Imprensa Nacional-Casa da Moeda, S.A.

Portugal · www.incm.pt · 12 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 12 sub-vendors.

Insights

Last updated 2026-08-15 · revision 2

12 direct vendors, 152 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Imprensa Nacional-Casa da Moeda, S.A. exhibits medium migration readiness. Strengths include the integration of modern technologies like Blockchain (EBSI node), AI, and Digital Identity, which suggests a capacity and willingness to adopt contemporary architectural patterns that can facilitate migration. The ISO 27001:2025 certification indicates a robust Information Security Management System, critical for ensuring data security and compliance throughout a migration process. The geographic diversity of vendor HQ/owner countries (6 unique countries) could imply a less concentrated vendor landscape, potentially reducing vendor lock-in if vendors are indeed utilized, though the 'Total Vendors: 0' entry creates ambiguity regarding the actual number of vendors. However, significant weaknesses and challenges exist. There is a lack of explicit information regarding cloud-native architecture, containerization, or microservices for core systems (beyond the EBSI node), making it difficult to assess the current state of their application portfolio's readiness for cloud migration. The use of WordPress for the corporate website, while functional, is not indicative of a fully cloud-native approach. Crucially, 'Data Residency Requirements: Not specified' is a major unknown that could pose substantial challenges and costs during migration, especially given their operations in multiple countries. The absence of financial stability data also prevents an assessment of the company's capacity to fund a potentially large-scale migration effort. The contradictory vendor data ('Total Vendors: 0' vs. listed geographic diversity) makes a precise assessment of vendor lock-in risk challenging, as the actual number of vendors and contract complexities are unknown.

Compliance

15 in-scope frameworks identified; showing 3.

NP EN ISO — Compliant

INCM's Contrastaria laboratories (Lisbon, Porto, and Gondomar) and the Graphic Raw Materials Laboratory hold accreditations from IPAC (Instituto Português de Acreditação) under NP EN ISO/IEC 17025. This standard is mandatory for testing and calibration laboratories and is directly relevant to INCM's precious metals assaying and quality control activities. Risk is Low because the accreditations are active and issued by the national accreditation body.

Evidence: https://incm.pt/site/certificacoes/, https://incm.pt/site/contrastaria/, https://www.ipac.pt/

ISO 14001 — Compliant

INCM holds a current ISO 14001:2015 certification (valid until 2027), issued by APCER, covering its environmental management system. Risk is Low because the certification is active and demonstrates systematic environmental compliance, which is particularly relevant given INCM's manufacturing operations (coin minting, security printing) involving chemical processes.

Evidence: https://incm.pt/site/certificacoes/, https://incm.pt/site/wp-content/uploads/2026/04/APCER-14001_validade-2027.pdf, https://incm.pt/site/responsabilidade-ambiental/

GDPR (source) — Partially Compliant

INCM is headquartered in Portugal (EU member state) and explicitly processes personal data of employees, customers, suppliers, and citizens (including biometric data for identity documents and passports). GDPR is universally applicable. INCM demonstrates strong structural compliance: it has a published Privacy Policy explicitly referencing GDPR/RGPD, a dedicated DPO contact (dpo@incm.pt), a GDPR data rights portal (rgpd.incm.pt), and an ISO 27001:2025 certification covering information security. However, the status is 'Partially Compliant' rather than 'Compliant' because: (1) no independent GDPR audit or CNPD (Portuguese DPA) compliance certification has been publicly disclosed; (2) INCM processes highly sensitive personal data (biometric data in passports, identity cards, residence permits, driving licences) which carries elevated risk under GDPR Articles 9 and 88; (3) the privacy policy was last revised in June 2023 and may not fully reflect the latest EDPB guidance. Risk is Medium rather than High because of the strong structural controls already in place (DPO, ISO 27001, published policy, data rights portal). Fines under GDPR can reach €20M or 4% of global annual turnover.

Evidence: https://incm.pt/site/politica-privacidade/, https://incm.pt/site/politica-de-seguranca-da-informacao/, https://incm.pt/site/certificacoes/, https://rgpd.incm.pt/, https://www.cnpd.pt/

Financials

Three-year financials

Financial Resilience Score: 8/10

INCM benefits from a highly resilient business model anchored in statutory monopolies granted by Portuguese law, including coin minting, secure identification documents (passports, national ID card, driving licences, residence permits), the official gazette (Diário da República), and precious-metals hallmarking. This creates stable, recurring public-sector revenue with minimal direct competition and strong visibility of demand tied to citizen and government needs. As a 100% state-owned enterprise under the Ministry of Finance, INCM also benefits from implicit sovereign support and low refinancing risk. Historically, the company has operated with annual turnover in the range of approximately €80–120 million and has been consistently profitable, paying dividends to the Portuguese State and financing significant capex from operating cash flow. Diversification across coins, secure documents, official publications, hallmarking, and editorial activity cushions the company against volatility in any single segment. INCM has also invested in digital identity, GovTec, and innovation programs, positioning itself for higher-value secure digital services. Modest but growing export activity, especially to Portuguese-speaking African countries, adds an incremental non-domestic revenue leg. Key risks include structural decline in physical printed publications and potentially in cash usage, dependence on Portuguese public procurement cycles, capital intensity of mint and secure-printing operations, and wage-cost pressures typical of Portuguese SOEs (recently evidenced by a 2026 salary agreement with unions).

Key strengths: Statutory monopolies on coin minting, ID documents, official gazette and hallmarking, 100% Portuguese State ownership providing implicit sovereign support, Diversified public-service portfolio across coins, documents, publications, hallmarking, Consistent historical profitability and dividend payments to the State, Export capability to PALOP and other third countries, Investment in digital identity, GovTec and innovation (INCM Lab, IN3+ Award, PRR projects)

Risk factors: Dependence on Portuguese public policy and public procurement cycles, Long-term structural decline in printed official publications and potentially cash usage, Revenue concentration on the domestic Portuguese market, Capital-intensive industrial base requiring cyclical capex, Wage-cost pressures under collective agreements typical of Portuguese SOEs

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report