DORA vs. NIS2 vs. PSD2: The Key Differences

In the rapidly evolving landscape of digital finance and cybersecurity, regulatory frameworks play a crucial role in ensuring the safety and integrity of services provided to consumers. Three significant regulations that have emerged in the European Union (EU) are the Digital Operational Resilience Act (DORA), the Network and Information Systems Directive 2 (NIS2), and the Revised Payment Services Directive (PSD2). While these regulations share common goals of enhancing security and operational resilience, they differ significantly in their scope, implementation, and compliance requirements. This article delves into the key differences among DORA, NIS2, and PSD2.

Implementation Date

The timelines for compliance with these regulations vary, impacting organizations differently. The deadline for implementing NIS2 was October 17, 2024, which has now passed. Organizations have a bit more time to comply with DORA, as the implementation date is set for January 17, 2025. Meanwhile, PSD2 is already active across the EU, but proposed changes, often referred to as PSD3, are expected to be introduced in the coming years, potentially altering the regulatory landscape once again.

Regulation Type

Understanding the nature of each regulation is essential for compliance. NIS2 is a directive, allowing EU member states the flexibility to develop rules tailored to their specific needs. In contrast, DORA is a sector-specific regulation that mandates uniform compliance across all EU member states, leaving no room for discretion. This means that DORA will be implemented identically in every EU country, while NIS2 can be transposed into national laws at different times and through various legislative processes.

PSD2, on the other hand, is a regulatory framework that each EU member state can adopt and implement according to its own legal system. While NIS2 is part of a broader cybersecurity framework, DORA takes precedence in sectors where specific rules apply, functioning as a lex specialis exemption.

Organizations Impacted

The scope of each regulation defines the organizations that must comply. NIS2 applies to entities categorized as either "essential" or "important." Essential entities include large enterprises providing critical services in sectors such as trust services, public electronic communication networks, and public administration. Important entities encompass all other organizations not classified as essential, including key digital service providers like cloud computing services and online marketplaces.

DORA primarily targets financial entities and critical ICT service providers, such as cloud service providers and their suppliers. It aims to ensure that these organizations maintain robust operational resilience.

PSD2 is applicable to banks, financial institutions, and any organization involved in retail payments or financial services within the EU. Notably, organizations based outside Europe may still need to comply with PSD2 if they serve customers in the region.

Cybersecurity Compliance

Cybersecurity compliance requirements vary significantly across these regulations. NIS2 emphasizes strengthening overall cybersecurity and incident reporting, mandating organizations to implement "appropriate and proportionate technical and organizational measures." This includes risk analysis, information security policies, incident handling, business continuity, and supply chain security.

DORA, however, is more prescriptive, introducing rigorous requirements for ICT risk management and incident reporting. Organizations must demonstrate that they conduct security testing on critical systems at least annually and address any vulnerabilities identified. DORA also mandates threat-led penetration testing every three years and various annual assessments.

PSD2 focuses on reducing fraud risk and preventing cyberattacks within the financial sector. It establishes security requirements across five key areas: open banking APIs, Strong Customer Authentication (SCA), customer transparency, rapid complaint resolution, and surcharge bans. The SCA requirement mandates multifactor authentication for user logins, enhancing security in payment processing.

Incident Reporting Requirements

All three regulations impose strict incident reporting requirements, but the specifics differ. NIS2 mandates an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. DORA’s requirements for "major" incidents are similar, with an initial notification within 24 hours, an intermediate notification within 72 hours, and a final report within one month.

PSD2 requires payment service providers to report incidents to the Financial Conduct Authority (FCA) within two hours of detection. If an incident is initially classified as non-major but later reclassified as major, DORA requires immediate reporting of the status change. The minimum reporting requirement for payment service providers is every three business days until the incident’s cause is understood.

Penalties for Noncompliance

The consequences of failing to comply with these regulations can be severe. Under NIS2, essential entities face fines of up to €10 million or 2% of their total worldwide annual turnover, whichever is higher. Important entities may incur fines of up to €7 million or 1.4% of their annual turnover. Additionally, NIS2 allows for the banning of C-level executives from future roles in cases of noncompliance.

Organizations that do not comply with DORA face corporate fines of up to 2% of annual turnover, fines for employees of up to €1 million, and fines of up to €500,000 for critical third parties. For PSD2, institutions can be penalized with financial fines of up to 4% of their annual returns.

Conclusion

In summary, while DORA, NIS2, and PSD2 share the common goal of enhancing security and operational resilience within the EU, they differ significantly in their implementation timelines, regulatory types, impacted organizations, cybersecurity compliance requirements, incident reporting protocols, and penalties for noncompliance. As organizations navigate these complex regulations, understanding their unique characteristics will be crucial for ensuring compliance and safeguarding their operations in an increasingly digital world.