Does using Ostorlab make us compliant with DORA or the ECB letter?

No tool does that on its own. These rules ask for a programme: governance, testing, remediation and reporting. Ostorlab supports the testing part for your mobile apps and the APIs behind them, and gives you evidence you can reuse from one release to the next. Your compliance team decides how it fits your obligations.

Do these rules apply to banks outside their region?

The ECB letter applies to the significant institutions the ECB supervises directly, DORA to financial entities in the EU, and the CBUAE rules to institutions licensed in the UAE. A group with entities in several of these places can be subject to more than one.

Which regulation should we start with?

The one with the nearest date. For significant institutions, that is the ECB action plan due on 31 October 2026. DORA's testing rules already apply, and the timing for Notice 2176 depends on what your copy of it sets. The same app and API testing supports all three.

Which apps should we test first?

Start with the apps your customers use to log in, pay and manage their accounts, since these usually support critical or important functions. You can scan a store app for free first to see the kind of findings you get.

Can we try it on our own app?

Yes. Search for your app on the App Store or Google Play and run a free, fast scan on ostorlab.co, with no login required. For logged-in flows and API testing, book a demo and we will set up a full scan with you.

Where is our data stored?

Ostorlab is SOC 2 Type II audited. On the Enterprise plan you can choose data residency in the United States, the European Union, the GCC or Asia-Pacific, or run scans on-premises. Details are in the Trust Center.

Bank regulators want proof that your apps hold up.

Supervisors from Frankfurt to Riyadh, Singapore and New York now expect banks to test their mobile apps and APIs often, behind login, and to prove each fix. Here is what each regulator asks, in plain words and with the official sources, and how Ostorlab supports the testing part.

EU: DORA testing rules, and the ECB action plan due 31 October 2026
Middle East: UAE, Saudi Arabia, Qatar, Kuwait and Jordan
Asia: Pakistan, Bangladesh, Japan, Singapore and Indonesia
Americas: United States and Brazil, plus Ukraine in Europe

Scan your own app Book a demo

Free scan of your app from the App Store or Google Play. No login required.

Regulations

Start with the three most asked-about

Each page sums up what the regulation asks, links to the official text, and maps Ostorlab's testing to it.

These pages sum up public texts to help you plan testing. They are not legal advice. Ostorlab supports your testing obligations; it does not make you compliant on its own, so check how it fits with your compliance team.

By country

Bank regulations where Ostorlab works

One page per regulator, each built from the official texts: what they ask of your mobile app and its APIs, how Ostorlab helps with the testing, and what stays with you.

European Union and Europe

Middle East

Africa

South Asia

Asia-Pacific

Americas

Side by side

Three regimes, compared

Who each one applies to, what it asks you to test, and where Ostorlab supports the testing part.

	ECB letter on AI-enabled cyber threats	DORA	CBUAE rules and Notice 2176
Issued by	ECB Banking Supervision	European Parliament and Council, with Commission technical standards	Central Bank of the UAE
Legal nature	Supervisory letter built on DORA, not a new regulation	EU regulation, directly applicable in every Member State	Federal law, regulations, standards and guidelines, plus Notice 2176, which is not public
Who it applies to	Significant institutions, the banks the ECB supervises directly	EU financial entities, including banks, payment and e-money institutions	Licensed financial institutions in the UAE, with some rules for specific licences
Key date or cadence	Action plan to the Joint Supervisory Team by 31 October 2026	Applies since 17 January 2025: weekly scans, yearly tests, TLPT every 3 years if identified	Decree-Law in force since 16 September 2025; quarterly reporting of vulnerabilities
Testing it asks for	Prioritised vulnerability scanning at scale, AI-based tools under human oversight, security by design	Vulnerability scans, static and dynamic code testing, penetration and end-to-end testing, TLPT	Vulnerability assessments, code review, business-logic testing, yearly independent API testing
What it means for mobile apps	Mobile apps and their APIs are internet-facing assets and internally developed software	Apps supporting critical or important functions need weekly automated scans and security testing before release	Authentication, step-up checks, sessions and device protections are fraud controls to test
Where Ostorlab helps	Baseline, remediation and retest evidence for the application part of the plan	Static, dynamic and AI-agent testing, dependency tracking, remediation tracking, groundwork for TLPT	Shielding bypass tests, logged-in testing, API testing and evidence for each release

Common thread

What the three have in common

Different regulators, the same four expectations for the apps your customers use.

Test more often
Weekly automated scans under DORA, scanning at scale in the ECB letter, regular assessments in the UAE: a yearly pentest alone no longer covers it.
Test what customers really use
The store build, behind login, with the APIs and SDKs it depends on, not a debug build with protections turned off.
Prove the fix
Findings are prioritised, remedied and validated, and the record shows it, for auditors and supervisors.
Stay in control of data and AI
AI tools under human oversight, vendors you can audit, and data kept where your policies require.

Ostorlab supports your testing obligations. Decisions on compliance stay with your teams. This is not legal advice.

Trusted by banks and fintechs, including