026:is BankIDnot OIDCexpected integratedat (SCA),this Sumsubstage, KYC live, DORAbut documentation completed,is securitybeing hardeningprepared. completedCards (0are Critical/Higha remaining),FUTURE CSRFfeature, andgated rate-limitingbehind middlewarefeature added, SCA audit trail deployed.flags.

---

Regulatory Framework

Applicable Regulations

Regulation	Norwegian Law	Relevance	Status
PSD2	Betalingstjenesteloven (LOV-2018-11-23-85)	Core —-- payment services	~35% readyregulation
AML/KYC	Hvitvaskingsloven (LOV-2018-06-01-23)	Core —-- anti-money laundering	~35% ready
GDPR	Personopplysningsloven (LOV-2018-06-15-38)	Core —-- personal data	~25% readyprotection
ICT Security	IKT-forskriften / DORA (EU) 2022/2554	Required for financial entities	~30% readyenterprises
Financial Enterprise	Finansforetaksloven (LOV-2015-04-10-17)	Licensing and governance	0% ready
Currency Registry	Valutaregisterloven (LOV-2004-12-17-109)	Cross-border payment reporting	0% ready
Consumer Protection	Finansavtaleloven (LOV-2020-12-18-146)	UserTerms and user rights	Partial

Source: legal/drop-regulatory-map-v2.md, docs/SECURITY-COMPLIANCE/compliance-framework.md §1md:1-80

---

Compliance Readiness by Area

1. Licensing (~15%0% ready)

Source: legal/drop-gap-analysis-v2.md:31-50

Requirement	Status	NotesGap
Finanstilsynet PI licencelicense	Not applied	PATHFULL A (aggregator) + PATH B (own licence) plannedGAP
Client fund safeguarding	N/ANot —applicable pass-through model(demo)	NoFULL wallet, no float heldGAP
Initial capital (20K-125K EUR)	Not secured	€50–125KFULL needed for PATH BGAP
Business plan	DraftExists completeas draft	legal/virksomhetsplan.mdPARTIAL
DORAAgent self-assessmentarrangement	CompleteNone	docs/SECURITY-COMPLIANCE/dora-self-assessment.mdFULL GAP

Recommended path: Agent model under Tink/Aiialicensed licencePSP (4–81-3 weeks)months) +while ownpreparing PIfull licencelicense inapplication parallel.(6-12 See project/FASTEST-PATH-TO-PRODUCTION.mdmonths).

2. PSD2 / SCA (~35%10% ready)

Source: legal/drop-gap-analysis-v2.md:53-78

Requirement	Status	Code Reference
Strong Customer Authentication	NOT IMPLEMENTED	No BankID, email+password only
BankID integration	NOT IMPLEMENTED	Mentioned in architecture, not in code
Dynamic linking	NOT IMPLEMENTED	No amount+payee tied to auth
Open Banking AISP/PISP	NOT IMPLEMENTED	Balance is local, not from bank
Framework agreement	PARTIAL	Landing page has vilkar.html
Fee transparency pre-auth	PARTIAL	Fee shown in API after submission
Session management	IMPLEMENTED	lib/auth.ts, lib/middleware.ts

3. AML/KYC (5% ready)

Requirement	Status	Code / Document
Strong Customer Authentication (BankID OIDC)	Implemented	src/drop-api/src/lib/bankid.ts, src/drop-api/src/routes/auth.ts
Dynamic linking (amount + payee tied to auth)	Partial	Consent model in place; PISP flow pending live partner
Open Banking AISP/PISP	Architecture complete	Awaiting aggregator partner (Tink/Aiia)
Framework agreement	Draft	legal/brukervilkar.md
Fee transparency pre-authorisation	Partial	Shown in payment confirmation screen
Session management	Implemented	src/drop-api/src/lib/auth.ts, httpOnly JWT
SCA audit trail	Implemented	Migration 010 — sca_events table

3. AML/KYC (~35% ready)

Requirement	Status	NotesGap
Customer identification (eIDAS High via BankID)	ImplementedMock only	BankIDAuto-approve national ID verified
KYC verification (Sumsub)	Production	src/drop-api/src/lib/services/ — Sumsub adapter live
Transaction monitoring	PartialNOT IMPLEMENTED	ConsentNo andmonitoring audit logging in place; automated alerts TBDsystem
Suspicious activity reporting	NotNOT implementedIMPLEMENTED	No SAR procedures documented (legal/hvitvaskingsrutiner.md), tooling Phase 2capability
AML riskRisk assessment	Document exists	legal/risikovurdering-hvitvasking.md
AML procedures	Document exists	legal/hvitvaskingsrutiner.md

4. GDPR (~25%15% ready)

beforelive

Requirement	Status	Document
Privacy notice (Norwegian)	DraftEXISTS (draft)	legal/personvernerklaering.md
DPIA	DraftEXISTS (draft)	legal/dpia-vurdering.md, docs/SECURITY-COMPLIANCE/data-protection-impact-assessment.md
Terms of service	DraftEXISTS (draft)	legal/brukervilkar.md
Data retention — cron job	Implemented	src/drop-app/src/app/api/cron/retention/route.ts
PII encryption at rest	Implemented	src/shared/crypto/pii-encryption.ts, KMS-backed
Processing register	NotNOT createdCREATED	legal/behandlingsprotokoll.md — Phase 2--
DPO appointment	NotNOT doneDONE	Required--
Data retention policy	NOT DEFINED	--
Consent management	PartialNOT IMPLEMENTED	Consent model in DB (consents table)
Right to erasure / portability	Not built	Phase 2--

5. ICT Security / DORA (~30%25% ready)

Full assessment:Source: docs/SECURITY-COMPLIANCE/dora-self-assessment.mdsecurity/security-rapport-2026-02-12.md:187-188 — overall maturity 1.1/3

EXISTS IN

Requirement	Status	EvidenceDocument/Code
Security policy (IKT-sikkerhetspolicy)	DraftEXISTS (draft)	legal/ikt-sikkerhetspolicy.md
BCPIncident + BIA (DORA Art. 11)handling	Draft	legal/beredskapsplan.md §2
Incident handling procedures	Draft(draft)	legal/hendelseshaandtering.md
DORABusiness annual self-assessmentcontinuity	CompleteEXISTS (draft)	docs/SECURITY-COMPLIANCE/dora-self-assessment.legal/beredskapsplan.md
DORAOutsourcing follow-up procedures (FP-01 to FP-T09)policy	DocumentedEXISTS (draft)	docs/SECURITY-COMPLIANCE/compliance-framework.legal/utkontraktering-policy.md §11.5
EncryptionSecurity policyaudit	CompleteCOMPLETED	docs/SECURITY-COMPLIANCE/data-encryption-policy.security/drop-security-rapport.md
Penetration testing	NOT DONE	--
Security hardening	Complete	0 Critical/High findings remaining
CSRF protection	ImplementedPROGRESS	src/drop-api/src/middleware/csrf.tssecurity/security-hardening-implementation.md
Rate limiting	Implemented	src/drop-api/src/middleware/rate-limit.ts
Penetration test	Not done	Required before licence submission (GAP-DORA-01)
SIEM / security monitoring	Planned	CloudWatch + Sentry — Phase 2
DR environment + BCP drill	Not done	Phase 2 (GAP-DORA-02)

---

Security Audit Summary

Initial audit:Date: 2026-02-12 —Source: security/drop-security-rapport.md

Before Hardening

• 4 CRITICAL, 5 HIGH, 6 MEDIUM, 4 Critical,LOW 5findings
High,

6

After Medium, 4 Low Post-hardeningHardening (2026-02-13):

0 Critical, 0 High, 2 Medium, 4 Low

Latest hardening review:Source: docs/security/audits/security-hardening-implementation.md

Key remediations completed:

• 0 CRITICAL (all resolved)
• 0 HIGH (all resolved)
• 2 MEDIUM remaining (CSP tightening, proxy config)
• 4 LOW (acknowledged, out of scope)

Key Remediations Completed

1. C1 -- Card data: Schema now stores only last_four +and token_ref stored (no PAN/CVV)
2. C2 -- Demo credentialscredentials: gatedGated behind NODE_ENV !== 'production'
3. C4 -- SHA-256 passwordspasswords: removed;Removed entirely, bcrypt only
4. C6/H1 -- Session revocationrevocation: implementedImplemented and active
5. H4 -- Input sanitizationsanitization: appliedApplied to all text fields
6. CSRFM5 tokens-- enforcedNotification onIDs: state-mutatingValidated routes(max 100, format check)
7. httpOnlyM6 +-- SecureSettings: +Currency/language SameSitevalidated cookiesagainst on JWTwhitelists

---

DORA Significant Gaps (for Finanstilsynet disclosure)

Gap	DORA Reference	Severity	Target
No live pen test or VA completed	Art. 24(2)	High	Before launch
DR environment not built; BCP drill not conducted	Art. 11(6)	High	Phase 2
ICT risk register tooling not operational	Art. 6(1)	Medium	Phase 2
Third-party risk assessments incomplete (BankID, OB partner)	Art. 28(4)	Medium	Before launch
SIEM not live	Art. 10(1)	Medium	Phase 2

Full gap list: docs/SECURITY-COMPLIANCE/dora-self-assessment.md §5

---

Legal Documents Inventory

Location: ~/ALAI/products/Drop/legal/

Document	File	Status
Privacy notice	personvernerklaering.md	Draft
DPIA assessment	dpia-vurdering.md	Draft
Terms of service	brukervilkar.md	Draft
AML procedures	hvitvaskingsrutiner.md	Draft
AML risk assessment	risikovurdering-hvitvasking.md	Draft
ICT security policy	ikt-sikkerhetspolicy.md	Draft
Incident handling	hendelseshaandtering.md	Draft
Business continuity + BIA	beredskapsplan.md	Draft
Outsourcing policy	utkontraktering-policy.md	Draft
Internal control	internkontroll.md	Draft
Suitability assessment	egnethetsvurdering.md	Draft
Complaint handling	klagebehandling.md	Draft
Licensing preparation	konsesjonssoknad-forberedelse.md	Draft
Business plan	virksomhetsplan.md	Draft
Gap analysis v2	drop-gap-analysis-v2.md	Complete
Regulatory map v2	drop-regulatory-map-v2.md	Complete

---

Security Documents Inventory

Location: ~/ALAI/products/Drop/security/

Document	File	Status
Security audit rapport	drop-security-rapport.md	Complete (2026-02-12)
Gap analysis	gap-analysis.md	Complete (2026-02-12)
Hardening checklist	hardening-checklist.md	In progress
Hardening implementation	security-hardening-implementation.md	Complete (2026-02-13)
Formal assessment	security-rapport-2026-02-12.md	Complete (2026-02-12)

---

Remediation Phases

Phase 1 —-- BeforeCurrent PISprint Licence(in Submissionprogress)

Security

• fixes, Externalarchitecture penetrationcleanup, test (fullsuite, scope)
•  Vulnerability assessment
•  Incident response tabletop exercise
•  Vendor risk assessments (BankID + Open Banking partner)
•  Audit rights in all critical vendor contracts
•  DPO appointment
•  Board ICT risk review

CI/CD.

Phase 2 —-- WithinBanking 6Integration Months(pending ofpartner Licence Grantselection)

BankID,

• Open DRBanking environmentAISP/PISP, buildreal andKYC, test
PostgreSQL
•  BCP/DR drill
•  ICT risk register tooling
•  Production SIEM (CloudWatch + Sentry)
•  Per-vendor exit strategies (6 critical vendors)
•  Automated patch management

migration.

Phase 3 —-- OngoingProduction Launch (post-licence)after Phase 2 + follow-up audit)

Audit

• Annuallogging, ICTerror riskhandling, self-assessmentmonitoring, (DORAstaging Art.environment, 6(8))
load
• Annualtesting, external penetration test
• Quarterly vulnerability assessments
• TLPT within 3 years of licence grant

test.

Source: docs/SECURITY-COMPLIANCE/dora-self-assessment.md §6security/security-rapport-2026-02-12.md:196-220