By CertiK service
For each security service, see which jurisdictions trigger it and how attractive each market is right now.
Penetration Testing
← back to all servicesTop markets for Penetration Testing
| Country | Region | Lead regulator | Maturity | Next deadline | Days | Score |
|---|---|---|---|---|---|---|
| BR — Brazil | LATAM | BCB | High | 2026-10-30 | 155 | 82.9 |
| DE — Germany | EU | Bundestag | High | — | — | 63.4 |
| HK — Hong Kong | APAC | SFC | High | — | — | 63.4 |
| GB — United Kingdom | EU | FCA | High | 2027-10-25 | 515 | 63.2 |
| SG — Singapore | APAC | MAS | High | — | — | 60.6 |
| FR — France | EU | Parlement | High | — | — | 57.7 |
| AE — United Arab Emirates | MENA | CBUAE | Medium | — | — | 56.8 |
| AR — Argentina | LATAM | BCRA | Medium | — | — | 56.8 |
| TR — Türkiye | MENA | null | Medium | — | — | 56.8 |
| US — United States | NA | IRS | Medium | — | — | 51.0 |
| CA — Canada | NA | null | High | — | — | 49.1 |
| IT — Italy | EU | Parlamento Italiano | Medium | — | — | 48.2 |
| ZA — South Africa | Africa | SARS | Medium | — | — | 48.2 |
| JP — Japan | APAC | FSA | Medium | — | — | 45.3 |
| UY — Uruguay | LATAM | Parlamento | Medium | — | — | 45.3 |
| CH — Switzerland | EU | FINMA | Medium | — | — | 42.5 |
Norms that trigger Penetration Testing
The regulation requires a license for virtual currency business activities involving New York or its residents. This includes transmitting, custodying, buying, selling, exchanging, or issuing virtual currency.
This statute governs the secondary trading of securities in the U.S. It establishes registration and reporting requirements for exchanges, brokers, dealers, and issuers.
This bill proposes a regulatory framework for digital assets, splitting jurisdiction between the CFTC for digital commodities and the SEC for investment-contract assets. It regulates exchanges, brokers, and dealers.
This law establishes a federal licensing framework for payment stablecoin issuers, known as Permitted Payment Stablecoin Issuers (PPSIs). It mandates 1:1 reserves, monthly public reserve reporting, and par value redemption.
This guidance expands the scope for licensed Virtual Asset Trading Platforms (VATPs), permitting new products like tokenized securities and stablecoins, staking, and shared global liquidity.
This document proposes a comprehensive licensing and regulatory framework for centralized virtual asset trading platforms operating in or marketing to Hong Kong. It covers requirements for custody, AML/CFT, token admission, and introduces investor protection measures to allow access for retail investors.
This ordinance establishes a mandatory licensing regime for issuers of specified stablecoins in Hong Kong. It also regulates the offering, advertising, and fraudulent activities related to these assets.
This rulebook establishes comprehensive compliance, risk management, and AML/CFT obligations for entities licensed by VARA. It includes specific rules for handling client money and client virtual assets.
This regulation establishes a licensing and registration framework for payment token (stablecoin) services in the UAE. It covers issuance, custody, and conversion, distinguishing between AED-backed tokens (licensed) and foreign currency-backed tokens (registered).
This law establishes the Virtual Assets Regulatory Authority (VARA) and a mandatory licensing regime for Virtual Asset Service Providers (VASPs) in Dubai, excluding the DIFC.
This act adapts Swiss federal law for DLT, creating ledger-based securities (register value rights) and a new license category for DLT trading facilities. It also clarifies the segregation of crypto-assets in bankruptcy.
This decree implements the EU's Alternative Investment Fund Managers Directive (AIFMD) into Italian law. It regulates the authorization, operation, and supervision of managers of alternative investment funds (AIFs).
This law establishes the general framework for financial instruments and intermediaries in Italy. It applies to crypto-assets that qualify as financial instruments (security tokens), subjecting them to licensing and conduct rules.
This decree implements the EU's MiCA regulation in Italy. It designates CONSOB and the Bank of Italy as the competent national authorities for supervising crypto-asset services and issuers.
The act requires Payment Service Providers (PSPs) to register with the Bank of Canada. Supervision focuses on operational risk management, incident response, and safeguarding end-user funds.
This guidance outlines the registration regime for Crypto Asset Trading Platforms (CTPs) operating in Canada. All CTPs, including foreign platforms serving Canadians, must register with securities regulators and adhere to investor protection conditions.
Requires licensed and provisional CASPs to submit operational and risk data. The request covers AML, custody, stablecoins, reserves, consumer protection, and cross-border activity.
This is a proposed regulation for Virtual Asset Service Providers (PSAVF). It establishes a prior authorization regime with minimum capital, guarantee, cybersecurity, custody, and AML requirements.
This law establishes a registration regime for the public offering of securities in Uruguay, supervised by the Superintendency of Financial Services (SSF). It was updated to explicitly cover securities issued on DLT, treating them as a form of book-entry security.
This act applies when a digital token is classified as a capital markets product, such as a security or derivative. It regulates market operators, clearing facilities, and capital markets services licensees.
This notice sets technology risk management requirements for licensed digital payment token service providers. It focuses on system reliability, availability, and the protection of customer information.
This framework applies to single-currency stablecoins (SCS) issued in Singapore and pegged to the Singapore Dollar or any G10 currency. It establishes requirements for reserve assets, capital, redemption, and disclosure.
This regulation establishes an authorization regime for UK payment institutions. It sets out operational, safeguarding, and conduct of business requirements for payment services, which can include those related to e-money tokens.
This regulation establishes an authorization and prudential supervision regime for electronic money issuers. It applies to fiat-referenced crypto-tokens if they meet the legal definition of e-money.
This guidance clarifies rules for communicating or approving financial promotions for qualifying cryptoassets in the UK. It focuses on ensuring promotions are fair, clear, and not misleading, covering various models like stablecoins and yield products.
This consultation paper proposes rules for the issuance of qualifying stablecoins and the custody of qualifying cryptoassets in the UK.
This consultation paper proposes prudential rules and guidance for issuing qualifying stablecoins and safeguarding qualifying cryptoassets in the UK.
This regulation establishes a mandatory registration regime for Virtual Asset Service Providers (VASPs) in Argentina. It imposes comprehensive duties including AML, cybersecurity, asset segregation, and public proof-of-reserves.
This regulation establishes a comprehensive framework for digital operational resilience in the EU financial sector. It sets harmonized rules for ICT risk management, incident reporting, resilience testing, and managing ICT third-party risk.
This act is the German implementation of MiFID II. It governs the trading of securities, including security tokens, and establishes rules for market conduct, market abuse, and organizational requirements for investment firms.
This act establishes the prudential and licensing framework for investment firms in Germany. It includes specific provisions for firms providing crypto-asset services, such as qualified crypto custody.
This law governs the management, administration, and distribution of investment funds (UCITS and AIFs) in Germany. It sets out authorization and operational requirements for fund managers and depositaries.
This act implements the EU's MiCA regulation in Germany, designating BaFin as the competent authority. It defines supervisory powers, authorization procedures, and transitional rules for existing crypto service providers.
This is an umbrella law implementing the EU's MiCA, TFR, and DORA regulations in Germany. It creates the KMAG (Crypto Markets Supervision Act) and amends various existing financial laws.
This is Germany's primary Banking Act, which defines crypto-assets (Kryptowerte) and establishes a licensing regime for financial services. It specifically regulates crypto-asset custody (Kryptoverwahrgeschäft) as a licensed activity.
This act regulates payment services and e-money business in Germany. It establishes a licensing and supervision framework for payment and e-money institutions, which applies to crypto-asset models that fall under these definitions.
This resolution establishes a licensing framework for Virtual Asset Service Providers (VASPs) in Brazil. It defines VASP categories, operational rules, governance, and asset segregation requirements.
This norm details the requirements for a mandatory technical certification by an independent firm. This certification is a prerequisite for entities seeking to provide crypto-asset intermediation and custody services in Brazil.
This 2004 instruction establishes the general rules for the constitution, administration, operation, and registration of traditional investment funds in Brazil. It does not apply to specific fund types like private equity or real estate funds.
This resolution mandates internal audit activities for various financial institutions. An amendment will extend these requirements to virtual asset service providers (VASPs) starting in March 2026.
This rule regulates public offerings of securities by small businesses through online investment crowdfunding platforms. It establishes an authorization regime for the platforms and a registration exemption for the offerings.
This regulation establishes the Brazilian instant payment system, Pix. It defines the rules, participants, governance, and operational framework for 24/7 real-time fund transfers.
This law establishes a licensing framework for Virtual Asset Service Providers (VASPs) in Brazil. It also criminalizes fraud involving virtual assets and subjects VASPs to national AML/CFT regulations.
This regulation governs the process for public offerings of securities in Brazil's primary and secondary markets. It establishes the registration requirements with the CVM to ensure investor protection through disclosure.
This resolution establishes a mandatory cybersecurity policy for payment institutions and other regulated entities, including virtual asset service providers from 2026. It details requirements for risk management, incident response, and contracting cloud services.
This resolution establishes a cybersecurity policy and requirements for contracting cloud computing services for financial institutions. It mandates risk management, incident response plans, and specific security controls.
This law created the French legal framework for Digital Asset Service Providers (PSAN). It defines digital assets and establishes a dual regime of mandatory registration and optional licensing for various crypto-asset services.
This ordinance adapts the French Monetary and Financial Code to the EU's MiCA regulation. It establishes the legal framework for the MiCA licensing regime in France and sets a transitional period for existing registered providers (PSANs).
The regulation establishes a registration system for Electronic Payment Service Providers, which offer payment initiation and account information aggregation services. It mandates contracts with banks and measures for user data security.
This act establishes a foundational framework for payment services in Japan. It defines 'Crypto Asset' and creates a registration regime for Crypto Asset Exchange Service Providers (CAESPs) under the Financial Services Agency (FSA).
This act establishes the licensing, operational, and supervisory framework for banks in Japan. It also regulates related entities like bank holding companies, bank agents, and electronic payment service providers.
This law establishes a comprehensive licensing and supervision framework for Crypto-Asset Service Providers (CASPs) in Türkiye. It empowers the Capital Markets Board to regulate their activities, with technical criteria for IT systems set by TÜBİTAK.
This law establishes a licensing framework for payment institutions and electronic money institutions in Turkey. It regulates payment services, systems, and the issuance of electronic money.