NIS2 for Financial market infrastructures
As in banking, DORA governs ICT risk: trading venues and central counterparties are financial entities under Regulation (EU) 2022/2554 (art. 2(1)(h)–(i), 2(2)), which is the sector-specific act for the purposes of NIS2 article 4 (DORA art. 1(2); NIS2 recital 28).
Which entities are covered
Operators of trading venues as defined in Article 4, point (24), of Directive 2014/65/EU; central counterparties (CCPs) as defined in Article 2, point (1), of Regulation (EU) No 648/2012.
Sub-sectors named in the annex
None. Annex I divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
A large entity of this sector — one exceeding the ceilings for medium-sized enterprises of Recommendation 2003/361/EC — is essential (art. 3(1)(a)); a medium-sized one is important (art. 3(2)). A small or micro entity is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Trading venues and central counterparties are financial entities under Regulation (EU) 2022/2554 (DORA art. 2(1)(h) and (i), 2(2)). Articles 21 and 23 of NIS2 and its supervision and enforcement under Chapter VII — the fines of article 34 included — give way to DORA (NIS2 article 4(1) and recital 28; DORA article 1(2)). Classification under article 3 and the list and registration duties of article 3(3) and 3(4) remain.
Traps specific to this sector
Trap 1
Only two types are listed. Central securities depositories and trade repositories are financial entities under DORA (art. 2(1)(g) and (j)) but are not among the types of Annex I, point 4.
Trap 2
What DORA displaces is NIS2's cybersecurity risk-management and reporting obligations, and its supervision and enforcement (recital 28); classification under article 3 and the list and registration duties of article 3(3) and 3(4) are not among them.
What else applies to you
Regulation (EU) 2022/2554 (DORA), the sector-specific act for the purposes of NIS2 article 4 (DORA art. 1(2)); Directive 2014/65/EU (MiFID II) and Regulation (EU) No 648/2012 (EMIR), which define the two entity types; Directive (EU) 2022/2557 (CER), whose article 8 disapplies its article 11 and Chapters III, IV and VI to critical entities in this sector.
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.