Akurateco Achieves High-Level NIS2 Cybersecurity Qualification from Portugal’s CNCS

Akurateco has been qualified as an "Important Entity" with a "High" compliance level by Portugal’s National Cybersecurity Centre (CNCS). This move places the payment orchestration platform under direct EU regulatory oversight via the NIS2 Directive, providing a legally enforceable security framework for payment service providers and banks conducting vendor due diligence in an increasingly scrutinized digital landscape.

What was announced

In November 2026, the Portuguese National Cybersecurity Centre (Centro Nacional de Cibersegurança, CNCS) formally designated Akurateco Lab, Informática Unipessoal LDA as an Important Entity. This qualification falls under Decree-Law No. 125/2025, which serves as the Portuguese transposition of the European Union’s NIS2 Directive. The law, which entered into force on 3 April 2026, establishes the CNCS as the national authority responsible for overseeing cybersecurity across critical sectors. Under this framework, entities are classified as essential or important based on their sector and size, and assigned a compliance level—basic, substantial, or high—using a risk matrix defined by the CNCS.

Akurateco has been assigned a "High" compliance level, representing the most demanding tier of the national framework. This status mandates that the company adhere to specific Portuguese and EU cybersecurity risk-management requirements, including the compulsory reporting of significant security incidents directly to the CNCS. For the platform’s core users—including payment service providers (PSPs), acquiring banks, and large-scale enterprise merchants—the qualification shifts cybersecurity from a matter of private contract to one of public law. While the company already maintains PCI DSS Level 1 compliance and ISO/IEC 27001:2022 certification, the NIS2 designation means its security obligations are now enforceable by an EU national authority rather than being solely verified through periodic private audits.

The companies involved

Akurateco operates as a white-label payment gateway and technical orchestration platform. The company provides the underlying infrastructure that allows PSPs, acquiring banks, and enterprise merchants to manage complex payment flows, routing, and integrations. By offering a white-label solution, Akurateco enables financial institutions to deploy branded payment technologies without the overhead of building proprietary systems from scratch. The platform is designed to handle high-volume transactions for millions of end users, making its operational stability and security posture a critical component of its clients' own risk profiles.

In the broader fintech market, Akurateco occupies a niche focused on technical orchestration, acting as a bridge between various payment methods, acquirers, and merchant interfaces. Its role in the payment ecosystem means it handles sensitive financial data, necessitating the high-level security certifications it currently holds, such as its annual on-site assessment by a Qualified Security Assessor. The company’s recent focus has been on expanding its technical capabilities and ensuring its compliance framework meets the evolving demands of the European regulatory environment, particularly as national authorities begin to enforce stricter standards for third-party technology providers.

What FF News has reported before

FF News has followed Akurateco’s technical and compliance expansion closely, with 21 previous reports on the company’s developments. In October 2026, we reported that Akurateco Achieves ISO/IEC 27001:2022 Certification to Bolster Payment Security and Compliance, a move that laid the groundwork for its current regulatory status. Earlier that month, the company expanded its ecosystem by partnering with viaSocket to Deliver No-Code Payment Automation for 2,300+ Apps. Our coverage in September 2026 also highlighted the platform’s front-end and developer-centric updates, including when Akurateco Launches Apple Pay Support for Chrome, Firefox, and Edge Browsers and the introduction of AI-Readable Payment API Documentation via MCP Server.

What this means

This qualification marks a significant shift in how fintech infrastructure providers are treated within the European Union. By moving from voluntary industry standards like PCI DSS to mandatory national oversight under NIS2, the "trust but verify" model of vendor management is being replaced by "comply or face state sanction." This puts immense pressure on other orchestration platforms and white-label providers to seek similar formal qualifications to remain competitive in the enterprise and banking sectors. For the wider industry, it raises the bar for what constitutes "due diligence," potentially making it harder for smaller, less regulated technical players to win contracts with major financial institutions as the supply chain becomes a primary focus for national regulators.