Brand TLDs in Financial Services

The legal framework

Financial institutions are a main target of phishing, because a lookalike domain name can be used to take over a customer's credentials. A brand TLD offers a namespace that only the institution can use. The decision to apply is also shaped by EU financial regulation, which does not require a brand TLD but affects how one would be used and governed.

Trust and consumer protection

A brand TLD is a signal and not a guarantee. If customers are told that genuine messages come only from names under the institution's TLD, a message from any other domain is suspect. This works only if the institution consistently uses the TLD for customer-facing services and says so in its communications. A TLD used for some services only gives a weaker signal. It also does not stop fraudsters from using other domains, from impersonating the institution on social media or from sending messages that look genuine. It therefore complements, and does not replace, email authentication, customer education and monitoring.

Payment services and authentication

Directive (EU) 2015/2366 (PSD2) requires strong customer authentication for many payment operations. This concerns how the customer proves their identity and not which domain the bank uses, so a brand TLD does not satisfy it. Its link to the rule is indirect: a recognisable, institution-controlled namespace helps customers to trust that they authenticate on the right site.

Digital operational resilience

Regulation (EU) 2022/2554 (DORA) applies to financial entities and requires them to manage ICT risk, including risk from third-party providers. A brand TLD that is part of the entity's customer-facing infrastructure sits in that scope. The registry service provider that runs it is an ICT third-party service provider, whose contract needs the safeguards DORA lists, and the dependency has to be recorded in the entity's register of information on its ICT arrangements.

Digital identity

Regulation (EU) 2024/1183 amended the eIDAS framework to create European digital identity wallets. It does not make domain names a part of the identity system, but a verified, institution-controlled namespace can complement it.

Community TLDs for the sector

Apart from brand TLDs, there are community TLDs for the sector: .bank and .insurance are run by fTLD Registry Services, with eligibility checks and security requirements for registrants. An institution can use one of these without running a registry itself. They do not give the exclusivity of a TLD that carries only its own name.

In practice

A European insurer considers a brand TLD. It does the following analysis.

First, the threat. Its security team sees lookalike domain names registered each month. Monitoring shows that most are taken down within days, but customers still receive phishing emails. A brand TLD would give customers a simple rule.

Second, the limits. Fraudsters will still use other extensions and other channels. The TLD must therefore be combined with email authentication, a customer campaign and continued monitoring of lookalikes under other extensions. Our online brand monitoring continues to be needed.

Third, governance. The registry service provider and the internal registry team become part of the ICT risk framework. The contract with the provider needs DORA clauses, and the board needs a view on the dependence.

Fourth, the trademark. The institution holds an EU trade mark for the name. A clearance check of the string shows no conflicting marks of other businesses in its sector, but one in a different sector. That raises the possibility of contention and, for a common word, of an objection.

The insurer concludes that the TLD fits its risk strategy, provided it commits to full use. It defines the use cases before it decides to apply. If it had not applied in 2026, the next opportunity may be many years away, and the article on ICANN's 2026 round explains the current status.

Frequently asked questions

Does a brand TLD make us compliant with PSD2 or DORA?

No. Neither regulation asks for one. A brand TLD is a tool you may use within your compliance framework, and it brings its own DORA-relevant dependencies.

Does a brand TLD stop phishing?

It removes one route, namely lookalikes under your own TLD, and gives customers a rule they can follow. Phishing from other domains, social media and email spoofing remain.

Can we use a brand TLD only internally?

Yes. Some operators use it for email and internal systems first. The authentication benefit for customers needs customer-facing use.

What are the alternatives?

Defensive registrations, monitoring with takedowns, and for banks and insurers the .bank or .insurance extensions. Each addresses part of the problem.

How this connects

New gTLDs for Brands describes how Pitch advises on the decision and the process. Related articles cover strategic use cases, the Applicant Guidebook and the history of the programme.