CRA Fintech Compliance — Banking Software in the EU

Key figures

Art. 12

CRA relationship with DORA and NIS2 — product obligations are additive

Annex III

Banking software may qualify as Important if it includes identity management, PKI or network management

€15M

Maximum fine under Art. 64(2) — separate from any DORA or NIS2 penalty

How to proceed

Distinguish entity regulation from product regulation

DORA and NIS2 regulate the financial institution (the entity). The CRA regulates the software product you sell to the institution. You are the manufacturer, not the regulated entity under DORA. Both regulatory layers coexist.

Classify your product under CRA categories

Identity management systems (Annex III Class I item 1), password managers (item 3), PKI software (item 9), network management systems (item 6), and VPN products (item 5) are Important Class I. Firewalls and IDS/IPS (Annex III Class II items 1-2) are Important Class II. Standard banking applications fall under Default.

Conduct the CRA cybersecurity risk assessment

Art. 13(2)-(3): the assessment must cover the product's intended purpose in financial infrastructure, foreseeable use in regulated environments, and the operational context of banking deployments.

Compile Art. 31 technical documentation

Annex VII applies. Your financial institution clients will request this documentation as part of their DORA ICT third-party risk management under DORA Art. 28.

Align vulnerability handling with DORA expectations

Art. 13(6)-(8): your vulnerability handling and security update delivery must match the SLA expectations of financial institutions. DORA Art. 28 requires financial entities to assess ICT third-party providers — your CRA documentation feeds into their assessment.

Prepare ENISA reporting

Art. 14 applies from September 2026. A vulnerability in your banking software may simultaneously trigger CRA Art. 14 notification (your obligation as manufacturer) and your client's NIS2/DORA incident reporting (their obligation as entity).

Common mistakes

❌

REGULATORY CONFLATION

Assuming DORA compliance by your clients covers your CRA obligations

DORA (Regulation (EU) 2022/2554) regulates financial entities, not software vendors. The CRA (Regulation (EU) 2024/2847) regulates products with digital elements, including banking software. Your client's DORA programme covers their entity risk. Your CRA obligation covers your product's cybersecurity. These are separate, additive obligations on different parties.

❌

CLASSIFICATION UNDERESTIMATION

Treating your banking software as Default category when it includes identity management

Annex III Class I of Regulation (EU) 2024/2847 lists identity management systems (item 1), password managers (item 3), and PKI software (item 9). If your banking product includes authentication, access control, or certificate issuance functionality, it may be Important Class I — requiring conformity assessment beyond internal control.

❌

DUAL REPORTING GAP

Not preparing for parallel CRA and DORA/NIS2 incident reporting

A vulnerability in your banking product may trigger your 24h CRA Art. 14 notification to ENISA and your client's NIS2 or DORA incident report simultaneously. If you are not prepared for both channels, the lag in one notification delays the other — compounding regulatory exposure for both parties.

What the ZIP contains

8 PDF documents generated from your data. Each cites the specific article of Regulation (EU) 2024/2847 it complies with.

Product Classifier

Determines whether your banking software falls under Default, Important Class I (if it includes identity management, PKI, VPN, network management per Annex III) or Important Class II (if it includes firewall/IDS/IPS per Annex III).

Technical Documentation

Art. 31 and Annex VII file structured for banking software: system architecture, API security, data encryption, authentication mechanisms, component inventory.

Risk Assessment

Cybersecurity risk assessment per Art. 13(2)-(3) scoped to financial infrastructure deployment: transaction integrity, data confidentiality, authentication bypass risks, API exposure.

User Information

Annex II information adapted for financial institution deployment: secure configuration, integration guidelines, support period, vulnerability reporting channel.

Declaration of Conformity

EU Declaration per Art. 28 and Annex V for the banking software product.

CVD Policy

Coordinated vulnerability disclosure policy aligned with financial sector responsible disclosure expectations.

Notification Template

ENISA notification template per Art. 14. Structured to enable parallel submission with DORA/NIS2 incident channels.

Obligations Calendar

Key CRA dates with DORA alignment: Art. 14 from September 2026, full CRA enforcement December 2027, DORA ICT third-party review cycles.

See before you buy — Download sample dossier (PDF, fictional company) — Real structure, real articles, real format. Fictional data.

Generated from your data, in your browser. No data leaves your device.

What you pay

🧾 FINANCIAL SECTOR COMPLIANCE CONSULTANCY

CRA + DORA gap analysis for banking software

€15,000-40,000 per product

12-24 weeks

Requires sharing source architecture with consultant

Report-based — does not produce Art. 31 file

Re-engagement per product version

✓ CRACHECK — ART. 31 DOCUMENTATION

8-document technical file for your banking product

€149 per product

15-25 minutes

System architecture data stays in your browser

Feeds directly into your clients' DORA Art. 28 assessments

30-day edit window, 10 regenerations

Permanent PDF

Two layers

● LAYER 1 — DOCUMENTATION · CRACHECK

The CRA documentation layer

CRACheck generates the Art. 31 and Annex VII technical documentation for your banking software product. The output serves two purposes: CRA compliance for you as manufacturer and evidence for your financial institution clients' DORA ICT third-party risk assessments. Eight documents per product.

∅ LAYER 2 — NOT INCLUDED

What CRACheck does not address

CRACheck does not produce DORA compliance documentation for your clients. It does not conduct penetration testing on your banking APIs. It does not certify your product against PCI-DSS, ISO 27001 or EBA guidelines. It does not perform the conformity assessment if your product requires a notified body under Art. 32 (Important Class II or Critical). It does not submit ENISA or DORA incident notifications on your behalf.

The CRA adds a product layer to financial sector regulation. CRACheck structures that product layer.

Enforcement regime

📅

11 September 2026 — Art. 14 reporting for product manufacturers

Your ENISA notification obligation is separate from your clients' NIS2/DORA reporting. Both channels must be operational.

⚖️

11 December 2027 — Full CRA enforcement

Banking software placed on the EU market must carry CE marking and Art. 31 documentation. Financial institution procurement will require this as standard.

🔒

Art. 64(2) — €15M or 2.5% of global turnover

Independent of any DORA or NIS2 penalty your client may face. The CRA fine applies to you as the product manufacturer.

Alternatives

Criterio	Financial compliance consultancy	Internal legal team	DORA-only approach	CRACheck
Price	€15K-40K	Staff time	Incomplete	€149 per product
Covers CRA product obligations	Partially	Depends on expertise	No — DORA covers entities	Yes — 8 Art. 31 documents
Feeds DORA Art. 28 assessment	Report only	Possibly	N/A	Structured technical file
Data privacy	Shared with consultant	Internal	N/A	100% browser-side
CRACheck	€149	Yes	Structured	Browser-side

Multiple banking modules or fintech products? Document the entire portfolio.

Pack 10: €99 per product. Pack 30: €79 per product. For fintech companies with multiple EU-deployed products, contact us for enterprise pricing.

Request volume pricing

Commercial enquiries via hello@solidwaretools.com

What CRACheck guarantees and what it does not

CRACheck generates a structured document set according to Art. 31 and Annex VII of Regulation (EU) 2024/2847 based on the information you provide about your banking software product. The accuracy of the data — including system architecture, security mechanisms and component inventories — is your responsibility as manufacturer.

We guarantee that the document structure follows Art. 31 and Annex VII and that the legal references cited are correct. We do not guarantee acceptance by a market surveillance authority, a financial regulator, or a financial institution's procurement process.

CRACheck is not legal advice. For the interaction between CRA, DORA, NIS2 and sector-specific financial regulation, consult a qualified fintech regulatory lawyer.

Frequently asked questions

Does DORA replace the CRA for banking software?

No. DORA (Regulation (EU) 2022/2554) regulates financial entities' ICT risk management. The CRA (Regulation (EU) 2024/2847) regulates the products those entities buy. Art. 12 of the CRA addresses the relationship with other Union law, and Art. 2(5) allows the Commission to limit CRA scope where sectoral rules achieve equivalent protection. Until such a delegated act is adopted, the CRA applies in full to banking software products placed on the EU market.

If our banking software includes identity management, is it Important Class I?

Annex III Class I item 1 of Regulation (EU) 2024/2847 lists "identity management systems and privileged access management software and hardware, including authentication and access control readers." If your banking software's core function is identity or access management, it falls under Important Class I. If identity management is an ancillary feature of a broader banking platform, classification depends on whether the identity component is placed on the market separately.

Will financial institution procurement require CRA documentation?

DORA Art. 28 requires financial entities to assess ICT third-party service providers. As CRA enforcement approaches, procurement departments will include Art. 31 documentation as part of their ICT risk assessment. Having the documentation ready positions your product for procurement approval.

Our product processes personal data. Does the CRA overlap with GDPR?

Art. 2 of Regulation (EU) 2024/2847 does not exclude products processing personal data. Annex I Part I point (2)(e) requires data confidentiality and encryption. Annex I Part I point (2)(g) requires data minimisation. These CRA requirements complement GDPR but do not replace it. CRACheck's Risk Assessment PDF covers cybersecurity aspects — GDPR's DPIA covers data protection aspects.

Is this a subscription?

No. One-time payment. The licence includes 30 days of editing and 10 regenerations. The downloaded PDF is yours permanently.

Can I request a refund?

Under Art. 16(m) of Directive (EU) 2011/83, activating the licence constitutes express consent for immediate generation of digital content, waiving the 14-day withdrawal right. Refunds are only processed for reproducible technical failures.

What if the regulation changes?

If Regulation (EU) 2024/2847 is amended during your licence window, you can regenerate the documentation using the updated version of the generator at no additional cost.

Official legal sources

Regulation (EU) 2024/2847 — Cyber Resilience Act — full text
Regulation (EU) 2022/2554 — DORA — Digital Operational Resilience Act

⚠️ Important notice: CRACheck is a self-assessment documentation tool, not legal advice and not a third-party audit. The document under Article 31 and Annex VII of Regulation (EU) 2024/2847 is generated from your input data. You are responsible for the accuracy of the data you provide. CRACheck does not replace a qualified professional assessment.