NIS2 Banking Sector: What DORA Replaces and What Your MSP Still Owes

A regional bank's COO forwards you a NIS2 questionnaire her board just received. Your MSP hosts their ticketing platform and runs their endpoint estate. She asks: "Do we answer this, or is DORA enough?"

The honest answer is both. In the NIS2 banking sector, DORA replaces most of NIS2's obligations, but it does not make the bank disappear from NIS2. And it pulls you, the supplier, into a different rulebook entirely.

NIS2 banking sector: DORA is lex specialis, not an exemption

NIS2 (Directive (EU) 2022/2555) lists credit institutions under Annex I, sector 3 (banking), and trading venues and central counterparties under sector 4 (financial market infrastructures). So these clients are in scope by sector.

Article 4 then does the sorting. Where a sector-specific Union act requires entities to adopt cybersecurity risk-management measures or notify significant incidents, and those requirements are at least equivalent in effect to NIS2, the relevant NIS2 provisions do not apply. That includes the supervision and enforcement rules in Chapter VII.

Recital 28 of NIS2 states that Regulation (EU) 2022/2554 (DORA) should be considered a sector-specific Union legal act. DORA recital 16 says the Regulation constitutes lex specialis with regard to NIS2. Article 1(2) of DORA confirms that for entities identified as essential or important under national transposition of NIS2 Article 3, DORA is the sector-specific act for Article 4 purposes.

Read that carefully. DORA displaces specific NIS2 provisions. It does not turn the bank into a non-NIS2 entity.

What DORA replaces, and who supervises

NIS2 obligation	What applies to a DORA financial entity
Article 21 risk-management measures	DORA ICT risk management framework
Article 21(2)(d) supply chain security	DORA ICT third-party risk rules (Chapter V, Articles 28 to 44)
Article 23 incident reporting	DORA major ICT-related incident reporting
Chapter VII supervision and fines	The financial supervisor and DORA sanctions

DORA has applied directly since 17 January 2025. Supervision stays with the financial authorities, such as the national central bank or financial supervisor, rather than the national cybersecurity agency.

Not every financial client is in NIS2 at all

This is the point most questionnaires get wrong. NIS2 only names credit institutions and financial market infrastructures. DORA's Article 2(1) is much wider: it also covers payment institutions, investment firms, central securities depositories, trade repositories and insurance and reinsurance undertakings, among others.

An insurer or a payment institution is therefore DORA-only. Sending that client a NIS2 gap analysis wastes their time and yours. A bank, a trading venue or a CCP needs both pictures, with DORA carrying the substance.

Two incident clocks, one MSP in the middle

NIS2 asks for an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. DORA runs a different clock for major ICT-related incidents. Under Delegated Regulation (EU) 2025/301, the initial notification is due within four hours of classifying the incident as major, and in any case within 24 hours of detection. An intermediate report follows within 72 hours of the initial one, and the final report within one month of the latest intermediate report.

Your bank client files under DORA. Your non-financial clients file under NIS2. If you run a shared SOC or a shared ticketing queue, the same event can start two different clocks on the same day. Your runbook needs a per-client flag for which regime applies. See NIS2 Incident Reporting: The 24-Hour, 72-Hour and 1-Month Deadlines for the NIS2 side.

Where your MSP gets pulled in

This is the commercial reality. A bank that is DORA-covered must manage its ICT third-party risk under DORA Chapter V. That means a register of information on every contractual arrangement for ICT services, and the key contractual provisions of Article 30 in your agreement: service descriptions, locations, incident assistance, audit and access rights, and exit strategies.

The supervisors also oversee the biggest providers directly. On 18 November 2025 the European Supervisory Authorities published the first list of critical ICT third-party providers designated under DORA. Most MSPs will not be on it. Your bank clients will still push the same expectations down the chain to you.

You also have your own NIS2 duties. ICT service management for B2B customers sits in Annex I, so an MSP is typically an essential or important entity in its own right. Two regimes, one company. The practical overlap is covered in NIS2 vs. DORA and in NIS2 Supply Chain Security.

National law decides the edges

DORA is a regulation. NIS2 is a directive. The leftovers, such as registration with the cybersecurity authority and national supervisory handling, depend on each member state's law. In Germany, section 28(6) of the BSIG disapplies a list of NIS2 provisions for DORA financial entities, but registration under section 33 is not on that list. In Italy, the DORA adaptation decree (D.Lgs. 23/2025) has applied since 12 March 2025 alongside D.Lgs. 138/2024. France and Spain have not transposed NIS2, and both were referred to the Court of Justice in 2026.

Confirm per client, per legal entity, which law applies. The rules on which regulator supervises your client help when a bank group spans several countries.

What to do this week

1. List every financial client and mark it: credit institution or FMI (NIS2 and DORA) or other financial entity (DORA only).
2. Check each contract for the DORA Article 30 provisions. Missing audit rights and exit terms are the usual gap.
3. Add a regime flag to your incident runbook: DORA four-hour clock or NIS2 24-hour clock.
4. Confirm your own NIS2 registration as an ICT service management provider in each country you operate.
5. Prepare the information the bank needs for its register of information: services, subcontractors, data locations.

Start with your own house. Start a free NIS2 Quick Scan to get a readiness assessment of your own compliance posture, then use the result to answer the bank's questionnaire with evidence instead of promises.

DORA replaces the rulebook for the bank. It does not replace the questions your clients will ask you.