How Nordic Supervisors Are Approaching DORA: Lessons From FIN-FSA, Finansinspektionen, and Finanstilsynet

The Nordic Paradox: Most Digital, Most Exposed

The Nordic countries are among the most digitally advanced financial markets in Europe. Sweden's Swish processes billions in real-time mobile payments annually. Finland's banking population is over 90% digital. Denmark's MobilePay is ubiquitous. Norway has achieved near-cashless status, with cash transactions representing a vanishing fraction of total payment volume.

This digital maturity means Nordic financial institutions are, in many ways, better prepared for DORA than their southern European counterparts. Their ICT infrastructure is modern, their digital service delivery is mature, and their technology investment levels are high. But the same digitization that creates preparedness also creates concentration risk. When nearly 100% of financial transactions flow through digital channels, the impact of an ICT disruption is not a degradation of service — it is a near-total halt of financial activity.

This paradox shapes how Nordic supervisors approach DORA. The regulatory framework's emphasis on operational resilience is not novel to Nordic supervision — the region has been thinking about digital resilience for years. What DORA adds is harmonization, specificity, and enforcement mechanisms that align the Nordics with the rest of the EU.

Supervisory Landscape

The Nordic financial supervisory architecture is shaped by EU membership status and national tradition:

Norway's position as an EEA member rather than an EU member creates a specific dynamic. DORA does not apply directly in Norway but is incorporated through the EEA Agreement. The Norwegian Finanstilsynet has indicated its intention to align national requirements closely with DORA, but the transposition timeline and any national adaptations create a transitional period where Norwegian institutions must track both the EEA incorporation process and the substance of DORA.

FIN-FSA: Finland's Pragmatic Approach

Finland's FIN-FSA has approached DORA implementation with characteristic pragmatism. Finland's financial sector is dominated by a small number of large institutions — with a few major banking groups controlling the vast majority of the market — which simplifies supervisory engagement but concentrates systemic risk.

FIN-FSA's key positions:

Proportionality in testing. FIN-FSA has emphasized that Art. 24-27 testing requirements must be proportionate to the institution's size and risk profile. For smaller Finnish institutions — credit unions, smaller payment providers — the expectation is basic resilience testing rather than full TLPT programmes.

Third-party concentration as a primary risk. FIN-FSA has identified third-party concentration as the most significant DORA compliance challenge for Finnish institutions. The Nordic financial sector's reliance on a small number of shared service providers — including shared core banking platforms and shared payment infrastructure — creates correlated failure risks that are difficult to mitigate at the individual institution level.

Coordinated approach with other Nordic supervisors. FIN-FSA participates actively in the Nordic-Baltic supervisory coordination framework, sharing approaches to DORA interpretation with Swedish, Danish, and Baltic supervisors.

Finansinspektionen: Sweden's Risk-Based Framework

Sweden's Finansinspektionen (FI) has long been one of Europe's most sophisticated financial supervisors. FI's approach to DORA builds on existing Swedish requirements for operational risk management, which in many areas already exceeded pre-DORA EU minimums.

Key Swedish dynamics:

BankID systemic dependency. Sweden's BankID — the digital identity system used by virtually all Swedish banks and many government services — represents a single point of failure that DORA's Art. 29 concentration risk provisions directly address. FI has indicated that institutions must assess their BankID dependency as part of their ICT third-party risk management and maintain contingency arrangements.

Swish and real-time payments. The Swish real-time payment system, owned collectively by Swedish banks, processes a substantial volume of person-to-person payments. Its operational resilience is both a shared responsibility and a potential systemic risk. DORA's requirements for resilience testing of critical payment infrastructure are particularly relevant.

Advanced supervisory data capabilities. FI has invested in supervisory technology and data analytics, positioning itself to conduct more granular DORA supervision than many other NCAs. Swedish institutions should expect data-driven supervisory inquiries rather than generic compliance questionnaires.

Finanstilsynet (Denmark): Dialogue-Oriented Supervision

Denmark's Finanstilsynet has historically favored a dialogue-oriented supervisory approach — engaging with institutions through structured conversations rather than purely formal examination processes. This tradition shapes the Danish approach to DORA.

Key Danish considerations:

Pension sector significance. Denmark's pension sector is among the largest in Europe relative to GDP. Pension funds (IORPs) are in DORA's scope, and Danish pension institutions must implement the full framework. FDK-FSA's guidance for the pension sector emphasizes that proportionality applies but does not exempt pension funds from the substance of DORA's requirements.

Nets/Nexi payment infrastructure. Denmark's payment infrastructure, including the Nets clearing system (now part of Nexi Group), is a critical shared dependency. DORA's Art. 28-30 provisions for critical ICT third-party providers apply directly to institutions' reliance on this infrastructure.

Cross-border Nordic banking groups. Several major Nordic banking groups operate across Denmark, Sweden, Finland, and Norway. These groups must navigate DORA supervision from multiple NCAs simultaneously, coordinating their compliance approach across jurisdictions.

Norway: EEA Transposition Dynamics

Norway's position as an EEA member creates a distinct implementation pathway. DORA must be incorporated into the EEA Agreement by the EEA Joint Committee before it becomes applicable in Norway. The Norwegian Finanstilsynet has been proactive in preparing the Norwegian financial sector for DORA-equivalent requirements.

Key Norwegian considerations:

DNB systemic importance. DNB, as Norway's largest financial institution, is a systemically important bank whose operational resilience has national significance. The Norwegian Finanstilsynet's approach to DNB's DORA compliance will set the benchmark for the entire Norwegian market.

Oil fund and sovereign wealth. Norway's Government Pension Fund Global (NBIM) operates significant financial infrastructure. While sovereign wealth funds are not directly in DORA's scope, the institutions that provide ICT services to NBIM may be affected.

Vipps payment ecosystem. Vipps (now part of Vipps MobilePay after the merger with Danish MobilePay) is a critical Nordic payment platform. Its operational resilience is a shared concern across Norwegian and Danish supervision.

Cross-Nordic Themes

Several themes emerge consistently across all four Nordic supervisory approaches:

1. Shared Infrastructure Concentration

The Nordics share critical financial infrastructure — payment platforms (Swish, Vipps MobilePay), identity systems (BankID variants), clearing systems, and core banking platforms. This creates concentration risks that no single institution can fully mitigate and that no single NCA can fully supervise.

2. Digital-First Population Vulnerability

When 95%+ of a population relies on digital financial services, the societal impact of an ICT disruption is proportionally higher than in markets where cash and branch services provide fallbacks. Nordic supervisors are particularly attentive to Art. 11 business continuity requirements and the institution's ability to maintain critical services during extended ICT outages.

3. Cross-Border Banking Group Supervision

Nordea, Danske Bank, Handelsbanken, SEB, and other Nordic banking groups operate across multiple Nordic jurisdictions. DORA supervision of these groups requires coordination between the home NCA and host NCAs — a coordination mechanism that Art. 46-49 addresses through information sharing arrangements but that requires practical bilateral cooperation between Nordic supervisors.

Lessons for Nordic Institutions

Leverage existing maturity. Nordic institutions generally have stronger digital foundations than the EU average. Rather than building DORA compliance from scratch, map existing capabilities to DORA requirements and address gaps. The DORA readiness assessment can help identify where existing maturity covers DORA requirements and where gaps remain.

Address concentration risk proactively. Do not wait for supervisors to raise concerns about BankID, cloud, or payment infrastructure concentration. Document your concentration risk analysis, assess substitutability, and develop contingency arrangements. This is the area where Nordic institutions face the most scrutiny.

Coordinate across group entities. For cross-border banking groups, establish a single DORA compliance framework that spans all Nordic jurisdictions, with local adaptations for NCA-specific expectations. Avoid building parallel compliance structures in each country.

Prepare for data-driven supervision. Nordic supervisors, particularly Sweden's Finansinspektionen, are investing in supervisory technology. Expect structured data requests, quantitative assessments, and evidence-based examinations rather than narrative compliance questionnaires. Your evidence management capability must produce structured, exportable, verifiable data.

Consult the DORA pillars overview for a complete mapping of DORA's requirements, the glossary for regulatory terminology, and the RTS/ITS reference for the technical standards that underpin supervisory expectations. The EBA's ICT risk management guidelines and the ECB's supervisory approach to operational resilience provide additional context for understanding Nordic supervisory expectations within the broader EU framework.

Conclusion

The Nordic financial markets approach DORA from a position of relative strength — high digital maturity, sophisticated supervision, and a collaborative supervisory culture. But strength creates its own risks. The same digital dependencies that make Nordic banking efficient make it vulnerable to ICT disruptions with outsized societal impact.

Nordic supervisors understand this paradox. Their DORA enforcement will focus not on whether institutions have policies — the Nordics generally do — but on whether those policies are operationally effective, tested under realistic conditions, and backed by evidence that demonstrates genuine resilience. The bar is high, but so is the starting point.

---

Resume en francais

Les marches financiers nordiques — Finlande, Suede, Danemark et Norvege — apportent des caracteristiques uniques a la mise en oeuvre de DORA. Cet article analyse l'approche de chaque superviseur nordique : la FIN-FSA finlandaise avec son pragmatisme et son focus sur la concentration des tiers, la Finansinspektionen suedoise avec sa supervision basee sur les risques et l'attention portee aux dependances systemiques (BankID, Swish), la Finanstilsynet danoise avec son approche dialogique et l'importance du secteur des pensions, et la Finanstilsynet norvegienne avec les dynamiques specifiques de transposition EEA. Les themes transversaux incluent la concentration des infrastructures partagees (systemes de paiement, identite numerique, plateformes bancaires), la vulnerabilite accrue des populations 100% numeriques, et la supervision des groupes bancaires transfrontaliers. Les institutions nordiques sont conseillees de capitaliser sur leur maturite existante, d'adresser proactivement le risque de concentration, de coordonner a travers les entites du groupe et de se preparer a une supervision fondee sur les donnees.