| name | fsi-compliance-checker |
| description | Maps code, architecture, and infrastructure changes to specific control IDs in PCI-DSS v4.0 and MAS TRM (Singapore financial regulator), producing an audit-traceable findings report with per-control remediation. |
| category | security |
| risk | safe |
| source | community |
| source_repo | timwukp/agent-skills-best-practice |
| source_type | community |
| date_added | 2026-06-12 |
| author | timwukp |
| tags | ["compliance","pci-dss","mas-trm","fintech","banking","security-review","audit","financial-services"] |
| tools | ["claude","cursor","gemini","codex","antigravity"] |
| license | MIT |
| license_source | https://github.com/timwukp/agent-skills-best-practice/blob/main/LICENSE |
FSI Compliance Checker
Overview
Maps a concrete change (code diff, architecture design, IaC, pipeline config) to the specific controls it touches in financial services compliance frameworks — PCI-DSS v4.0 for payment card data and MAS TRM for Singapore-regulated institutions — and reports gaps with actionable remediation. This is engineering-level compliance triage: it helps teams catch violations before audit, but it does not replace a qualified assessor (QSA) or the institution's compliance function. Say so in every report.
When to Use This Skill
- Use when a change touches payment card data (PAN, CVV, track data) and needs a PCI-DSS check
- Use when reviewing changes at a Singapore-regulated financial institution against MAS TRM expectations
- Use when someone asks "is this compliant", "does logging this violate PCI", or requests a banking-regulation review of a diff, design, or Terraform change
- Do NOT use for generic security review (no framework involved), GDPR/SOC2/HIPAA (out of bundled scope), or legal advice
How It Works
Step 1: Select the framework
Load only the reference file(s) the engagement needs:
| Situation | Load |
|---|
| Payment card data is stored, processed, or transmitted | pci-dss.md |
| Singapore-regulated financial institution (bank, insurer, capital markets, major payment institution) | mas-trm.md |
| Both apply (e.g. Singapore bank handling cards) | Both files |
| Other jurisdictions/frameworks (SOX, GDPR, HKMA, APRA) | State they are out of scope; offer general secure-engineering review instead |
If the user hasn't said which applies, ask one question: what data does the change touch, and is the institution Singapore-regulated?
Step 2: Scope the change
Identify what the diff/design actually touches: data elements (card data? customer PII? credentials?), trust boundaries, enprojectnments (production? DR?), and third parties.
Step 3: Assess applicable controls
Select the applicable controls from the loaded reference file(s) — typically 5-15 controls, not the whole framework. List what you ruled out and why (one line each) so the scoping is auditable. Assess each as Compliant / Gap / Needs evidence (can't tell from the artifact — name the evidence required).
Step 4: Report
Every Gap gets: the control ID, what's wrong in this specific change, concrete remediation, and severity (Critical = violation involving live regulated data; High = control absent; Medium = control partial/undocumented).
