Compliance work tends to stall in the same place. A requirement gets filed on the security team's board, and the people who could actually change the payments service never see it. Three quarters later an auditor asks for proof, and the team learns that "we do this" and "we can show this" are two separate claims.

I write Java for systems that move money. My background includes high-traffic airline platforms, OpenBanking PSD2 integrations and a startup I co-founded. I should be plain about one thing: those were not DORA or NIS2 audits. What carried over from them was a habit. Checks that run on every deploy keep working, and checks that live in a document drift. This post applies that habit to the two EU regulations, from the point of view of the person who has to write the YAML and the Java.

A boundary before anything else. This is an engineering pattern, not legal advice and not an official compliance mapping.…