Financial market infrastructures, meaning trading venues, central counterparties and clearing and settlement systems, run on platforms that must process large volumes of orders with latencies measured in milliseconds. A successful attack here does not affect a single institution but the entire settlement chain: interrupting a trading session, altering market data or making a central counterparty unavailable is transmitted instantly to all participants. On top of the technical risk sits a perception risk, because markets react to loss of confidence as fast as they react to an actual fault.
Directive (EU) 2022/2555 (NIS 2) lists financial market infrastructures in Annex I, among the sectors of high criticality. As with credit institutions, the framework has to be read together with Regulation (EU) 2022/2554 (DORA), which sets out ICT risk management, operational resilience testing and oversight of critical third-party providers for financial entities.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Financial market infrastructure sector
Essential entities:
Operators of trading venues and central counterparties (CCPs) as defined in the relevant Union financial services legislation.
- Operators of regulated markets, multilateral and organised trading facilities
- Central counterparties providing clearing services
- Central securities depositories and settlement systems
- Providers of market data and connectivity services to trading venues
Sector-specific cyber threats
- Disruption of trading sessions through denial of service or latency attacks
- Manipulation or corruption of market data feeds
- Unauthorised access to clearing and settlement systems
- Compromise of participant connectivity and order routing infrastructure
- Insider misuse of privileged access to trading platforms
- Attacks on time synchronisation used for transaction sequencing
NIS 2 requirements for the financial market infrastructure sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Instant propagation of any disruption to all market participants
- Dependency on precise time synchronisation and on communications networks
- Links with the banking sector for settlement of cash legs
- Concentration risk on a small number of critical ICT providers
In market infrastructure, availability and data integrity are the service itself. NIS 2 and DORA require tested resilience, close supervision of third-party providers and reporting arrangements that work under pressure, because the window for reacting to an incident is measured in minutes.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.