This is an abbreviated list, to give you an idea of the level of detail needed for this one question the FCA states your process in place to file, monitor, track and restrict access to sensitive payment data should include:

1. A description of the flows of data classified as sensitive payment data in the context of the payment institution’s business model
2. The procedures in place to authorise access to the sensitive payment data
3. A description of the monitoring tool
4. The access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures
5. A description of how the collected data is filed (unless the applicant firm intends to provide PIS only)
6. The expected internal and/or external use of the collected data, including by counterparties (unless the applicant firm intends to provide PIS only)
7. The IT system and technical security measures that have been implemented, including encryption and/or tokenisation
8. Identification of the individual(s), bodies and/or committees with access to the sensitive payment data
9. An explanation of how breaches will be detected and addressed
10. An annual internal control program in relation to the safety of the IT systems