BSI TR-03174: Security Requirements for Financial Apps Compared to TR-03161
What would bother you more: an emptied bank account or an exposed patient record? Many people would instinctively say the bank account. Yet health apps have long had an established benchmark in BSI TR-03161, and for DiGAs (prescribable digital health applications in Germany) the attestation is even mandatory. The counterpart for financial apps is BSI TR-03174 "Secure Applications in the Financial Sector", at version 4.0 since June 2026.
This article explains what BSI TR-03174 requires, who it applies to, and why experience from healthcare carries over directly.
What is BSI TR-03174?
BSI TR-03174 is a Technical Guideline issued by the BSI (German Federal Office for Information Security) with security recommendations for applications in the financial sector. It consists of three parts: mobile applications, web applications and background systems, all at version 4.0 of 1 June 2026.
The recommendations are graded as MUST, MUST NOT, SHOULD and MAY. A SHOULD requirement may only be omitted if you demonstrate that doing so creates no risk or that it is currently not technically feasible.
TR-03174 and TR-03161 compared
| BSI TR-03161 | BSI TR-03174 | |
|---|---|---|
| Sector | Healthcare | Finance and finance-related services |
| Parts | Mobile, web, background systems | Mobile, web, background systems |
| Current version | Part 1: 3.0, Parts 2 and 3: 2.0 (25 March 2024) | all parts 4.0 (1 June 2026) |
| Binding nature | mandatory for DiGAs | explicitly not a regulatory obligation |
| Certification | BSI certificate via a recognised testing body | BSI certificate per part, voluntary |
Both guidelines use the same requirement areas and identifiers, from intended purpose (O.Purp) through cryptography (O.Cryp) and authentication (O.Auth) to network communication (O.Ntwk). For background systems, both require, in identical wording, an ISO 27001 certification of the operator. Part 3 of TR-03174 explicitly cites TR-03161 as a source. Only TR-03161 additionally has the area "paid resources".
The most important difference is how binding they are. In TR-03174 the BSI writes: "The notes and recommendations of the TR do not constitute regulatory obligations." (our translation)
Who is TR-03174 relevant for?
The BSI addresses the TR "primarily to a non-regulated, heterogeneous group of recipients" (our translation), such as digital household budget books, financial and loan calculators, or discount retailers' payment apps. For banks and payment service providers it is a point of reference: PSD2, DORA and the BaFin circulars take precedence.
That makes it relevant for:
- Fintechs and app providers who want to make their security demonstrable without being supervised themselves
- Regulated institutions looking for a concrete technical benchmark for apps and backends
- Service providers who develop or operate financial applications
Bank account or patient record: what are you actually protecting?
In its risk assessment, TR-03174 explicitly takes into account the "directly possible financial damage" (our translation). For data of the highest criticality, the measures must rule out all risk scenarios with no residual risk.
To put it honestly: financial damage can usually be quantified and sometimes compensated, an exposed diagnosis cannot.
For the technology, however, the ranking hardly matters. Encrypted storage, protected keys, secure sessions and monitored third-party libraries are needed by the banking app just as much as by the DiGA.
Why healthcare experience carries over to finance
According to the BSI list, five testing bodies are currently recognised for TR-03174: PwC, TÜV Informationstechnik, secuvera, TÜV TRUST IT and SRC. All five are also recognised for TR-03161. For cryptography and connections, both guidelines refer to BSI TR-02102.
If you have secured a health app according to TR-03161, you have therefore already implemented most of the patterns. That is exactly what our products build on.
How azuma helps
Checking code with azuma nori. Many recommendations can be verified in the code, such as no hard-coded keys (O.Cryp_1), no debug leftovers (O.Source_6) or no unmaintained third-party software (O.TrdP_7). azuma nori checks your codebase locally against all three parts of TR-03174, currently in preview, in addition to TR-03161 and TR-02102. Either as a gap analysis or with every release in your CI/CD pipeline, without your source code ever leaving your infrastructure.
Authentication with azuma doa. TR-03174 requires, for example, two-factor authentication from different categories (O.Auth_2), protection against repeated failed attempts (O.Auth_4) and securely terminating sessions in the backend (O.Auth_9). As a health IAM, azuma doa is designed for precisely these TR-03161 requirements: MFA, device binding, passkeys/FIDO2 and secure session and token management. That makes doa a fit for financial apps as well.
Neither product replaces ISO 27001, backend monitoring or penetration testing.
First steps towards TR-03174
- Determine the parts: mobile app, web application, backend? According to the TR, web application and backend can hardly be separated, so Part 3 almost always applies.
- Place it in the regulatory context: PSD2, DORA or BaFin requirements take precedence over the TR.
- Define the protection requirements and classify sensitive data by criticality.
- Gap analysis in the code, e.g. with azuma nori, and justify any SHOULD deviations.
- Commission a testing body if you want a certificate.
Frequently asked questions
Is BSI TR-03174 mandatory?
No. According to the BSI, its recommendations do not constitute regulatory obligations. Certification is voluntary.
What is the difference between TR-03174 and TR-03161?
TR-03161 applies to healthcare and is mandatory for DiGAs; TR-03174 for the financial sector is voluntary. The structure is largely the same.
Who audits against BSI TR-03174?
Testing bodies recognised by the BSI, currently PwC, TÜV Informationstechnik, secuvera, TÜV TRUST IT and SRC. The certificate is issued by the BSI.
Does TR-03174 make you DORA-compliant?
No, not automatically. According to the BSI, DORA, PSD2 and BaFin requirements take precedence; the TR serves as a point of reference.
Want to know where your financial app stands against BSI TR-03174? Sign up for the free trial of azuma nori (three selected controls included) or get in touch, about azuma doa too.
As of: 27 October 2026, BSI TR-03174 version 4.0 of 1 June 2026, testing bodies according to the BSI list of 26 October 2026. The BSI's current publications are authoritative.