NIS2 for Banking and Financial Market Infrastructures: NIS2 under DORA — Banking and financial market infrastructures in Annex I, word for word

In this lesson

Quote the two Annex I rows that bring banks and market infrastructures into NIS2, word for word, with the Union acts that define each entity type.
Decide whether a given legal entity in a financial group is of one of those three types, and say which act answers the question.
Match each annex type to its place in the scope list of Regulation (EU) 2022/2554 (DORA), and see why the two texts meet on the same three definitions.
Name the financial entities that DORA covers but that the NIS2 annexes do not mention, and avoid the scoping error that follows from the label financial market infrastructure.

Two rows in the annex of high criticality

Directive (EU) 2022/2555 lists the entity types it covers in two annexes. Annex I is headed “SECTORS OF HIGH CRITICALITY” and is set out in three columns: sector, subsector and type of entity. The financial sector occupies two of its eleven points. Point 3 is banking. Point 4 is financial market infrastructures. Neither point has a subsector: the type-of-entity column follows the sector name directly. Annex II, the list of other critical sectors, contains no financial entity at all.

Here are the two rows, with the type-of-entity text exactly as the Official Journal prints it, footnote markers omitted.

Point	Sector	Subsector	Type of entity
3	Banking	(none)	“Credit institutions as defined in Article 4, point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council”
4	Financial market infrastructures	(none)	“Operators of trading venues as defined in Article 4, point (24), of Directive 2014/65/EU of the European Parliament and of the Council” “Central counterparties (CCPs) as defined in Article 2, point (1), of Regulation (EU) No 648/2012 of the European Parliament and of the Council”

That is the whole of the financial sector in NIS2: three entity types, each defined by reference to another Union act.

Point 3: credit institutions, as defined elsewhere

Annex I, point 3

NIS2 does not define a credit institution. It borrows the definition of Article 4, point (1), of Regulation (EU) No 575/2013, which the directive's footnote identifies as the Regulation “on prudential requirements for credit institutions and amending Regulation (EU) No 648/2012”. The consequence is practical: whether an entity is of the banking type is a question of prudential law, not of cybersecurity law. Your scoping note should cite the provision and attach the evidence of the entity's status under it, in practice the authorisation file the compliance function already keeps.

The row names credit institutions and nothing else. Other licensed businesses that a customer might call a bank are not listed: payment institutions, electronic money institutions and investment firms appear in neither annex. Recital 10 of DORA gives the example of a financial entity holding a banking, an investment firm and a payment institution licence, each issued by a different competent authority. For NIS2, what counts is whether the legal entity is a credit institution within the meaning of the cited provision.

Point 4: trading venues and central counterparties

Annex I, point 4

Point 4 covers two types. The first is the operator of a trading venue, with the venue defined in Article 4, point (24), of Directive 2014/65/EU, the directive “on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU”. Note the wording: the entity in scope is the operator, the legal person that runs the venue, not the venue as a market. The second type is the central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012, the Regulation “on OTC derivatives, central counterparties and trade repositories”.

The sector heading can suggest more than it contains. Central securities depositories and trade repositories, which DORA lists among its financial entities, are also part of the market's infrastructure. The annex lists neither. A central securities depository is not of a type referred to in Annex I or II, so article 2(1) of NIS2 does not reach it as such, however systemic its role. The heading describes the row; it does not add entity types to it.

The same three definitions in DORA

DORA, art. 2(1), 3

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) has its own scope list. Article 2(1) names twenty-one categories, and article 2(2) provides that those in points (a) to (t) are collectively referred to as “financial entities”. Point (u), ICT third-party service providers, is in the list but is not a financial entity. The three NIS2 types sit in that list, and DORA defines them by reference to exactly the same provisions.

NIS2 Annex I type	Defining provision	DORA scope	DORA definition
Credit institutions (point 3)	Reg. (EU) No 575/2013, art. 4, point (1)	Art. 2(1)(a)	Art. 3, point (31), same provision
Operators of trading venues (point 4)	Dir. 2014/65/EU, art. 4, point (24)	Art. 2(1)(i), which names trading venues	Art. 3, point (43), same provision
Central counterparties (point 4)	Reg. (EU) No 648/2012, art. 2, point (1)	Art. 2(1)(h)	Art. 3, point (40), same provision

Unless one of the exclusions of DORA article 2(3) or the member-state option of article 2(4) applies, an entity of one of the three annex types is also a DORA financial entity. Lesson m1l2 deals with those exclusions, including the one that article 2(10) of NIS2 mirrors; lesson m2l1 explains why DORA then sets the ICT risk-management and incident-reporting rules.

What DORA covers and the annexes do not

DORA, art. 2(1)(b)-(t)

DORA's list is much longer than the annex. Among its financial entities are payment institutions, account information service providers, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, trade repositories, managers of alternative investment funds, management companies, data reporting service providers, insurance and reinsurance undertakings, insurance intermediaries, institutions for occupational retirement provision, credit rating agencies, administrators of critical benchmarks, crowdfunding service providers and securitisation repositories. None of these is an Annex I or Annex II type. For them, NIS2 is not displaced by DORA: it never applied to them as financial entities in the first place.

Two errors follow. First, a statement such as our whole group is covered by NIS2 because we are a bank is wrong at the level of the payment institution, the investment firm or the insurer in the group. Second, a statement such as DORA covers us, so NIS2 is irrelevant is wrong at the level of any group company that is not a financial entity but is of another annex type, such as a group company providing managed IT services to third parties.

From identification to a uniform rule

DORA, recital 15

The three types are not new to EU cybersecurity law. Recital 15 of DORA records that Directive (EU) 2016/1148, the first NIS directive, already applied to “three types of financial entities, namely credit institutions, trading venues and central counterparties”, but that, because it relied on national identification of operators of essential services, only the institutions identified by member states were brought into its scope in practice. The same recital notes that NIS2 sets a uniform criterion, the size-cap rule, “while also keeping the three types of financial entities in its scope”.

Article 3(1)(g) of NIS2 keeps a bridge: if the member state so provides, entities it identified before 16 January 2023 as operators of essential services are essential entities. Whether your member state uses that option is a national question for the transposition tracker.

A method for the scoping file

Art. 6(38)

The annex is applied to entities, and article 6(38) defines an entity as “a natural or legal person created and recognised as such under the national law of its place of establishment”. Groups are not entities. A defensible scoping file for a financial group therefore lists each legal person and answers four questions for each, with the evidence:

Is it a credit institution, an operator of a trading venue or a central counterparty within the meaning of the provision the annex cites? Evidence: the authorisation and the provision.
Is it a DORA financial entity, and under which point of DORA article 2(1)? Evidence: the same file, plus a check of DORA article 2(3) and of any national use of article 2(4).
If it is not a financial entity, is it of another NIS2 annex type? Evidence: a description of the services it provides and to whom.
Does it meet the NIS2 size rule or a size-independent case? Lesson m1l2 covers this.

In practice

A fictional case. The Orsana group has five legal entities in one member state. Orsana Bank is authorised as a credit institution and employs 3 400 people. Orsana Clearing is authorised as a central counterparty under Regulation (EU) No 648/2012 and employs 180 people. Orsana Pay is a payment institution with 300 staff. Orsana Securities Services is a central securities depository. Orsana Technology is a group company that runs data centres and managed IT services for the other entities and for external clients.

The scoping note reads the annex line by line. Orsana Bank is a point 3 type and Orsana Clearing a point 4 type; both are also DORA financial entities under article 2(1)(a) and (h). Orsana Pay and Orsana Securities Services are DORA financial entities under article 2(1)(b) and (g), but neither is an Annex I or II type, so NIS2 does not apply to them as such. Orsana Technology is not a financial entity at all; the note flags it for analysis as a possible managed service provider or data centre service provider under Annex I, point 8 or 9, where NIS2 would apply to it in its own right.

What a supervisor will ask

Which of your legal entities are credit institutions, operators of trading venues or central counterparties, and on what basis? The entity list with the authorisation behind each classification.
Why is this group company outside NIS2? A reasoned note citing the annex row it does not match, not a statement that the group is regulated.
Which entities are DORA financial entities, and under which point of DORA article 2(1)? The same register, with the DORA column completed.
Has any group company that is not a financial entity been assessed against the other Annex I and II types? The assessment, dated and owned.

Key points

Annex I, point 3 (banking) covers only credit institutions as defined in Article 4, point (1), of Regulation (EU) No 575/2013.
Annex I, point 4 (financial market infrastructures) covers only operators of trading venues and central counterparties, each defined by reference to Directive 2014/65/EU and Regulation (EU) No 648/2012. Neither point has a subsector.
DORA lists the same three types in article 2(1)(a), (h) and (i) and defines them by reference to the same provisions.
Payment and e-money institutions, investment firms, central securities depositories, insurers and the other DORA financial entities are not NIS2 annex types.
The annex is applied to each legal entity; a group company that is not a financial entity may be of another annex type and in NIS2 in its own right.