In brief
- Regulation: NIS2.
- All banks are subject to NIS2 as essential entities, but the bulk of their digital resilience obligations fall under DORA.
- Identifying the prevalence of DORA.
- Ensuring consistency of measures.
- Coordinating notifications.
- NIS2 provides for up to €10M or 2% for essential entities, but its application is residual in banking, where DORA's prudential regime structures supervision.
Regulatory deadlines
The key dates of this regulation.
January 2023
Entry into force (EU directive)
In forceOctober 2024
Transposition deadline (EU)
In force2026
French transposition (Resilience Act)
In forceWhat does NIS2 cover?
NIS2 establishes a horizontal cybersecurity baseline across many sectors, including the banking sector. However, where a sector-specific act imposes at least equivalent requirements, it takes precedence: this is the case with DORA for financial entities with regard to ICT risk and incident reporting.
The bank therefore structures its resilience around DORA and mobilises NIS2 only for what is not already covered.
Is the 'Banking' sector in scope?
All banks are subject to NIS2 as essential entities, but the bulk of their digital resilience obligations fall under DORA. The value of this guide is to clarify what remains within NIS2's scope once DORA is applied.
This alignment avoids duplication in governance, measures, and notifications.
Detailed obligations
Identify the prevalence of DORA
Recognise that, for ICT risk and incidents, DORA constitutes the lex specialis and takes precedence over NIS2.
Ensure consistency of measures
Ensuring that security measures satisfy DORA, covering the residual NIS2 scope without duplicating it.
Coordinating notifications
Avoid duplicate notifications by coordinating DORA channels and, where applicable, NIS2.
Documenting the articulation
Formalise an obligations mapping showing how DORA covers the ICT scope.
Sanctions & risks
NIS2 provides for penalties of up to €10M or 2% for essential entities, but its application is residual in banking, where DORA's prudential framework structures supervision. The primary risk is a poorly coordinated arrangement that generates overlaps or blind spots.
A clear mapping of both texts is the best protection.
Application timeline
- 1DORA. Applicable from 17 January 2025; takes precedence for ICT risk.
- 2NIS2. French transposition in progress; residual scope for the banking sector.
Common mistakes in the sector
- 1Duplicated devices. Building two parallel NIS2 and DORA frameworks.
- 2Ignored prevalence. Failing to recognise that DORA takes precedence for ICT risk.
- 3Duplicate notifications. Notify the same incident twice without coordination.
- 4Undocumented articulation. Failing to formalise the mapping of obligations.
Practical case
A bank had initiated a NIS2 project before DORA came into effect. It rationalised by placing DORA at the centre of its ICT resilience, reassigning NIS2 workstreams to the residual scope and unifying its incident procedures — eliminating duplicate governance and reporting.
Compliance roadmap
- 1
Mapping obligations. Compare the scope covered by DORA and by NIS2.
- 2
Prioritise DORA. Structuring ICT resilience around DORA.
- 3
Cover the residual risk. Addressing NIS2 points not covered by DORA.
- 4
Coordinating notifications. Coordinating channels to avoid duplication.
- 5
Document. Formalising the interface for authorities and audits.
Frequently asked questions
Yes, as an essential entity, but DORA prevails for ICT risk and incidents; NIS2 plays only a residual role.
Take action on NIS2
Free assessment or a chat with an expert dedicated to bank.
They already trust us
See how organisations in the bank sector secured their compliance with DCO.