Fintech Compliance: DORA, NIS2, Both or Neither? A Scope Map for 8 Fintech Business Models

If your fintech holds a payment, e-money, crypto or investment licence, your cybersecurity law is almost certainly DORA, not NIS2. That isn’t because DORA “overrides” NIS2. NIS2’s annexes simply never list those licences. The only financial entities NIS2 names are credit institutions, operators of trading venues and central counterparties. Everything else on DORA’s list sits outside NIS2 from the start.

Three things decide your position: your licence, your size, and whether you sell technology to regulated firms. The map below runs eight fintech business models through them. Some land under neither law, which isn’t the same as having no obligations.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Does this apply to you? The fintech scope map

In plain terms: start from your licence, not your product. DORA attaches to 20 named types of financial entity. NIS2 attaches to sectors, and finance barely appears in them.

Four questions settle most cases:

1. Do you hold an EU financial licence or registration on DORA’s list? Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554 (DORA) names 20 types. If yes, DORA applies directly; go to question 2. If no, go to question 3.
2. Is that licence a banking licence, or do you operate a trading venue or central counterparty? If yes, NIS2 also identifies you (once you are at least medium-sized) and DORA displaces most of it. If no, you are DORA-only.
3. Do you sell ICT services to DORA-regulated firms? If yes, DORA reaches you through your customers’ contracts.
4. Are you a cloud computing, data centre, managed service or managed security service provider with 50 or more staff, or with turnover and balance sheet both above €10 million? If yes, NIS2 applies directly, as a digital provider rather than as a fintech.

Fintech model	Typical EU status	DORA	NIS2	Net result
1. Neobank or banking-as-a-service bank	Credit institution	Yes, Art 2(1)(a)	Yes, Annex I sector 3	Both; DORA governs ICT risk and incidents
2. Payment app, payment initiation, acquiring, e-money wallet	Payment or e-money institution, including small “exempted” ones	Yes, Art 2(1)(b) and (d)	No; not an Annex type	DORA only
3. Open-banking data aggregator	Registered account information service provider	Yes, Art 2(1)(c)	No	DORA only
4. Crypto exchange or custodian	MiCA crypto-asset service provider	Yes, Art 2(1)(f)	No	DORA only
5. Neobroker, robo-adviser, crowdfunding platform	Investment firm or crowdfunding service provider	Yes, Art 2(1)(e) and (s)	No, unless you operate a trading venue	DORA only (venue operators: both)
6. Insurtech broker or distributor	Insurance intermediary	Only if large; SMEs excluded by Art 2(3)(e)	No	DORA (large) or neither (SME)
7. Buy-now-pay-later or non-bank lender	National creditor authorisation	No; creditors are not on the list	No	Neither
8. B2B fintech infrastructure: core banking SaaS, KYC or fraud API, payments cloud	No financial licence	Indirectly, through customer contracts	Yes, if cloud, data centre, MSP or MSSP and at least medium-sized	NIS2 directly, DORA by contract

Legal basis: DORA Art 2(1)–(3); NIS2 Art 2(1) and Annexes I–II. Where a BNPL or lending product runs under a payment, e-money or banking licence, the row for that licence applies instead.

Row 4 is new. As France’s AMF notes, the MiCA transitional period ended EU-wide on 1 July 2026, so a crypto firm serving EU clients is now an authorised crypto-asset service provider inside DORA, or it should have wound down.

Why NIS2 skips most licensed fintechs

In plain terms: NIS2 covers “banking”, but its definition of a bank excludes payment and e-money institutions. Being regulated by a financial supervisor doesn’t put you on the NIS2 list.

Annex I of Directive (EU) 2022/2555 (NIS2) has two financial sectors. Sector 3, banking, covers “credit institutions as defined in Article 4, point (1), of Regulation (EU) No 575/2013”. Sector 4 covers operators of trading venues and central counterparties. Annex II, the “other critical sectors” list, has no financial sector at all.

The credit-institution definition is where e-money firms sometimes get misfiled. Before 2009 they were credit institutions: Article 4(1)(b) of Directive 2006/48/EC defined a credit institution as a deposit-taker “or” an electronic money institution. Directive 2009/110/EC ended that. Its Article 20 cut the definition back to deposit-taking and lending, and its Article 6(2) bars e-money institutions from taking deposits. An EMI can’t meet that definition, so it isn’t a NIS2 banking entity at any size.

Payment institutions are further away still. Under Article 4(4) of PSD2, a payment institution is a separately authorised legal person, and Article 33 treats registered account information service providers as payment institutions. Neither status appears in either NIS2 annex.

Two things follow, and both get missed:

• NIS2’s size-independent triggers can’t catch you. Article 2(2), the “regardless of their size” rule, applies only to “entities of a type referred to in Annex I or II”, which a payment institution isn’t.
• National law can still go further. NIS2 is minimum harmonisation (Article 5), so a Member State may extend its act to more of its financial sector. Check your national transposition.

When we ran DORA’s 20 financial-entity types against NIS2’s two financial sectors, only three types overlapped: credit institutions, trading venues and central counterparties. The other seventeen, including every licence a typical fintech holds, are DORA-only by design.

When both apply: banks and venue operators

In plain terms: a fintech with a banking licence is identified under NIS2 but works to DORA. You keep the NIS2 status, and DORA does the heavy lifting.

The bridge sits in DORA. Its Article 1(2) makes it a “sector-specific Union legal act for the purposes of Article 4” of NIS2 for financial entities identified as essential or important. NIS2 Article 4(1) then switches off “the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII” where the sector act is at least equivalent. NIS2 Recital 28 states the intent that DORA’s rules “should apply instead”, but recitals don’t bind; Article 4 does.

DORA Article 1(2) speaks of entities already identified under NIS2, so the bank stays on the national list. Which residual duties survive depends on national transposition. Our guide on why DORA doesn’t cover all banking walks through the residual layer, and the Article 2(3) exclusion list covers the financial entities that fall out of DORA altogether.

DORA has no size floor, but it does have a small-firm lane

In plain terms: NIS2 ignores firms with fewer than 50 staff unless they are in a size-independent category. DORA applies to a five-person payment institution, but with real relief. The relief depends on your licence type more than your headcount.

NIS2 Article 2(1) brings in only entities that qualify as at least medium-sized under Commission Recommendation 2003/361/EC. A small enterprise there has fewer than 50 staff and turnover and/or balance sheet of no more than €10 million, counted with linked enterprises. DORA has no such gate, only two separate reliefs that are often confused.

Your situation	DORA treatment	Source
Payment or e-money institution operating under a national exemption (small PI under PSD2 Art 32, exempted EMI)	Articles 5–15 switched off; replaced by an eight-point simplified ICT risk framework	DORA Art 16(1)
Fully authorised firm with fewer than 10 staff and turnover and/or balance sheet ≤ €2 million	Full Chapter II applies, minus the “other than microenterprises” carve-outs	DORA Art 3(60) and carve-outs across Arts 5–30
Fully authorised firm above microenterprise size	Full regime, applied proportionately to size, risk profile and complexity	DORA Art 4(1)

The trap is reading Article 16 as a microenterprise rule. Its list is defined by licence: small and non-interconnected investment firms, exempted payment and e-money institutions, certain exempted credit institutions and small pension funds. A fully authorised payment institution with eight employees gets the microenterprise carve-outs, not Article 16. We counted the phrase “other than microenterprises” 19 times in DORA’s operative text. Among them: no separate ICT risk control function (Art 6(4)), periodic rather than annual framework reviews (Art 6(5)), no internal audit of the framework (Art 6(6)), no formal resilience testing programme (Art 24(1)), no third-party risk strategy (Art 28(2)), and delegable audit rights over providers (Art 30(3)). Hire your tenth employee and they all fall away at once, so plan the control function and testing programme before that hire.

B2B fintech vendors: NIS2 directly, DORA through the contract

In plain terms: if you sell software or infrastructure to banks and payment firms, NIS2 may regulate you as a digital provider, and DORA will reach you through every customer contract.

NIS2 Annex I lists cloud computing service providers and data centre service providers (sector 8) and managed service and managed security service providers (sector 9). The managed-service definition is broad: installing, managing, operating or maintaining ICT products, infrastructure or applications for customers, on site or remotely. A core-banking host or a payments platform you run for clients can fit. At medium size you are an important entity; above the medium-sized ceilings, an essential one. Whether a pure SaaS API is a “cloud computing service” is a classification call to document and, if unclear, confirm with your national authority.

DORA’s route in is commercial. Article 28(1)(a) keeps your customers “fully responsible” whatever they outsource, so they push the obligations down to you. Article 30(2) lists nine minimum contract elements for any ICT service, from data locations to termination rights. Article 30(3) adds six more where your service supports a critical or important function, including service levels with precise performance targets, participation in the customer’s threat-led penetration testing, ongoing performance monitoring with access, inspection and audit rights, and exit strategies with a transition period. Expect your next renewal to carry all fifteen.

Direct DORA supervision is for a small group. On 18 November 2025 the European Supervisory Authorities designated the first critical ICT third-party providers, using financial entities’ registers of information. The published list has 19 names, mostly cloud, telecom and IT-services groups; the closest to fintech infrastructure are FIS, Bloomberg and LSEG Data and Risk. Everyone else meets DORA through contracts and questionnaires. Our breakdown of the supply chain gap DORA leaves shows the same relationship from the bank’s side.

One case is unsettled. A payment institution that also sells cloud services is a DORA financial entity and, for the cloud business, an Annex I entity. DORA Article 1(2) doesn’t say which annex the identification must come from, while NIS2 Article 4(1) keeps NIS2 alive for entities “not covered by” the sector act. Whether DORA displaces NIS2 for the cloud line is open at EU level, so get your authority’s position in writing.

When neither law applies, and what still does

In plain terms: “out of scope of both” means no cybersecurity regulator of your own. It doesn’t mean no security obligations.

Three fintech profiles usually land here. First, SME insurance intermediaries: DORA Article 2(3)(e) excludes those that are micro, small or medium-sized, and NIS2 never lists insurance. Second, non-bank lenders and buy-now-pay-later providers lending without a payment, e-money or banking licence: creditors aren’t on DORA’s list. From 20 November 2026, Article 37 of Consumer Credit Directive (EU) 2023/2225 subjects such creditors to admission, registration and supervision, but that is conduct regulation, not a cybersecurity regime. Third, B2B vendors below medium size.

All three still face security obligations from three directions:

• GDPR. Article 32 of Regulation (EU) 2016/679 requires appropriate technical and organisational security measures from controllers and processors alike.
• Customer contracts. If any customer is a DORA financial entity, the Article 30 clauses arrive regardless of your own scope.
• The Cyber Resilience Act, if you sell a product with digital elements such as a payment terminal or hardware wallet. Under Regulation (EU) 2024/2847, manufacturers’ reporting obligations (Article 14) apply from 11 September 2026 and the Regulation as a whole from 11 December 2027.

Deadlines and penalty exposure at a glance

Date	What happened or happens	Fintech models affected
17 Jan 2025	DORA applies (Art 64)	Rows 1–6
18 Nov 2025	First 19 critical ICT third-party providers designated	Row 8 and its customers
1 Jul 2026	MiCA transitional period ends EU-wide	Row 4
11 Sep 2026	CRA Article 14 reporting obligations apply	Product manufacturers
20 Nov 2026	Consumer Credit Directive 2023/2225 applies	Row 7
11 Dec 2027	CRA applies in full	Product manufacturers

Regime	Maximum penalty set at EU level	Who enforces
NIS2, essential entity	Member States must set a maximum of at least €10 million or 2% of worldwide turnover, whichever is higher (Art 34(4))	National NIS2 authority
NIS2, important entity	At least €7 million or 1.4% (Art 34(5))	National NIS2 authority
DORA, financial entity	No EU figure; Member States set administrative penalties (Art 50(3))	National financial supervisor
DORA, critical ICT provider	Periodic penalty of up to 1% of average daily worldwide turnover, for up to six months (Art 35(7)–(8))	Lead Overseer (an ESA)

Actual amounts depend on national law and authority discretion. Confirm with your national competent authority.

What to do next, by role

Role	First action
Founder or CEO	Record in one memo which row of the scope map you are in and why. Re-run it after every licence change or funding round.
CTO or CISO	Microenterprise: list the carve-outs you rely on and when you expect to pass 10 staff. Vendor: map your controls to the 15 Article 30 contract elements before customers ask.
Board	Under DORA Article 5(2) the management body approves and is responsible for the ICT risk management framework. If you’re DORA-only, minute that approval under DORA, not NIS2.

Frequently asked questions

Does NIS2 apply to payment institutions?

Not at EU level. The only financial entities in NIS2’s annexes are credit institutions, trading venue operators and central counterparties. A national law can extend scope under Article 5. DORA applies to payment institutions either way, including small exempted ones.

Is an e-money institution a bank under NIS2?

No. Directive 2009/110/EC removed e-money institutions from the credit-institution definition and bars them from taking deposits. DORA Article 2(1)(d) covers them instead.

Does DORA apply to a fintech with five employees?

Yes, if it holds a licence on DORA’s list. An exempted small payment or e-money institution uses the Article 16 simplified framework; a fully authorised one applies the full framework minus the microenterprise carve-outs.

We sell SaaS to banks. Are we DORA-regulated?

Not directly, unless designated a critical ICT third-party provider. Your bank customers must still put Article 30 terms in place with you, and if you are a cloud, data centre or managed service provider of at least medium size, NIS2 applies in its own right.

Summary

For fintechs, DORA versus NIS2 is a licence question with a size modifier. Banks and venue operators get both, with DORA in charge. Payment, e-money, open-banking, crypto, investment and crowdfunding licences get DORA alone. Medium-sized technology vendors get NIS2 directly and DORA by contract. Everyone else still owes GDPR security and whatever their customers’ contracts demand. Write down your row, and revisit it whenever your licence or headcount changes.

Sources

1. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA): Articles 1(2), 2, 3(60), 4, 5, 6, 16, 24, 26, 28, 30, 31, 35, 50 and 64 — EUR-Lex. Linked in the scope map section above.
2. Directive (EU) 2022/2555 (NIS2): Articles 2, 3, 4, 5, 6 and 34, Recital 28, Annexes I and II — EUR-Lex. Linked in “Why NIS2 skips most licensed fintechs” above.
3. Directive 2009/110/EC on electronic money institutions: Articles 2(1), 6(2) and 20 — EUR-Lex. Linked above.
4. Directive 2006/48/EC relating to the taking up and pursuit of the business of credit institutions: Article 4(1) — EUR-Lex. Linked above.
5. Directive (EU) 2015/2366 (PSD2): Articles 4(4), 32 and 33 — EUR-Lex. Linked above.
6. Commission Recommendation 2003/361/EC on the definition of micro, small and medium-sized enterprises: Annex, Articles 2 and 3 — EUR-Lex. Linked above.
7. Directive (EU) 2023/2225 on credit agreements for consumers: Articles 37 and 48 — EUR-Lex. Linked above.
8. Regulation (EU) 2024/2847 (Cyber Resilience Act): Articles 14 and 71 — EUR-Lex. Linked above.
9. Regulation (EU) 2016/679 (GDPR): Article 32 — EUR-Lex. Linked above.
10. European Supervisory Authorities designate critical ICT third-party providers — ESMA, 18 November 2025. Linked above.
11. List of designated critical ICT third-party service providers (DORA Article 31(9)) — ESAs Joint Committee, November 2025. Linked above.
12. End of the MiCA transitional period: ESMA sets out its expectations of professionals and warns retail investors — Autorité des marchés financiers, 23 June 2026. Linked above.