When a major bank evaluates a third-party payments infrastructure provider, technology capability is rarely the first filter. The first filter is trust. And in the world of regulated financial institutions, trust is not established by a sales conversation or a product demonstration. It is established by evidence.
SOC 2 Type 2 attestation is one of the most important pieces of that evidence. Understanding what it means — and why it matters specifically in the context of a payments platform — is increasingly important for both the institutions that require it and the technology providers that seek it.
What SOC 2 Type 2 actually certifies
SOC 2 is a framework developed by the American Institute of Certified Public Accountants (AICPA) that evaluates a service organisation's controls against a set of Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
The distinction between Type 1 and Type 2 is significant. Type 1 attests that controls are suitably designed at a point in time. Type 2 attests that those controls operated effectively over a sustained period — typically six to twelve months. For a financial institution evaluating a third-party platform, Type 2 is the meaningful standard. It answers a different question: not "do they have controls?" but "do their controls actually work, consistently, over time?"
Cymonz received SOC 2 Type 2 attestation in January 2026, following an independent audit by Sensiba covering September through November 2025. The audit concluded that our controls were suitably designed and operated effectively throughout the review period.
Why it matters for major bank partners specifically
Banks operate under regulatory obligations that extend to their third-party relationships. Under frameworks like APRA's CPS 234 in Australia, the FCA's operational resilience rules in the UK, and equivalent regimes across most developed markets, financial institutions are responsible for ensuring that their critical technology providers meet defined security and resilience standards.
This means that when a bank deploys a third-party payments platform, its risk and compliance teams need to be able to demonstrate — to their own board, and to their regulator — that the provider has been assessed against appropriate standards. SOC 2 Type 2 provides a standardised, independently verified basis for that assessment.
Without it, the due diligence burden falls on the bank itself: commissioning its own security assessments, reviewing documentation, and making judgements without the benefit of independent verification. That's a slower, more expensive process — and it's one that many institutions will not undertake for a provider that cannot offer a recognised attestation.
What it signals beyond the certificate
The value of SOC 2 Type 2 is not just the certificate. It's what achieving and maintaining it signals about how a company operates.
The process requires a company to document its controls comprehensively, test them rigorously, and subject them to independent scrutiny. It requires a culture of accountability — where security and operational integrity are treated as ongoing operational priorities, not annual compliance exercises.
For a payments platform handling real money across regulated jurisdictions, that culture matters as much as the technology. The institutions that trust us with their payments infrastructure need to know that when something goes wrong — as it occasionally will in any complex system — there are clear escalation paths, documented incident response procedures, and a team that takes its obligations seriously.
SOC 2 Type 2 is one way we demonstrate that. It won't be the last.
What to look for when evaluating platforms
For institutions evaluating payments infrastructure providers, attestation status is a necessary but not sufficient condition. The questions to ask beyond "do you have SOC 2 Type 2?" include: what period does the audit cover, and how recent is it? What was the scope — all five trust service categories, or a subset? What did the auditor identify as areas for improvement, and what has been done about them? And critically: what is the governance framework for maintaining those controls between audit cycles?
A provider that can answer those questions clearly, with documentation, is a provider whose security posture is worth trusting. One that responds to security due diligence with a single certificate and no further detail is a provider that treats attestation as a sales credential rather than an operational commitment.
The distinction matters. And the institutions that take security seriously are increasingly good at telling the difference.