Norges Bank Financial Infrastructure Report 2026: oversight signal, not a binding circular

The Norges Bank Financial Infrastructure Report 2026 reads two ways. Day one it sounds reassuring: stable operations, few disruptions, NBO turning over around NOK 359 billion a day in 2025 and NICS handling roughly 9.6 million daily transactions. Day two it lays out a longer list of preparedness work the Bank now expects from banks, payment service providers and points of sale. The second read is the one operations teams should map.

The report is the public output of Norges Bank's oversight role under the Central Bank Act and the Payment Systems Act. It is not a binding circular and does not impose per-firm capital or reporting demands. What it does is signal which vulnerabilities the Bank treats as material, and that signal feeds straight into continuity planning, vendor due diligence and the next supervisory dialogue.

Concentration risk is the operational headline. Critical functions depend on a small number of providers of cloud, system software and core systems, and many firms run the same security software. Bits AS contracted Mastercard Payment Services Infrastructure to run NICS, so one technical operator sits behind the shared clearing system most Norwegian retail payments pass through before settling in NBO. The continuity test is whether one provider quietly sits behind several payment rails that look independent on the organisation chart. An outsourcing register that lists three suppliers but resolves to one cloud region or one core-banking vendor is reporting diversification that does not exist.

Norway implemented the EU Digital Operational Resilience Act through the DORA Act and DORA Regulation, both in force from 1 July 2025. The report states that threat-led penetration testing is mandatory for designated entities, run through TIBER-NO, with Finanstilsynet designating organisations and Norges Bank providing input. The Bank points to spring 2026 prioritisation of the 15 to 20 largest financial-sector entities with critical-infrastructure responsibility. TLPT is not a routine vulnerability scan or an annual pen test; it is a controlled, intelligence-led red-team test of critical live production systems.

NBO INST, the planned Norwegian krone instant-payment service on the Eurosystem TIPS platform, is on a revised timeline. Adapting the platform to settle kroner is more extensive than previously assumed, so a product team should not commit to a confirmed instant-settlement go-live date yet.

Self-preparedness applies at the point of sale. The Bank recommends multiple card solutions, QR-code fallback, cash reserves for change, and notes that some in-store cash services drop out when the BankAxept backup is activated. For acquirers and point-of-sale providers, that is a continuity signal, not a consumer note.

Source basis: Norges Bank Financial Infrastructure Report 2026 (10 June 2026); Norwegian Central Bank Act; Norwegian Payment Systems Act; Norwegian DORA Act and DORA Regulation (in force 1 July 2025); Regulation (EU) 2022/2554.

Full article: https://regreportingdesk.com/norges-bank-financial-infrastructure-report-2026/