NIS2 for Banking
DORA governs ICT risk here. Regulation (EU) 2022/2554 is a sector-specific Union legal act for the purposes of NIS2 article 4 in relation to financial entities identified as essential or important (DORA art. 1(2)), and its rules on ICT risk management, ICT-related incidents, testing, information sharing and ICT third-party risk apply instead of those of NIS2 (NIS2 recital 28).
Which entities are covered
Credit institutions as defined in Article 4, point (1), of Regulation (EU) No 575/2013.
Sub-sectors named in the annex
None. Annex I divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
A large entity of this sector — one exceeding the ceilings for medium-sized enterprises of Recommendation 2003/361/EC — is essential (art. 3(1)(a)); a medium-sized one is important (art. 3(2)). A small or micro entity is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Credit institutions are financial entities under Regulation (EU) 2022/2554 (DORA art. 2(1)(a), 2(2)). Articles 21 and 23 of NIS2 and its supervision and enforcement under Chapter VII — the fines of article 34 included — give way to DORA (NIS2 article 4(1) and recital 28; DORA article 1(2)). Classification under article 3 and the list and registration duties of article 3(3) and 3(4) remain.
Traps specific to this sector
Trap 1
Recital 28 asks member states not to apply NIS2's cybersecurity risk-management and reporting obligations, or its supervision and enforcement, to financial entities covered by DORA. Classification under article 3 — which DORA article 1(2) presupposes — and the list and registration duties of article 3(3) and 3(4) are not among them.
Trap 2
An entity that a member state excludes from DORA under DORA article 2(4) is outside NIS2 as well (NIS2 art. 2(10)).
Trap 3
DORA's precedence concerns financial entities (DORA art. 1(2), 2(2)). A group company that is not one — an intra-group IT provider, for instance — falls under NIS2 on its own facts: if it meets the definition of an Annex I or II type, such as managed service provider (art. 6(39)), and the size rule, it is in scope.
What else applies to you
Regulation (EU) 2022/2554 (DORA), the sector-specific act for the purposes of NIS2 article 4 (DORA art. 1(2)); Directive (EU) 2022/2557 (CER), whose article 8 disapplies its article 11 and Chapters III, IV and VI to critical entities in banking.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.