Financial Services
Two rulebooks, one institution — and only one of them applies to you.
Banks, trading venues, and central counterparties sit in the financial sector. But before any obligation matters, one question comes first: are you covered by DORA? If so, the BSIG hands most of its duties back to DORA — and almost nobody tells you that upfront.
Does this apply to you?
Annex 1 · Sector 3
Sector: Financial sector
Banking (credit institutions that take deposits and grant credit for their own account) and financial market infrastructure (trading venues under Section 2(22) WpHG and central counterparties).
Entity of essential importance
at least 250 employees — or annual turnover above €50 million and an annual balance sheet total above €43 million
Applies to entity types under Annex 1 · Section 28(1), (2) BSIG
Important entity
at least 50 employees — or annual turnover and balance sheet total above €10 million
Applies to entity types under Annexes 1 and 2 · Section 28(1), (2) BSIG
Important for you: The sentence that matters most for you sits in Section 28(6) BSIG: for financial entities within the meaning of Article 2(2) of the DORA Regulation (EU) 2022/2554, Sections 30, 31, 32, 35, 36, 38 and 39 BSIG do NOT apply — the DORA regime takes their place instead. Building both in parallel means doing the work twice. Which regime applies to you is a question for legal counsel.
Covered regardless of size: operators of critical facilities, qualified trust service providers, top-level domain registries, and DNS service providers (Section 28(1) Nos. 1, 2 BSIG); trust service providers always count as an important entity (Section 28(2) No. 1 BSIG). Employee count and financial figures are alternative thresholds (either one triggers coverage); for the financial figures, both values must be exceeded. Whether your specific company is covered is a case-by-case question — that's what lawyers are for.
What's typically in the register in this sector
These obligations decide it for you.
Section 28(6) BSIG
First: work out which rulebook applies
DORA entities lose the central BSIG duties. That's not a decision you can skip — it determines the shape of your entire project.
Section 30(2) No. 4 BSIG
Keep outsourcing arrangements under control
Where the BSIG does apply: the security-relevant aspects of your relationships with ICT service providers need to be governed — the same discipline DORA asks of you anyway.
Section 38 BSIG
A management-level duty, with liability attached
Management implements the measures and oversees their execution; a breach of duty creates liability toward the entity itself, primarily under company law.
Example (fictional): The institution that paid twice
A smaller institution kicks off a project to build an information security management system after the NIS2 transposition — consultants, workshops, six months of work. In parallel, the DORA implementation is already running in-house, because the supervisor is asking about it.
At the first joint steering meeting, it becomes clear that both projects are tackling the same outsourcing arrangements, the same incidents, and the same responsibilities. The question of which regime even applies should have been asked at the start — not in month seven.
A freely invented example for illustration — no real customer, no legal advice
Here's how Compliverse takes this off your plate.
- 1
The compass clarifies your role first: which regime applies, and which modules you actually need.
- 2
Outsourcing arrangements and service providers go into one register with criticality and contract status — usable for both regimes.
- 3
The management report makes board-level oversight demonstrable, instead of buried in meeting minutes.
NIS2 in Financial Services: frequently asked questions
Is my Financial Services company in scope for NIS2?
Your sector is covered by Germany's BSI Act: Annex 1 · Sector 3, sector Financial sector. That does not put you in scope automatically — a size threshold has to be met as well (Section 28(1), (2) BSIG). And no official notice arrives: you assess the classification yourself and register if it applies (Section 33 BSIG). Your sector also has an exception — it is set out on this page under “Are you in scope?”. Judging your individual case is a lawyer's job.
From what size does NIS2 apply to us?
You count as an essential entity from at least 250 employees — or annual turnover above €50 million and an annual balance sheet total above €43 million; as an important entity from at least 50 employees — or annual turnover and balance sheet total above €10 million (Section 28(1), (2) BSIG). Headcount and financial figures are alternatives to each other — but where the financial figures are used, both have to be exceeded. Some entity types are in scope regardless of size, among them operators of critical facilities and qualified trust service providers.
Which authority is responsible for us in Germany?
Registration and supervision sit with the Bundesamt für Sicherheit in der Informationstechnik (BSI) — Germany's Federal Office for Information Security (Section 33 BSIG). Security incidents, however, do not go there: they go to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) — early warning within 24 hours, report within 72 hours, follow-up report a month later (Section 32 BSIG). This is the most common misreading of the act — the supervisory authority and the reporting office are not the same body.
What happens if we do not implement NIS2?
The obligations do not go away: registration stays due (Section 33 BSIG), so do the risk-management measures (Section 30(2) BSIG), and reporting deadlines start running with the first significant incident (Section 32 BSIG). On top of that, Section 38 BSIG puts management personally on the hook: they have to approve the measures, oversee their implementation, and undergo training themselves. “I didn't know” does not carry here.
Find out in thirty seconds what applies to you.
Four questions, an honest first estimate — then you'll know which module to start with and what it costs.
What becomes important next
More industries
Legal status checked on 01/09/2026 · Every statement with a source · No legal advice