Payment service providers (PSPs) and acquiring banks are under growing pressure to prove that their technology vendors are secure. White-label payment gateway and orchestration platform provider Akurateco has obtained ISO/IEC 27001:2022 certification, the international standard for information security management systems (ISMS). The certificate was issued by an independent, accredited certification body following an external audit.
ISO/IEC 27001:2022 alongside PCI DSS Level 1
The certification covers Akurateco’s payment software platform operations and adds to its existing PCI DSS Level 1 compliance. While PCI DSS sets requirements for protecting cardholder data, ISO/IEC 27001:2022 assesses how an organisation manages information security across its certified scope, including risk assessment, access control, supplier management, incident response, and business continuity.
Andrew Riabchuk, founder and CTO of Akurateco, said clients run their payment businesses on the company’s infrastructure, so security is built into how the platform is developed and operated. He added that PCI DSS Level 1 shows how Akurateco protects card data, while ISO/IEC 27001:2022 confirms through an independent audit that the same approach applies to risk management, access control, suppliers, and incident response.
Supporting vendor due diligence under DORA
Since January 2025, the EU’s Digital Operational Resilience Act (DORA) has required credit institutions, payment institutions, and other financial entities to carry out due diligence on ICT providers before contracting them and to monitor those providers throughout the relationship. Supervisors in other markets apply similar scrutiny. Accredited certification gives risk, procurement, and compliance teams verifiable evidence during vendor reviews, which can shorten security assessments and request-for-proposal processes.
Anastasiia Brener, Chief Commercial Officer at Akurateco, said almost every PSP and acquiring bank the company works with now runs a detailed vendor security assessment before signing, and the certification gives their teams independent evidence from the start. The certification is maintained through annual surveillance audits and is registered in IAF CertSearch, while clients can request supporting security documentation under a non-disclosure agreement as part of due diligence.
