--- title: "Brand TLDs in Financial Services | Pitch" description: "Why banks and insurers look at brand TLDs, what a brand TLD can and cannot do against phishing, and which EU rules shape the decision." url: https://www.pitch.law/academy/dotbrand-domains-in-financial-services-what-a-decade-of-data-reveals-about-trust-security-and-the-road-to-2026 --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [New gTLDs](https://www.pitch.law/academy/topics/gtld) # Brand TLDs in Financial Services Why banks and insurers look at brand TLDs, what a brand TLD can and cannot do against phishing, and which EU rules shape the decision. - By By Bart Lieben, Attorney-at-Law - Published 7 February 2026 ## The legal framework Financial institutions are a main target of phishing, because a lookalike domain name can be used to take over a customer's credentials. A brand TLD offers a namespace that only the institution can use. The decision to apply is also shaped by EU financial regulation, which does not require a brand TLD but affects how one would be used and governed. ### Trust and consumer protection A brand TLD is a signal and not a guarantee. If customers are told that genuine messages come only from names under the institution's TLD, a message from any other domain is suspect. This works only if the institution consistently uses the TLD for customer-facing services and says so in its communications. A TLD used for some services only gives a weaker signal. It also does not stop fraudsters from using other domains, from impersonating the institution on social media or from sending messages that look genuine. It therefore complements, and does not replace, email authentication, customer education and monitoring. ### Payment services and authentication Directive (EU) 2015/2366 (PSD2) requires strong customer authentication for many payment operations. This concerns how the customer proves their identity and not which domain the bank uses, so a brand TLD does not satisfy it. Its link to the rule is indirect: a recognisable, institution-controlled namespace helps customers to trust that they authenticate on the right site. ### Digital operational resilience Regulation (EU) 2022/2554 (DORA) applies to financial entities and requires them to manage ICT risk, including risk from third-party providers. A brand TLD that is part of the entity's customer-facing infrastructure sits in that scope. The registry service provider that runs it is an ICT third-party service provider, whose contract needs the safeguards DORA lists, and the dependency has to be recorded in the entity's register of information on its ICT arrangements. ### Digital identity Regulation (EU) 2024/1183 amended the eIDAS framework to create European digital identity wallets. It does not make domain names a part of the identity system, but a verified, institution-controlled namespace can complement it. ### Community TLDs for the sector Apart from brand TLDs, there are community TLDs for the sector: .bank and .insurance are run by fTLD Registry Services, with eligibility checks and security requirements for registrants. An institution can use one of these without running a registry itself. They do not give the exclusivity of a TLD that carries only its own name. ## In practice A European insurer considers a brand TLD. It does the following analysis. First, the threat. Its security team sees lookalike domain names registered each month. Monitoring shows that most are taken down within days, but customers still receive phishing emails. A brand TLD would give customers a simple rule. Second, the limits. Fraudsters will still use other extensions and other channels. The TLD must therefore be combined with email authentication, a customer campaign and continued monitoring of lookalikes under other extensions. [Our online brand monitoring](https://www.pitch.law/technologies/domain-monitoring-enforcement) continues to be needed. Third, governance. The registry service provider and the internal registry team become part of the ICT risk framework. The contract with the provider needs DORA clauses, and the board needs a view on the dependence. Fourth, the trademark. The institution holds an EU trade mark for the name. [A clearance check of the string](https://www.pitch.law/technologies/efficient-cost-effective-and-accurate-trademark-clearance-solutions) shows no conflicting marks of other businesses in its sector, but one in a different sector. That raises the possibility of contention and, for a common word, of an objection. The insurer concludes that the TLD fits its risk strategy, provided it commits to full use. It defines the use cases before it decides to apply. If it had not applied in 2026, the next opportunity may be many years away, and the article on [ICANN's 2026 round](https://www.pitch.law/academy/icanns-next-round-of-new-generic-top-level-domains-in-2026) explains the current status. ## Frequently asked questions ### Does a brand TLD make us compliant with PSD2 or DORA? No. Neither regulation asks for one. A brand TLD is a tool you may use within your compliance framework, and it brings its own DORA-relevant dependencies. ### Does a brand TLD stop phishing? It removes one route, namely lookalikes under your own TLD, and gives customers a rule they can follow. Phishing from other domains, social media and email spoofing remain. ### Can we use a brand TLD only internally? Yes. Some operators use it for email and internal systems first. The authentication benefit for customers needs customer-facing use. ### What are the alternatives? Defensive registrations, monitoring with takedowns, and for banks and insurers the .bank or .insurance extensions. Each addresses part of the problem. ## How this connects [New gTLDs for Brands](https://www.pitch.law/solutions/new-gtlds) describes how Pitch advises on the decision and the process. Related articles cover [strategic use cases](https://www.pitch.law/academy/strategic-use-cases-for-brand-tlds-from-experiment-to-a-cornerstone-in-digital-strategy), the [Applicant Guidebook](https://www.pitch.law/academy/brand-tlds-in-the-2026-round-of-new-gtlds-key-takeaways-from-the-draft-applicant-guidebook) and the [history of the programme](https://www.pitch.law/academy/history-and-background). ## In short - Brand TLDs as a trust signal against phishing - What they do not replace - DORA, PSD2 and eIDAS context - Community TLDs for banks and insurers ## Related solutions - [Solutions](https://www.pitch.law/solutions/new-gtlds) ### [New gTLDs for Brands](https://www.pitch.law/solutions/new-gtlds) [Advice for brand owners on ICANN's new gTLD programme, from the decision to apply through objections and contention to running a registry.](https://www.pitch.law/solutions/new-gtlds) ## Technology we use - [Technology](https://www.pitch.law/technologies/efficient-cost-effective-and-accurate-trademark-clearance-solutions) ### [Trademark Clearance Search](https://www.pitch.law/technologies/efficient-cost-effective-and-accurate-trademark-clearance-solutions) [Our clearance engine runs a name through absolute grounds, registers and online sources, scores similarity and produces an opinion that an attorney signs off.](https://www.pitch.law/technologies/efficient-cost-effective-and-accurate-trademark-clearance-solutions) - [Technology](https://www.pitch.law/technologies/domain-monitoring-enforcement) ### [Online Brand Monitoring](https://www.pitch.law/technologies/domain-monitoring-enforcement) [Continuous discovery of lookalike domain names, counterfeit listings and impersonating accounts, with detections shown in the client portal for attorney review.](https://www.pitch.law/technologies/domain-monitoring-enforcement) ## More in New gTLDs - ### [Brand TLDs in the 2026 Round: the Applicant Guidebook](https://www.pitch.law/academy/brand-tlds-in-the-2026-round-of-new-gtlds-key-takeaways-from-the-draft-applicant-guidebook) [What a brand TLD is, how the Applicant Guidebook treats it, and the contract obligations that come with running one.](https://www.pitch.law/academy/brand-tlds-in-the-2026-round-of-new-gtlds-key-takeaways-from-the-draft-applicant-guidebook) - ### [History of ICANN's New gTLD Program](https://www.pitch.law/academy/history-and-background) [How the top-level domain space grew from a handful of extensions to more than a thousand, and what the earlier rounds teach applicants and brand owners today.](https://www.pitch.law/academy/history-and-background) - ### [ICANN's Next Round of New gTLDs (2026)](https://www.pitch.law/academy/icanns-next-round-of-new-generic-top-level-domains-in-2026) [Where ICANN's 2026 round of new generic top-level domains stands in October 2026, how the process continues after the application window, and what it means for brand owners.](https://www.pitch.law/academy/icanns-next-round-of-new-generic-top-level-domains-in-2026) - ### [Strategic Use Cases for Brand TLDs](https://www.pitch.law/academy/strategic-use-cases-for-brand-tlds-from-experiment-to-a-cornerstone-in-digital-strategy) [How companies use a brand TLD in practice, from authentication and anti-phishing to internal systems and partner networks, and the legal points that go with each use.](https://www.pitch.law/academy/strategic-use-cases-for-brand-tlds-from-experiment-to-a-cornerstone-in-digital-strategy) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)