FSI Compliance Checker
Map a concrete change (code diff, architecture design, IaC, pipeline config) to the specific controls it touches in financial services compliance frameworks, and report gaps with actionable remediation. This is engineering-level compliance triage — it helps teams catch violations before audit, but it does not replace a qualified assessor (QSA) or the institution's compliance function. Say so in every report.
Framework Selection
Load only the reference file(s) the engagement needs:
| Situation |
Load |
| Payment card data is stored, processed, or transmitted (PAN, CVV, track data) |
references/pci-dss.md |
| Singapore-regulated financial institution (bank, insurer, capital markets, major payment institution) |
references/mas-trm.md |
| Both apply (e.g. Singapore bank handling cards) |
Both files |
| Other jurisdictions/frameworks (SOX, GDPR, HKMA, APRA) |
State that they are out of scope of this skill's bundled references; offer general secure-engineering review instead |
If the user hasn't said which applies, ask one question: what data does the change touch, and is the institution Singapore-regulated?
Review Process
- Scope the change. Identify what the diff/design actually touches: data elements (card data? customer PII? credentials?), trust boundaries, environments (production? DR?), and third parties.
- Select applicable controls from the loaded reference file(s) — typically 5-15 controls, not the whole framework. List what you ruled out and why (one line each) so the scoping is auditable.
- Assess each applicable control against the change:
Compliant / Gap / Needs evidence (can't tell from the artifact — name the evidence required).
- Write findings using the report format below. Every Gap gets: the control ID, what's wrong in this specific change, concrete remediation, and severity (Critical = violation involving live regulated data; High = control absent; Medium = control partial/undocumented).
- Recommend story conversion: offer to turn findings into backlog items (via the security-story-writing skill if available) with the control ID in each story for traceability.
Report Format
# Compliance Review: [change title]
**Frameworks:** [PCI-DSS v4.0 / MAS TRM 2021] · **Date:** [YYYY-MM-DD]
**Scope:** [what was reviewed: files, design doc, pipeline]
> Engineering triage only — not a substitute for QSA assessment or the compliance function.
## Data & Boundary Analysis
- Data elements touched: [e.g. PAN (masked), customer NRIC, none]
- Environments/boundaries: [e.g. CDE-adjacent service, public API]
## Findings
| # | Control | Status | Severity | Finding | Remediation |
|---|---------|--------|----------|---------|-------------|
| 1 | [PCI 3.5.1] | Gap | Critical | [specific issue in this change] | [specific fix] |
## Ruled Out (not applicable)
- [Control area] — [one-line reason]
## Evidence Needed
- [Control]: [what artifact would demonstrate compliance]
Common FSI Engineering Triggers
Changes that almost always have compliance impact — check these proactively when they appear in a diff:
- Logging statements near payment or authentication flows (PAN/CVV must never be logged; MAS TRM requires security event logging — both directions matter)
- New data stores or caches receiving customer or card data (encryption at rest, retention, residency)
- Authentication/session changes (MFA requirements, session timeout, credential storage)
- New third-party SDKs or API integrations (outsourcing/vendor controls, data flows leaving the boundary)
- Infrastructure changes touching network segmentation, security groups, or public exposure
- CI/CD changes that alter who/what can deploy to production (change management, segregation of duties)
Guidelines
- Cite control IDs precisely (e.g. "PCI-DSS 8.3.6", "MAS TRM 9.1.1") so findings are traceable in audit tooling; the reference files carry the ID schemes.
- Severity discipline: don't inflate. A missing comment is not a Critical; unencrypted PAN at rest is.
- When the change is compliant, say so affirmatively per control — "no findings" plus the checked-control list is a useful audit artifact.
- Never output real card numbers, even as examples; use the standard test PANs (e.g. 4111 1111 1111 1111) when illustrating.
1---2name: fsi-compliance-checker-23description: Maps code, architecture, and infrastructure changes to specific control IDs in financial services compliance frameworks - PCI-DSS v4.0 for payment card data and MAS TRM for Singapore-regulated institutions - producing an audit-traceable findings report with per-control remediation. Use this instead of a general security review whenever a compliance framework (PCI-DSS, MAS TRM), regulator, audit, or cardholder-data scope is mentioned, even if the request is phrased as a code review or a yes/no compliance question. Triggers on: "PCI-DSS check", "MAS TRM", "is this compliant", "compliance review", "audit this change for banking regulations", "does logging this violate PCI", "cardholder data handling review".4license: MIT5---67# FSI Compliance Checker89Map a concrete change (code diff, architecture design, IaC, pipeline config) to the specific controls it touches in financial services compliance frameworks, and report gaps with actionable remediation. This is engineering-level compliance triage — it helps teams catch violations before audit, but it does not replace a qualified assessor (QSA) or the institution's compliance function. Say so in every report.1011## Framework Selection1213Load only the reference file(s) the engagement needs:1415| Situation | Load |16|-----------|------|17| Payment card data is stored, processed, or transmitted (PAN, CVV, track data) | [references/pci-dss.md](references/pci-dss.md) |18| Singapore-regulated financial institution (bank, insurer, capital markets, major payment institution) | [references/mas-trm.md](references/mas-trm.md) |19| Both apply (e.g. Singapore bank handling cards) | Both files |20| Other jurisdictions/frameworks (SOX, GDPR, HKMA, APRA) | State that they are out of scope of this skill's bundled references; offer general secure-engineering review instead |2122If the user hasn't said which applies, ask one question: what data does the change touch, and is the institution Singapore-regulated?2324## Review Process25261. **Scope the change.** Identify what the diff/design actually touches: data elements (card data? customer PII? credentials?), trust boundaries, environments (production? DR?), and third parties.272. **Select applicable controls** from the loaded reference file(s) — typically 5-15 controls, not the whole framework. List what you ruled out and why (one line each) so the scoping is auditable.283. **Assess each applicable control** against the change: `Compliant` / `Gap` / `Needs evidence` (can't tell from the artifact — name the evidence required).294. **Write findings** using the report format below. Every Gap gets: the control ID, what's wrong in this specific change, concrete remediation, and severity (Critical = violation involving live regulated data; High = control absent; Medium = control partial/undocumented).305. **Recommend story conversion**: offer to turn findings into backlog items (via the security-story-writing skill if available) with the control ID in each story for traceability.3132## Report Format3334```markdown35# Compliance Review: [change title]36**Frameworks:** [PCI-DSS v4.0 / MAS TRM 2021] · **Date:** [YYYY-MM-DD]37**Scope:** [what was reviewed: files, design doc, pipeline]38> Engineering triage only — not a substitute for QSA assessment or the compliance function.3940## Data & Boundary Analysis41- Data elements touched: [e.g. PAN (masked), customer NRIC, none]42- Environments/boundaries: [e.g. CDE-adjacent service, public API]4344## Findings45| # | Control | Status | Severity | Finding | Remediation |46|---|---------|--------|----------|---------|-------------|47| 1 | [PCI 3.5.1] | Gap | Critical | [specific issue in this change] | [specific fix] |4849## Ruled Out (not applicable)50- [Control area] — [one-line reason]5152## Evidence Needed53- [Control]: [what artifact would demonstrate compliance]54```5556## Common FSI Engineering Triggers5758Changes that almost always have compliance impact — check these proactively when they appear in a diff:5960- Logging statements near payment or authentication flows (PAN/CVV must never be logged; MAS TRM requires security event logging — both directions matter)61- New data stores or caches receiving customer or card data (encryption at rest, retention, residency)62- Authentication/session changes (MFA requirements, session timeout, credential storage)63- New third-party SDKs or API integrations (outsourcing/vendor controls, data flows leaving the boundary)64- Infrastructure changes touching network segmentation, security groups, or public exposure65- CI/CD changes that alter who/what can deploy to production (change management, segregation of duties)6667## Guidelines6869- Cite control IDs precisely (e.g. "PCI-DSS 8.3.6", "MAS TRM 9.1.1") so findings are traceable in audit tooling; the reference files carry the ID schemes.70- Severity discipline: don't inflate. A missing comment is not a Critical; unencrypted PAN at rest is.71- When the change is compliant, say so affirmatively per control — "no findings" plus the checked-control list is a useful audit artifact.72- Never output real card numbers, even as examples; use the standard test PANs (e.g. 4111 1111 1111 1111) when illustrating.
timwukp