Nykredit Bank A/S

Denmark · owned by Forenet Kredit f.m.b.a. (Denmark) · www.nykredit.dk · 35 vendors

Nykredit Bank A/S is one of Denmark's largest financial institutions, offering a full range of banking, mortgage (realkreditlån), savings, investment, pension, and insurance products to private individuals and businesses. It is part of the Nykredit Group and is uniquely owned by Forenet Kredit, a customer association, meaning profits are returned to customers through member benefits. The group is headquartered in Nordhavn, Copenhagen.

Resilience scores

Disruption prediction

Nykredit Bank A/S has an estimated 40% probability of disruption in the next 6 months.

17 of Nykredit Bank A/S's 35 vendors monitored for disruptions.

Technology vendors

Services catalogue

5 services in catalogue across 4 categories; runs on 35 sub-vendors.

Insights

Last updated 2026-07-30 · revision 23

35 direct vendors, 348 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Nykredit Bank A/S exhibits a medium level of migration readiness. Its strong financial performance, characterized by consistent growth in total income and net profit, provides substantial capacity to fund significant migration initiatives. The company's adoption of modern development practices, including Agile/Scrum, API Development (REST APIs), and contemporary programming languages (Java, .NET, Python, JavaScript/TypeScript), lays a solid foundation for transitioning to more cloud-native architectures. Additionally, the use of Cloudflare for CDN/Image Optimization suggests some existing familiarity and adoption of cloud services. However, several significant challenges temper its readiness. There is no explicit mention of widespread cloud-native technologies such as containerization (Docker, Kubernetes) or a fully microservices-based architecture, which are crucial for seamless and efficient cloud migration. The highly stringent regulatory environment, encompassing GDPR, Danish Financial Business Act, Basel III, MiFID II, AML, and NIS2 (as an essential entity), imposes complex compliance requirements related to data sovereignty, security, and audit trails, making cloud migration more intricate. Data residency requirements, highly probable within the EU/EEA, further restrict the choice of cloud regions. A critical unknown is the vendor landscape: the data states 'Total Vendors: 0' but also lists 'Total Services: 66' and diverse vendor HQ countries. This ambiguity makes it difficult to assess the actual number of unique vendors and the associated vendor lock-in risk, which is explicitly stated as 'Unknown.' High vendor lock-in could significantly impede migration efforts. The sheer volume of 66 listed services also suggests a complex ecosystem that would require extensive planning and effort to migrate.

Compliance

12 in-scope frameworks identified; showing 3.

DORA (source) — Assessment Required

DORA became fully applicable to EU financial entities on 17 January 2025. The risk is High because: (1) DORA is legally mandatory for all EU credit institutions including Nykredit Bank A/S; (2) it imposes comprehensive ICT risk management, incident reporting, digital operational resilience testing (TLPT), and third-party ICT provider oversight requirements; (3) Nykredit's extensive digital banking infrastructure (netbank, mobile banking, payment processing, Markets platform) and reliance on third-party ICT providers (BEC datacenter, cloud providers) creates significant DORA compliance scope; (4) Finanstilsynet is the competent authority for DORA compliance in Denmark's banking sector; (5) non-compliance can result in fines up to 1% of average daily worldwide turnover for up to 6 months. The 'Assessment Required' status reflects that while DORA applicability is certain, Nykredit's specific DORA compliance posture and any formal DORA assessment documentation has not been publicly disclosed.

Evidence: https://www.nykredit.com/en-gb/investor-relations/regulation/danish-fsa/, https://www.nykredit.com/en-gb/investor-relations/regulation/, https://www.nykredit.dk/om-os/lovpligtig-information/

GDPR (source) — Compliant

Nykredit Bank A/S is headquartered in Denmark (EU member state) and processes extensive personal data of millions of customers, employees, and suppliers — making GDPR fully and unambiguously applicable. The risk level is assessed as Medium rather than Low because: (1) the volume and sensitivity of financial personal data processed is very high (banking, mortgage, investment, pension data); (2) Danish Datatilsynet (Data Protection Authority) is an active enforcement body with a track record of issuing fines and reprimands to financial institutions; (3) Nykredit processes special categories of data (financial health, creditworthiness) that attract heightened scrutiny; (4) the bank uses third-party data processors (e.g., BEC datacenter) which introduces supply-chain data risk. However, the risk is not High because Nykredit has demonstrably implemented a robust GDPR compliance framework: a formally appointed DPO, published privacy policies, data subject rights portals (access, portability, erasure), 72-hour breach notification procedures, and data processor agreements with all partners.

Evidence: https://www.nykredit.dk/personoplysninger-og-cookies/, https://www.nykredit.dk/en-gb/personoplysninger-og-cookies/privacy-policy-of-nykredit-bank-as/, https://www.nykredit.dk/personoplysninger-og-cookies/personoplysninger---bank/, https://www.nykredit.dk/kundeservice/selvbetjening/gdpr/gdpr-indsigt/, https://www.nykredit.dk/kundeservice/selvbetjening/gdpr/gdpr-dataportabilitet/, https://www.nykredit.dk/kundeservice/selvbetjening/gdpr/gdpr-sletning/

SFDR — Compliant

SFDR is applicable to Nykredit Bank A/S as a financial market participant offering investment products and financial advice. The risk is Medium because: (1) SFDR is legally mandatory for EU financial market participants; (2) Nykredit offers investment products (PuljeInvest, PensionsInvest, Nykreditinvest funds) that must be classified under SFDR Article 6, 8, or 9; (3) ESG disclosure requirements are complex and subject to evolving regulatory guidance; (4) Nykredit has made public ESG commitments (net zero by 2050, fossil fuel lending policy, Green Bond Framework) that must be accurately reflected in SFDR disclosures; (5) greenwashing risk is a key enforcement priority for EU regulators. However, Nykredit's active ESG programme and Green Bond Framework suggest proactive SFDR engagement.

Evidence: https://www.nykredit.com/en-gb/investor-relations/bond-issuance/green-bonds/, https://www.nykredit.com/en-gb/okonomiske-analyser/2023/09/nykredit-ends-fossil-fuel-lending/, https://www.nykredit.com/en-gb/samfundsansvar/, https://www.nykreditinvest.dk/baredygtighed/invester-med-omtanke/

Financials

Three-year financials

Financial Resilience Score: 9/10

Nykredit Bank A/S demonstrates exceptional financial resilience, underpinned by a CET1 capital ratio of 27.7% at end-2024 — far above its 10.7% internal capital adequacy requirement — and a total capital ratio of 27.8%. The bank is a designated Danish SIFI with high external credit ratings (S&P A+ Stable, Fitch A+ Stable, Resolution Counterparty AA−) and top-tier ESG ratings (MSCI AAA, Sustainalytics Low Risk). Liquidity is very strong with an LCR of 229% and a Supervisory Diamond liquidity benchmark of 246.8%, both well above regulatory minimums. Asset quality is excellent: 2024 recorded a net impairment reversal of DKK 175 million, reflecting the healthy Danish economy and prudent credit standards. Earnings power has grown substantially, with profit before tax rising from DKK 2.0bn (2020) to DKK 4.6bn (2024) and equity growing 54% over five years to DKK 40.3bn, entirely from retained earnings. The bank benefits from diversified income streams (46% net interest, 34% wealth management, 20% other) and mutual ownership via Forenet Kredit, which supports long-term stability. Parent Nykredit Realkredit provides intercompany capital support (~DKK 18bn deposit to meet MREL). Key risks include declining net interest income as rates normalise (guidance for 2025 net profit is DKK 3.0–3.5bn, below 2024), concentration in Danish finance & insurance sector exposures, geopolitical provisioning of DKK 586m, and integration risk from the parent's Spar Nord merger. Overall, the combination of superior capitalisation, liquidity, ratings and asset quality justifies a very high resilience score.

Key strengths: CET1 ratio 27.7% and total capital ratio 27.8%, far above regulatory requirements, High credit ratings: S&P A+ Stable, Fitch A+ Stable, Resolution Counterparty AA−, LCR of 229% and Supervisory Diamond liquidity benchmark of 246.8%, Net impairment reversal of DKK 175m in 2024, reflecting strong asset quality, Danish SIFI status with mutual ownership via Forenet Kredit, Diversified income (46% NII, 34% wealth management, 20% other), Equity grew 54% over 5 years to DKK 40.3bn via retained earnings, Parent Nykredit Realkredit provides ~DKK 18bn intercompany MREL support, Top-tier ESG ratings (MSCI AAA, Sustainalytics Low Risk)

Risk factors: Declining net interest income as ECB/Danish rates normalise (2025 profit guided lower at DKK 3.0–3.5bn), Concentration in Danish finance & insurance sector (DKK 50.4bn exposure), Largest single non-financial exposure of DKK 3.7bn temporarily above internal DKK 3bn limit, DKK 586m provisions for sectors exposed to geopolitical tensions, DKK 81m provisions for ESG physical and transition risks, Legacy derivatives residual exposure, Model/valuation risk with ~DKK 494m in post-model management adjustments, Integration risk from parent Nykredit Group merger with Spar Nord in 2025–2026, Geographic concentration: ~96% of income from Denmark

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report