Your situation
You develop applications in the financial sector and want to demonstrate their security level through certification according to BSI TR-03174? As a recognised evaluation facility, we support you from the pre-evaluation to the evaluation in the BSI procedure.
Free of charge and without obligation.
Your situation
Data in financial applications such as payment or online banking apps requires particular protection. Since the beginning of 2025, the BSI TR-03174 “Requirements for applications in the financial sector” has been available for this purpose. It is relevant for banks and service providers in the banking sector, focuses on mobile use and covers mobile applications, web applications and background systems.
The Technical Guideline can be used in two ways: as a specification already during the planning and implementation of new apps or updates, or as the basis for certification by the BSI, which manufacturers can apply for if they wish. The evaluation is carried out by an authorised evaluation facility.
We are recognised by the BSI as a TR-03174 evaluation facility and bring experience from the “sister guideline” TR-03161 for health applications, for which certification has been mandatory since 2025.
Services & results
A quick check tells you in advance to what extent your financial application meets TR-03174. An evaluation facility recognised by the BSI then evaluates the mobile application, web application and background systems for your certification procedure and supports you in communicating with the BSI – with experience from TR-03161 for health applications.
Whether you use TR-03174 as a development specification or are aiming for certification: we evaluate the app, web application and background systems against the requirements of the Technical Guideline.
In the quick check, we assess in advance to what extent your financial application meets the requirements of BSI TR-03174. Your development team can close identified gaps before the certification evaluation – or take them into account from the start for new apps and updates.
As a recognised evaluation facility, we carry out the required evaluation of the defined components – mobile application, web application and background systems – and document the results for the certification procedure.
We support you in communicating with the BSI until certification is obtained. The BSI decides on the certificate.
secuvera is recognised by the BSI as an evaluation facility for TR-03174. The Technical Guideline is the “sister guideline” of TR-03161 for health applications, according to which we have already evaluated applications that the BSI subsequently certified, such as the DiGA (digital health application) “kontina” with iOS and Android app and backend.
In addition, there is our penetration testing team, which is certified by the BSI as an IT security service provider for IS penetration testing and tests mobile apps for Android and iOS according to the OWASP Mobile Application Security Testing Guide (MASTG).
Getting started
Describe the financial application, its mobile or web-based components and the backends. We discuss the development status, existing evaluations and the evidence you want.
Depending on maturity, a quick check before the actual evaluation can help. We then agree on documents, access, the evaluation object and the further procedure.
The evaluation relates to the agreed evaluation object. The decision on certification is made by the BSI.
It is aimed at manufacturers of applications in the financial sector and their development service providers. What matters is the specific application and the desired security evidence goal. We discuss the mobile, web-based and associated backend components.
When you want to assess, before the certification evaluation, how far the requirements are met and which points are still open. An early comparison can reveal rework needed in development. It does not replace the later evaluation in the certification procedure.
Existing tests and technical documents help to understand the starting point. Whether they cover the requirements for the defined TR-03174 evaluation object must be checked specifically. An earlier pentest does not automatically replace the required evaluation.
secuvera supports the technical communication on evaluation scope and results. Your development team provides the necessary product information and makes any required adjustments. The decision on the TR-03174 certificate is made by the BSI.
Certification by the BSI takes place at the request of the manufacturer. TR-03174 can also serve as a specification for planning, development and updates without certification. We support both routes, for example with a quick check.
