How a Berlin Neobank Went From Zero Compliance to Audit-Ready Across 3 Frameworks in 5 Weeks

NovaPay had just closed its Series A and was growing fast. Their digital banking platform was gaining traction across Germany and Portugal, onboarding thousands of customers every month. But when their lead Series B investor laid down the terms, the founders faced a reality check they hadn’t anticipated.

The condition was non-negotiable: prove compliance across DORA, SOC 2, and ISO 27001 within 8 weeks — or the round wouldn’t close.

NovaPay had no compliance team. No policies. No evidence repository. No GRC tooling. Just a great product, a motivated team of 85, and a deadline that suddenly felt impossible.

The Challenge

When the NovaPay leadership team sat down to assess their starting point, the scope of the problem became clear:

• No existing compliance infrastructure — zero policies, zero documented controls, zero evidence
• 85 employees distributed across Berlin and Lisbon offices
• 200+ microservices running on AWS, with complex CI/CD pipelines through GitHub Actions
• A hard investor deadline: 8 weeks to demonstrate audit-readiness across three frameworks simultaneously
• Startup budget constraints — they couldn’t spend like an enterprise

Why Traditional Approaches Wouldn’t Work

NovaPay’s CTO, David Chen, explored the obvious options first. Each one fell short:

None of these paths could deliver what NovaPay needed: three-framework audit-readiness in under two months, at a price a Series A startup could afford.

The Matproof Approach

A fellow Berlin founder recommended Matproof. David was skeptical — five weeks for three frameworks sounded too good to be true. But with the clock ticking, they started on a Monday morning. Here’s what happened week by week:

What the NovaPay Team Says

The Investor Outcome

NovaPay’s Series B closed successfully at €28M — above their initial target. The lead investor specifically noted that NovaPay’s compliance posture was a differentiating factor in the deal.

In the due diligence report, the investor’s legal team wrote:

“NovaPay demonstrated a mature and well-documented compliance program across DORA, SOC 2, and ISO 27001 — unusual for a company at this stage. Their use of automated compliance tooling gives us confidence in their ability to maintain this posture as they scale.”

— Series B Due Diligence Report (excerpt)

Compliance wasn’t a blocker. It became a trust signal that accelerated the deal.

Key Takeaways

Whether you’re a Series A startup facing investor due diligence or a growing fintech preparing for your first audit, NovaPay’s experience offers clear lessons:

• You don’t need a large compliance team to get audit-ready — the right platform multiplies your existing team’s capacity
• Multi-framework compliance doesn’t mean 3x the work — with proper control mapping, the overlap is 60%+
• AI-generated policies aren’t generic if the platform understands your actual tech stack and organizational context
• Compliance can be a fundraising advantage, not just a checkbox
• Starting early (even pre-revenue) is cheaper and faster than retrofitting compliance later
• Automated evidence collection transforms compliance from a periodic burden into a continuous, low-maintenance process