Short answer
A DAM for financial services must control compliance-approved marketing, disclaimer versions, retention periods and partner distribution under a security review that banks and insurers apply to every ICT supplier. DAMSelection assessment: weight security, hosting and compliance plus workflow and approvals at about 34 percent of the total score when the DAM stores approval evidence for marketing communications.
Asset types in financial services
A financial services DAM holds brand assets, product marketing, disclosures and partner materials, and most of them carry a compliance approval and a retention date. Banks, insurers, asset managers and payment firms share this pattern, with different product rules per sector.
Typical asset families:
- Brand assets: logos, photography, video, templates and sponsorship imagery.
- Product marketing: campaign visuals, landing page assets, product brochures and fund factsheets.
- Disclosures and disclaimers: risk warnings, legal footers and product-specific text blocks, each with a version.
- Partner and intermediary packs: materials for distributors, brokers and independent advisers.
- Corporate and investor relations: annual reports, results presentations and executive photography.
Metadata decides whether compliance can prove what went out. DAMSelection assessment: make these fields mandatory at upload: product, jurisdiction, audience (retail or professional client), channel, compliance approval ID, approver, approval date, disclaimer version, campaign end date and retention end date. Model them in the metadata schema guide before vendor demos.
Regulation that shapes the DAM
Financial services DAM requirements come from conduct rules on marketing communications, record-keeping rules and operational resilience rules for ICT suppliers. The DAM itself is rarely regulated; it supplies the evidence a firm needs to show compliance.
| Rule | What it requires | DAM requirement |
|---|---|---|
| MiFID II, Directive 2014/65/EU, Article 24(3) | Information to clients, including marketing communications, is fair, clear and not misleading; marketing communications are clearly identifiable | Approval workflow, approved version lock, disclaimer version per asset |
| MiFID II, Article 16(6) | Records of all services, activities and transactions sufficient for supervision | Audit trail of approval and distribution |
| MiFID II, Article 16(7) | Recorded telephone conversations and electronic communications on own-account dealing and client orders kept for five years, up to seven where the competent authority requests | Retention rules and legal hold per asset class |
| Regulation (EU) 2019/1156, Article 4(1) | Fund marketing communications identifiable as such, risks and rewards described equally prominently, information fair, clear and not misleading; applies from 2 August 2021 | Review checklist fields for fund marketing |
| Regulation (EU) 2022/2554 (DORA) | ICT third-party risk management, key contractual provisions and a register of information; applies from 17 January 2025 | Contract terms, exit plan and supplier data for the register |
| FCA Handbook COBS 4.2.1R(1) (UK) | A communication or financial promotion is fair, clear and not misleading | Approval record per promotion |
Fact: the dates in the table are as published on EUR-Lex, ESMA and EIOPA. DAMSelection assessment: confirm with your compliance function which records the DAM must hold, because many firms keep the approval record in a separate compliance review tool.
Photography of customers and employees is personal data under the GDPR, Regulation (EU) 2016/679. Retention rules for marketing records and erasure requests for people in photos must be reconciled in one policy.
Metadata for compliance evidence
A financial services DAM proves compliance through metadata, so each field must answer a question a regulator or auditor asks. DAMSelection assessment: make these fields mandatory and system-filled where possible, because hand-typed approval data breaks under audit.
| Field | Question it answers | Filled by |
|---|---|---|
| Compliance approval ID | Which approval covers this version | Compliance review tool through the API |
| Approver and approval date | Who approved it and when | Workflow, automatically |
| Disclaimer version | Which risk wording the asset carries | Template or upload rule |
| Jurisdiction and client type | Where and to whom it may be shown | Uploader, validated by compliance |
| First use and campaign end date | When it was in market | Distribution log and campaign plan |
| Retention end date and legal hold | When it may be deleted | Retention rule per asset class |
Design the fields in the Metadata Model Builder and agree them with compliance before vendor demos. The pharma and life sciences fit page shows the same evidence pattern for medicinal product advertising.
Fit criteria and weights
Financial services buyers should weight security, approvals and evidence highest. The table uses the twelve DAMSelection scoring criteria; shift weight to the brand portal when partner distribution is a large share of use.
| Criterion | Weight (DAMSelection assessment) | What to look for |
|---|---|---|
| Security, hosting and compliance | 18 | ISO/IEC 27001, SOC 2, EU hosting, penetration test reports, DORA contract terms |
| Workflow and approvals | 16 | Compliance stages, approval IDs, re-approval on change |
| Metadata and taxonomy flexibility | 10 | Jurisdiction, audience and disclaimer version fields |
| Brand portal and sharing | 9 | Partner portals by jurisdiction and client type |
| Rights and licence management | 8 | Stock and talent licence expiry |
| API and extensibility | 8 | Webhooks for compliance tools and CMS |
| Administration and total cost profile | 7 | Admin effort for retention and access reviews |
| Search and AI discovery | 6 | Search by product, jurisdiction and approval status |
| Distribution and CDN | 6 | Expiring links, download logs |
| Creative tool integration | 6 | Agency and in-house design handover |
| Asset ingestion and processing | 4 | Standard image, video and PDF processing |
| PIM integration depth | 2 | Rarely relevant outside insurance product catalogues |
| Total | 100 |
Score candidates with the scoring matrix. The candidate table on this page lists platforms from the enterprise content platforms and European specialists segments; DAM by industry lists the other nine industries. The regulated industries shortlist adds scored scenarios.
Scenarios to script
Financial services demos should test disclaimer control, partner distribution and retention on your own assets. DAMSelection assessment: vendors demo the buyer's scripted scenarios on the buyer's assets, or the demo carries no selection value. Build the scripts in the Demo Script Generator.
Scenario 1: Disclaimer change across markets
Load 80 campaign assets for one savings product across the Netherlands, Belgium and Germany, tagged with disclaimer version 3. Compliance issues version 4. Ask the vendor to find every affected asset within three filters, block downloads and share links, route the assets for re-approval and export the list with approval history.
Scenario 2: Intermediary portal by jurisdiction and client type
Share a fund marketing pack with distributors. Professional-client material may only reach distributors in two countries; retail material reaches all five. Ask the vendor to configure the permissions live, then show the download log per partner for the last 30 days.
Scenario 3: Retention, legal hold and deletion
A campaign ends. Ask the vendor to apply a five-year retention rule, place one asset on legal hold, delete a test asset at retention end and export the audit evidence. Then process an erasure request for an employee shown in two photos and show how the conflict with retention is recorded.
Integrations
A financial services DAM connects to the compliance review process, the channels and the security stack. The security integrations carry as much weight as the marketing ones in this industry.
| System | What flows | Test |
|---|---|---|
| Compliance review tool | Approval IDs, approver, status | Status change blocks distribution in the DAM |
| Web CMS and app content | Approved renditions | Withdrawn asset disappears from pages |
| Marketing automation and email | Approved images and disclaimers | Disclaimer version travels with the asset |
| Identity provider (SAML SSO and SCIM) | Users, groups, leavers | Access removed on the day of leaving |
| SIEM and log management | Audit and access logs | Log export format and frequency |
| Records management or archive | Final versions for retention | Hand-off at campaign end |
Review the security requirements list and the security review guide before the shortlist, because security findings often remove candidates late.
Pitfalls
Financial services DAM projects most often stall in security review or fail on evidence the regulator asks for. Five pitfalls recur in DAMSelection practice:
- The approval workflow lives in the DAM, but the audit trail cannot be exported in a form compliance accepts.
- Public share links without expiry let superseded disclaimers circulate after re-approval.
- Retention rules and GDPR erasure requests conflict, with no recorded decision per asset class.
- DORA contract terms, exit support and subcontractor lists are raised after vendor selection, which reopens negotiation.
- Data residency is assumed from the vendor's headquarters. Ask for hosting regions and backup locations in writing.
Candidate vendors
| Vendor | Segment | Industry fit score |
|---|---|---|
| Adobe AEM Assets | Enterprise content platforms | Scoring pending |
| Aprimo | Enterprise content platforms | Scoring pending |
| OpenText | Enterprise content platforms | Scoring pending |
| Orange Logic | Enterprise content platforms | Scoring pending |
| Sitecore Content Hub | Enterprise content platforms | Scoring pending |
| Hyland Nuxeo | Enterprise content platforms | Scoring pending |
Case pattern
Pending An anonymised selection pattern from a PIMvendors engagement in this industry publishes here after client approval.
Frequently asked
Does a DAM for a bank need to be DORA compliant?
DORA applies to financial entities. A DAM vendor is an ICT third-party service provider, so the bank's contract with it must meet DORA contract requirements and the vendor appears in the register of information. DAMSelection assessment: a DAM seldom supports a critical or important function, which keeps requirements lighter. The contract checklist applies in every case.
Can the DAM replace a compliance approval tool?
A DAM can hold compliance approvals when its workflow records approval IDs, approver identity, timestamps and the approved version, and when the audit trail exports cleanly. Firms with an established compliance review tool usually keep it and integrate the DAM by approval ID.
How long should marketing assets be retained?
Retention depends on the rule that applies to the record. MiFID II Article 16(7) sets five years, up to seven on request, for recorded calls and electronic communications on client orders and own-account dealing. Compliance sets the rule per asset class, and the DAM enforces it with retention dates and legal hold.
What security certifications should a financial services DAM have?
Financial services buyers typically ask for ISO/IEC 27001 and SOC 2 Type II reports, penetration test summaries, EU hosting and SSO with SCIM. DAMSelection assessment: certificates open the security review; the questionnaire and contract terms decide it. Verify each vendor's certificates on the vendor profile.
Which DAM vendors suit financial services?
The candidate table on this page lists platforms from the enterprise content platforms and European specialists segments. Fit depends on the security review, approval evidence and partner portal needs. Compare them on the [regulated industries shortlist](/dam/vendors/shortlists/regulated-industries/).
Sources
- Directive 2014/65/EU (MiFID II), Article 24, ESMA Interactive Single Rulebook
- Directive 2014/65/EU (MiFID II), Article 16, ESMA Interactive Single Rulebook
- Regulation (EU) 2019/1156 on cross-border distribution of collective investment undertakings (EUR-Lex)
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (EUR-Lex)
- Digital Operational Resilience Act (EIOPA)
- Regulation (EU) 2022/2554 (DORA), Article 30, key contractual provisions (springlex.eu reproduction of OJ L 333, 27.12.2022)
- EBA Single Rulebook Q&A 2025_7388 on the DORA Article 28(3) register of information
- FCA Handbook COBS 4.2, Fair, clear and not misleading communications
- Regulation (EU) 2016/679, General Data Protection Regulation (EUR-Lex)