ISTQB Finance Testing (CT-FT): Syllabus, Exam Format and Study Order

Meera has tested online shopping checkouts for four years, and this week she moved to her bank's payments team. Her first defect is bounced: a fee of 0.005 was rounded the wrong way. The ISTQB Certified Tester - Finance Testing (CT-FT) exam, built on syllabus v1.0, teaches exactly this domain: 40 questions in 60 minutes, open to anyone holding a Foundation Level certificate.

Her story is common. Plenty of capable testers arrive in banks, insurers and fintech firms and find that the techniques they know still apply, but the vocabulary, the regulators and the cost of a single wrong cent do not. CT-FT is ISTQB's answer to that gap. This guide walks through what the syllabus holds, how the exam is set up, how finance questions behave, and an order of study that suits someone with no banking background.

What is ISTQB CT-FT, and is v1.0 the current syllabus?

CT-FT is a specialist certification from the International Software Testing Qualifications Board (ISTQB). It extends the Foundation Level qualification into the financial services domain: banking, fintech companies, insurers, pension and leasing businesses, and payment providers. ISTQB describes its scope as the structure of the financial industry, compliance testing, risk-based testing, data testing and data management, functional and non-functional testing, and test automation in regulated environments.

Version 1.0 of the syllabus was released on 27 May 2026, and ISTQB's CT-FT certification page lists it as the syllabus the exam is based on, alongside a sample exam with answers. I checked that page in October 2026 and found no newer version, so everything below follows v1.0. Because the certification is new, there is no older edition to confuse you; an older blog post that quotes different chapters is describing something other than the current exam.

The full text is a 61-page PDF, free to download from ISTQB (CT-FT syllabus v1.0). Chapters 1 to 6 are examinable. The introduction and the appendices are not, and standards named in the references are examinable only as far as the syllabus itself summarises them. That last rule matters: you do not have to read the text of PSD2 or DORA, but you do have to know what the syllabus says each one means for a tester.

What do the exam facts look like, and who is allowed to sit it?

The structure is short and specific. The table below sets the exam figures next to the rules that surround them.

Exam detail	CT-FT
Full name	ISTQB Certified Tester - Finance Testing
Exam code	CT-FT
Syllabus version	Version v1.0
Number of questions	40
Duration	60 minutes (ISTQB adds 25% for candidates sitting in a non-native language)
Passing score	30 / 45
Exam fee	USD 199
Prerequisite	A valid ISTQB Certified Tester Foundation Level (CTFL) certificate
Category	Specialist

ISTQB's CT-FT page lists a passing score of 30 out of 45 total points; the total is higher than the 40 questions because some questions carry two points. Treat 30 as a target of roughly two points in three, and aim well above it in practice.

Three eligibility and cost details are worth knowing before you plan. First, you must hold CTFL, v4.0 or an earlier version, so a candidate who has not yet taken the Foundation exam needs to do that first (see ISTQB's CTFL page). Second, banking experience helps but is not required; the syllabus says so directly. Third, ISTQB publishes no single global fee. Exams are sold by local exam providers, who set their own prices, so USD 199 is a reference figure and your invoice can differ. The providers are listed on ISTQB's exam provider page. Training is optional: self-study from the syllabus is a recognised route.

What does each of the six syllabus chapters ask of you?

The syllabus is divided into six chapters with a suggested share of teaching time attached to each, about nine hours in all. Those shares show relative emphasis, and the largest block is functional and non-functional testing, at nearly a third. Every learning objective is tagged K1 (remember), K2 (understand) or K3 (apply). Only four objectives sit at K3, and they are the ones that decide whether you can reason through a calculation or a scenario rather than just recognise a term.

Chapter 1: Introduction to the Financial Services Industry (about 9%)

This chapter defines finance testing as verifying and validating software used in banks, fintech companies and non-bank financial institutions such as insurers, pension funds and leasing firms. You are expected to recall its main objectives: functional correctness (interest, amortisation and balances calculated to a defined precision), regulatory compliance, security, data integrity, and performance and availability.

It then describes the kinds of environment you will meet. An omnichannel retail bank must keep mobile, web, branch, ATM and phone channels consistent with a legacy core system. A trading platform is a high-throughput, low-latency environment where speed and deterministic execution dominate. A fintech company typically runs a logic-dense, API-heavy microservice estate where the test focus is resilience: a failure in one service must not cascade. The last section explains how domain knowledge shortens defect discovery, because a tester who understands settlement, clearing or a loan lifecycle spots a wrong rule that a pure technique-driven tester will not.

Chapter 2: Compliance Testing (about 15%)

Compliance testing checks whether a system meets standards, laws, regulations and contracts. The chapter covers its objectives, a table of the regulations that matter, the consequences of failing them, and what is distinctive about testing in a regulated setting. The regulations in the syllabus table include GDPR, SOX, PCI DSS, DORA, PSD2, Basel III/IV, the EU anti-money laundering directives (AMLD5 and AMLD6) and the MiCA regulation for crypto assets. For each one you should be able to say what it means for a test: PSD2 points you at strong customer authentication and consent handling, PCI DSS at encrypted cardholder data and masked logs, SOX at segregation of duties and immutable audit trails, and DORA at failover and disaster recovery scenarios.

The final section introduces auditability, meaning that evidence of testing must be complete, retained and reproducible, and Continuous Automated Compliance Validation (CACV), which embeds regulatory checks in the delivery pipeline through compliance as code, quality gates that block non-compliant releases and continuous control monitoring.

Chapter 3: Risk-Based Testing (about 8%)

The shortest chapter reuses the Foundation idea that risk is the product of the probability of failure and its business impact, and applies it to finance. Risk is sorted into three families: business and financial risks (a wrong calculation, a botched data migration), technical and operational risks (tool dependency, scope creep), and regulatory and compliance risks (including third-party providers who fail their obligations, which DORA makes prominent). Prioritisation techniques named in the syllabus are FMEA, fault tree analysis and PRISMA. The syllabus also asks you to see how the chosen risk level changes the test conditions, depth and effort for each feature, and to involve compliance officers and risk managers in assessing it.

Chapter 4: Data Testing and Data Management (about 17%)

Here the exam moves to the data itself. You study accuracy (does the value match reality?) and consistency (does every system hold the same value in the same form?), then reconciliation across systems, then privacy and protection. Reconciliation is the K3 objective in this chapter, so expect to be asked to choose or apply a technique: record sampling, aggregate comparisons, checksum verification, and balance matching between source and target after a core banking migration. Post-migration reconciliation compares opening balances, transaction totals and posting statuses. The privacy section ties back to chapter 2 with masked, synthetic or tokenised data in place of live customer records.

Chapter 5: Functional and Non-Functional Testing (about 31%)

The longest chapter has five parts. Functional testing of finance uses familiar black-box techniques with finance twists: boundary value analysis on amounts with 0.01 increments and rounding at the smallest unit, equivalence partitioning for transaction types, decision tables for combinations of business rules and state transition testing for account and payment lifecycles. Performance risks cover peaks such as month-end, salary day and market open. Performance testing in finance covers load and stress testing in a production-like environment and is a K3 objective. Security and availability testing covers vulnerability scanning, penetration testing, SAST/DAST and dependency analysis, plus multi-factor authentication, role-based access and token lifecycles. The chapter closes with generative AI in finance testing: where an assistant can support test analysis, design, implementation and reporting, and where human review stays mandatory.

Chapter 6: Test Automation (about 20%)

The last chapter explains why automation pays off in finance (precise results, fast regression after a payment or credit change, scheduled runs) and then turns to strategy for both legacy and modern landscapes, which is the K3 objective. It finishes with the problems: regulatory complexity, script maintenance, the need to keep logs that auditors can replay, proprietary tools for ATMs, point-of-sale and biometrics, and the different difficulties of mobile, front-end and back-end automation.

How does a finance-domain question actually behave?

The exam text is not published, but the syllabus levels tell you what to expect: K1 questions ask for a term or a fact, K2 questions ask you to explain or choose the best description, and K3 questions give a small scenario and ask you to compute or select the correct application. Three hypothetical examples, written to match the syllabus, show the K3 style.

A boundary on a payment limit

A payment app allows a single transfer of at least 0.01 and at most 1,000.00 in one currency, with two decimal places. Boundary value analysis with the currency's precision gives these values: 0.00 (invalid), 0.01 (valid), 1,000.00 (valid) and 1,000.01 (invalid), with 0.02 and 999.99 as the inner neighbours. A candidate who proposes 1,000.001 has missed that the system cannot hold a third decimal, so the interesting case is how the interface treats a pasted value with extra digits. The same reasoning applies to a percentage fee: 0.5% of 1.01 is 0.00505, and the test must state which rounding rule the specification requires.

A migration that looks fine

A bank moves 120,000 savings accounts from a legacy platform to a new core. After the load, the new system shows 120,000 accounts. The count matches, yet total balances differ by 41.20. Counting alone would have passed this migration. Aggregation comparison catches the gap, and balance matching on a sample of accounts then pinpoints which records were rounded differently during transformation. The point the syllabus makes, and the exam rewards, is that technical success of the load and business correctness of the data are separate questions.

Ranking by risk

You have time to test only a few features before release. Scoring probability and impact from 1 to 5 and multiplying gives a ranking.

Feature	Probability	Impact	Risk score
Interest calculation on a new loan product	4	5	20
Strong customer authentication on payments	3	5	15
Statement PDF layout	3	2	6

The loan interest calculation gets the deepest coverage, including boundary values and a reconciliation of results against an independent calculation. The statement layout gets a light check. If a regulator-facing report depended on that layout, its impact score would rise and the order could change, which is why chapter 3 insists that compliance officers take part in the scoring.

In what order should a Foundation-level tester study for it?

Start from what you already own. CTFL holders know equivalence partitioning, boundary values, decision tables, state transitions and risk-based testing, so chapters 3 and 5.1 are partly revision. The unfamiliar parts are the regulatory vocabulary of chapter 2 and the reconciliation work of chapter 4, and those need the most time. The sequence below runs over six weeks at about six hours a week; stretch it if banking is entirely new to you.

Week	Focus	Finish the week with
1	Chapter 1 and the regulation table of chapter 2	One line per regulation: what a tester checks because of it
2	Rest of chapter 2: auditability and CACV	An explanation of compliance as code in your own words
3	Chapter 3 plus chapter 4.1 and 4.3	A risk table scored by hand for a payment release
4	Reconciliation (4.2) and functional testing (5.1)	Worked boundary and reconciliation cases, done without notes
5	Chapter 5.2 to 5.5 and chapter 6	A table of test types against the finance risk each addresses
6	Revision of keywords and the four K3 objectives	A full sample paper, with every error traced to a syllabus section

Two habits pay off throughout. Read the keywords listed under each chapter heading, because the syllabus says glossary terms must be remembered at K1 even when no learning objective names them. And practise the K3 objectives with numbers, not prose: do the boundary table, the reconciliation check and the risk score on paper until they are routine. ISTQB also publishes a free sample exam question set for CT-FT, which is a good week-six benchmark. When you want more questions than the free set provides, a CT-FT practice exam gives you another paper to sit against the clock.

What happens on the day, and how should you spend the 60 minutes?

You book through a national exam provider rather than ISTQB itself. Check how that provider delivers the paper, since methods differ by country, and confirm the language options, the fee in local currency and the rule for the extra 25 per cent of time before you pay. The time allowance applies when the exam language is not your first, so request it at booking if it applies to you.

The arithmetic is simple: 60 minutes for 40 questions gives 90 seconds per question, or about 112 seconds at 75 minutes. K1 questions should take well under a minute, which banks time for K3 scenarios. A workable method is one pass answering what you know, flagging anything that needs a calculation, then a second pass for the flagged items with the time you saved. Use pencil and paper, if the provider permits it, for boundary tables and balance sums, because mental arithmetic on rounding is where careless errors creep in. Read each option against the scenario's own words, since the syllabus distinguishes, for example, accuracy from consistency and load from stress, and distractors often swap them.

Plan a margin as well. The pass mark is 30 of 45 points, so a handful of lost K2 questions is survivable, but several lost K3 questions is not, because those test applied reasoning. If you fail, the sensible response is to map each missed topic to its syllabus section and retake when the exam provider's rules allow; check the provider for any waiting period.

Where does CT-FT sit among ISTQB credentials, and what does it do for a career?

CT-FT is a domain add-on, not a replacement for the Foundation. The syllabus refers readers to ISTQB's Performance Testing and Test Automation Engineering syllabi for general concepts and keeps its own pages to what is distinctive in finance. In that sense it signals something the Foundation cannot: that you can work inside a regulated, high-stakes environment and speak the language of compliance and risk teams.

The audience ISTQB describes is broader than testers. Test analysts, automation engineers, test managers, business analysts and compliance or risk staff who work next to testing all gain from the shared vocabulary. A practical way to use the credential is to show it with evidence: a reconciliation script you wrote, a risk table you maintain, or a mapping from PSD2 or DORA requirements to test conditions. The certificate gives you an agreed way to prove that you hold finance domain knowledge. For the structure of the content and each learning objective, our CT-FT syllabus page is a convenient companion to ISTQB's own PDF.

Frequently Asked Questions

What is the ISTQB Finance Testing (CT-FT) certification?

CT-FT is a specialist ISTQB certification for testing software in banks, fintech firms, insurers and payment providers. Syllabus v1.0 covers the financial industry, compliance, risk-based testing, data testing, functional and non-functional testing and test automation. It builds on the Foundation Level qualification.

Do I need CTFL before taking CT-FT?

Yes. The syllabus states that candidates must hold a valid ISTQB Certified Tester Foundation Level certificate, and ISTQB's certification page accepts v4.0 or earlier versions. Experience with financial systems is helpful but not mandatory, so a tester new to banking can still qualify.

How many questions and how much time does the CT-FT exam give?

The exam has 40 questions and lasts 60 minutes. ISTQB adds 25 per cent extra time for candidates who sit it in a non-native language, which makes 75 minutes. That works out at about 90 seconds a question on the standard allowance.

What is the passing score for CT-FT?

The passing score is 30 out of 45 points. Because the exam has 40 questions and 45 available points, some questions carry more than one point. Aim comfortably above the line on practice papers, since the applied K3 questions are where marks are most often lost.

How much does the CT-FT exam cost?

The reference fee is USD 199, but ISTQB publishes no single global price. Exams are sold by local exam providers who set their own fees, so the amount you pay depends on your country and provider. Confirm the price, language options and extra time rules with the provider before booking.

Select ratingPoorOkayGoodGreatAwesome

Rating: 5 / 5 (1 vote)