Supply chain assurance for banking and financial services

Banking sits in NIS2 Annex I, but for most financial entities the operative rulebook for ICT and third-party risk is DORA — the Digital Operational Resilience Act, applying since 17 January 2025. NIS2 explicitly gives way where a sector-specific EU act imposes at-least-equivalent requirements, and for banks, insurers, investment firms, and payment institutions, DORA does exactly that for ICT risk management, incident reporting, and third-party assurance. In practice: if you are a regulated financial entity, your supervisor asks DORA-shaped questions; NIS2 shapes the world around you — your suppliers, your corporate-services providers, the non-financial entities in your group.

The mid-market pressure point is real on both sides of that line. Regional and cooperative banks, payment institutions, and insurance intermediaries carry the same register-and-evidence expectations as tier-one institutions with a fraction of the staff — and every ICT vendor selling into financial services now faces due-diligence questionnaires with regulatory force behind them.

The two regimes ask structurally similar things of supplier assurance. DORA requires financial entities to maintain a register of information covering all ICT third-party contractual arrangements, to embed specific contractual provisions with ICT providers, to run documented risk assessment before contracting and on material change, and to hold documented exit strategies for critical ICT services. Its most distinctive move is direct EU-level oversight of critical ICT third-party providers — the large cloud and core-platform vendors financial entities concentrate on. NIS2 Article 21(2)(d) asks for the same operational discipline — assessed supplier register, per-supplier evidence, decision trail, reaction to material change — from the essential and important entities it covers.

The practical consequence of the overlap: the artefact shapes converge, the legal bases differ. A supplier inventory, per-supplier assessment evidence, and a defensible decision trail serve a bank answering its DORA supervisor and a manufacturer answering its NIS2 authority alike — but each regime has its own register format, notification cadence, and contractual checklist, and copy-pasting one regime’s paperwork into the other’s inspection is exactly the shortcut a supervisor notices.

Financial-sector supply chains are thin and concentrated: a core banking platform, one or two payment processors, a primary cloud provider, and a long tail of specialised fintech and data vendors. Concentration risk is a named regulatory concern — when much of a national banking sector depends on the same handful of ICT providers, the assurance question stops being “is this vendor sound” and becomes “what happens to us all if it isn’t.” Sub-outsourcing chains run deep: the fintech you contract runs on a hyperscaler, integrates three data providers, and each layer has its own sub-processors.

The assurance flow is also unusually bidirectional. Every vendor serving banks answers heavyweight due-diligence questionnaires repeatedly — the same posture, proven bespoke, for every institution — while banks’ own corporate suppliers increasingly arrive with NIS2 obligations of their own. And because financial services ran outsourcing-risk frameworks long before DORA, legacy contracts are common: agreements written a decade ago, still running, with none of the notification, audit-access, or exit provisions the current regime expects.

Vittnor — Supply Chain Assurance for the mid-market — is built for NIS2 Article 21(2)(d) supplier assurance. The operational spine it provides — a maintained supplier inventory, per-supplier assessment evidence with reviewer attribution, a timestamped decision trace, reviewer-flagged re-review on material change — is the same discipline DORA’s ICT third-party regime expects, and that is precisely why the honest boundary matters: DORA-specific register-of-information exports and cross-regime evidence packs are not a current capability; cross-framework routing is on the v2 roadmap. Describing your regulatory landscape is our job; overclaiming into it is not.

Where the product fits today: financial-sector buyers running structured NIS2-shaped supplier assurance over their concentrated ICT estate, with hash-anchored evidence and exports an auditor can ingest — and, on the supplier side, the fintech and ICT vendors answering bank due diligence, whose evidence library keeps every artefact current and organised so the next questionnaire starts from what they already proved; cross-buyer reuse is planned for later versions. For entities without a dedicated second line, the one-off NIS2 Supplier Exposure Assessment maps the supplier-risk landscape first.