Sector · Banking and fintech regulatory compliance
Regulatory compliance for banking and fintech: DORA, NIS2 and GDPR
Banking regulatory compliance in the EU now revolves around DORA. Banks, payment and e-money institutions, investment firms and crypto-asset service providers share the same challenge: proving their digital operational resilience to the supervisor. DORA has set the pace since January 2025, and GDPR and the EU AI Act complete the picture.
Key regulations for banking regulatory compliance
What DORA requires
Regulation (EU) 2022/2554 has applied since 17 January 2025 to most EU financial entities. Therefore, it is now the backbone of banking regulatory compliance, and it is organised in five pillars:
- ICT risk management: a framework approved and overseen by the management body, covering identification, protection, detection, response and recovery.
- Major incident reporting: an initial notification within 4 hours of classifying an incident as major (and no later than 24 hours after detection), an intermediate report within 72 hours and a final report one month later.
- Resilience testing: an annual testing programme and, for entities designated by the supervisor, threat-led penetration testing (TLPT) at least every three years.
- ICT third-party risk: minimum contractual clauses, exit strategies and a register of information covering every arrangement with ICT providers.
- Information sharing on cyber threats between entities, on a voluntary basis.
Banking compliance: key deadlines
| When | What |
|---|---|
| 17 January 2025 | DORA fully applicable. |
| 4 h · 72 h · 1 month | Initial, intermediate and final reporting of major incidents. |
| Every 3 years | TLPT for entities designated by the supervisor. |
| 2 December 2027 | EU AI Act obligations for high-risk systems such as creditworthiness assessment and credit scoring. |
What about NIS2?
Banking and financial market infrastructures are listed in NIS2, but DORA is the sector-specific law for finance: for ICT risk management and incident reporting, DORA prevails. However, NIS2 remains relevant for your suppliers and for group companies that are not financial entities.
GDPR and the EU AI Act
Banking regulatory compliance also covers customer data, which requires clear lawful bases, records of processing, impact assessments and breach notification to the data protection authority within 72 hours. In addition, AI systems that assess the creditworthiness of natural persons or establish their credit score are high-risk under the EU AI Act, with obligations from 2 December 2027.
If you are a fintech serving banks
If you are not a financial entity but provide ICT services to banks, DORA does not apply to you directly, but it reaches you by contract: your client must include you in its register of information, require minimum clauses and, if the service is critical, audit you. As a result, part of your clients’ banking regulatory compliance becomes your own work.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with banking regulatory compliance
- The ICT third-party register, linked to your contracts as well as to each supplier assessment.
- Incident classification with DORA criteria and the 4-hour, 72-hour and one-month clock.
- The resilience testing programme and, afterwards, follow-up of TLPT findings.
- One control, many regulations: ISO 27001 controls reused for DORA, NIS2 and GDPR.
FAQ
Banking regulatory compliance: frequently asked questions
Who does DORA apply to?
Banks, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and other EU financial entities, with a simplified regime for some smaller ones. It also reaches critical ICT providers designated by the European authorities.
Does DORA apply to my fintech?
If you are licensed as a financial entity (payment, e-money, investment or crypto-asset), yes. If you only provide technology services to financial entities, it does not apply directly, but your clients will pass their requirements on by contract.
What is the register of information?
A structured inventory of all contractual arrangements with ICT service providers, which the entity must keep up to date and make available to the supervisor when requested.
Other sectors: InsurersPublic-sector suppliersEnergy and essential servicesConnected-product manufacturers
Shall we look at it with your own services?
We’ll show you the platform with a real case from your sector. No commitment, no sales script.
