ISO 27001, SOC 2 & Capital Markets Compliance Standards
Talk to an Expert

Accreditations

To deliver, without pause, the highest value to the firms that run the world’s markets – innovation that answers a real business need, engineered to the standard the regulator expects, and held to the data protection obligations of every jurisdiction we operate in. Certification is not the finish line. It is the floor we build on.

Certification

Independently audited. Annually re-tested.

Our controls are examined by external auditors against internationally recognised frameworks – not self-attested.

ISO/IEC 27001:2022 Certified

Information security management

SOC 2 Type II Certified

Operating effectiveness over time

Industry recognition

Awarded for the work, not the pitch.

Recognition from capital-markets industry bodies and technology juries across post-trade transformation, corporate actions, onboarding and applied AI.

01

2025

Best Post-Trade Transformation System

02

2024 · 2022 · 2021 · 2020

Best Corporate Actions Solution

03

2022

Best Family Office Solution & CEO

04

2021

Best Client Onboarding & Client Portal

05

2021

Global AI Fintech 100

06

2021

Best Buy-Side CRM Platform

Regulatory alignment

Global standards. Local rulebooks.

A platform that clears and settles in ten markets cannot be compliant in the abstract. NOVA CMX is engineered to the international standards that make markets interoperable, and configured to the specific rulebook of each market it runs in.

Global standards

The frameworks that let markets talk to each other

Built once against the standards, configured per client, so a change in one market does not become a rebuild everywhere else.

  • ISO 20022 - native messaging across payments, settlement and reporting
  • SWIFT MT and MX message families, end to end
  • FIX for order, execution and allocation flow
  • T+1 and T+0 settlement cycles, market by market
  • CPMI-IOSCO principles for financial market infrastructures
  • ISO/IEC 27001 and SOC 2 control frameworks

Local supervision

Configured to each regulator's rulebook

Reporting formats, retention rules, client-money segregation and outsourcing obligations differ by jurisdiction. They are configuration in NOVA CMX, not custom code.

  • Singapore - MAS technology risk management and outsourcing guidelines
  • Malaysia - Securities Commission and Bursa Malaysia requirements
  • Hong Kong - SFC electronic trading and record-keeping rules
  • Australia - ASIC market integrity rules and ASX / CHESS operating rules
  • Indonesia - OJK and IDX reporting obligations
  • United Kingdom - FCA conduct, CASS and operational resilience

Data protection

Client data stays where the law says it stays

Data residency, retention and subject rights are enforced by the platform - deployment model and hosting region are your decision, in your cloud or ours.

  • GDPR and UK GDPR - lawful basis, minimisation, subject rights
  • Singapore PDPA and Malaysia PDPA
  • Hong Kong PDPO and Australia Privacy Act / APPs
  • Indonesia PDP Law No. 27 of 2022
  • In-region hosting and configurable data residency
  • Encryption in transit and at rest; key management under client control

How we hold the line

Compliance as an operating discipline.

The practices behind the certificates – what we do between audits.

01

Secure by design

Threat modelling, code review and dependency scanning sit in the delivery pipeline. Security is a release gate, not a post-release patch.

02

Independent testing

Annual penetration tests and continuous vulnerability scanning by external parties, with remediation tracked to closure.

03

Full auditability

Every trade, amendment and instruction carries an immutable audit trail with user, timestamp and reason, ready for the regulator's question before it is asked.

04

Resilience tested

Documented recovery objectives, rehearsed failover and 99.99% platform uptime - evidenced, not asserted.

Capital markets - engineered

Running due diligence on us?

Send your vendor risk questionnaire, control matrix or regulatory checklist. We will respond with evidence, and our SOC 2 report under NDA.
Request our Documentation
Architecture & Deployment

Stay ahead of what's next

Sign up for our monthly newsletter for insights, trends and updates shaping the future of post-trade and capital markets.
You can unsubscribe any time.