sox 404 compliance for fintech