Grumpy Bear is a GRC and InfoSec digital practice for mid-market regulated firms in the Netherlands and the EU. Financial services answer to DORA. Since 15 August 2026 the rest answer to the Dutch NIS2 law (Cyberbeveiligingswet). Most groups answer to both, in different parts of the business. The Suite is the one governed operating model underneath: 11 domains, 81 processes and 72 controls, kept current for one flat annual rate.
See where you stand See the services€9,500 a year, flat. No modules, no per-user price. Why that number →
Licensing opens in spring 2027.
95 standards · 8 languages · v2.0 · updated 2026-10-19
DORA, PSD2, the Instant Payments Regulation and PCI DSS. A major incident starts a four hour clock, and the evidence has to exist before it starts.
What this looks like →In force since 15 August 2026, across eighteen sectors and more than 8,000 Dutch organisations. Registration, a duty of care, and a 24-hour clock.
What this looks like →Article 4 of NIS2 hands the financial sector to DORA, and that settles only what DORA covers. Your shared services entity, your non-financial subsidiaries and the providers you depend on can sit in the Dutch NIS2 law in their own right. Two registers, two reporting clocks, one set of people. The framework underneath does not change.
You don't download The Suite once and watch it go stale. It lives online in your own den, it is maintained for you while you work, and it covers the whole of your operating reality: financial services and payments, processes, procedures and ways of working, in one place your teams can actually use on a Tuesday morning.
Password-protected and browser-based. Nothing to install, nothing to host, nothing for your IT team to maintain. Your people open a link and the whole practice is there: searchable, multilingual, on any device, wherever the work actually happens.
When a scheme rulebook changes, a supervisor publishes guidance or a new obligation lands, the register changes and every den refreshes with it. You never work from last year's PDF, you never run a re-mapping project, and the update is already paid for.
Not a shelf of policies. The processes your people follow, the procedures underneath them, the controls that prove it happened, and the ways of working that make it stick. The same standard across financial services and payments alike.
Most governance products tell you when something has already gone wrong, because a detective control is cheap to write and easy to demonstrate. The Suite carries 20 preventive controls that sit in front of the work and stop the bad outcome from being possible in the first place: a design authority gate before a build starts, an intake gate before demand becomes commitment, provisioning that ends the day someone leaves. The carousel below moves through all eleven domains. Names and structure are shown here; how each control is tested, what evidence it leaves and what good looks like arrive with your licence.
Shown above: the structure, in eight languages, generated from the same register your den runs on. Held back: the test procedure, the evidence definition, the starting position and the target state for every control, which is the part you licence.
A complete governed operating framework for financial services and payments, delivered online and kept current: 11 domains, 81 processes, 72 internal controls across the Three Lines of Defence of which 20 are preventive, 95 standards, and a regulatory register mapping DORA, the EU AI Act, NIS2, GDPR and the payments regime to the processes and controls that satisfy them. Payments is a domain of its own: scheme governance, SCA, Verification of Payee, PCI DSS, safeguarding, screening and disputes, with their own controls and assessments. Interactive, multilingual, yours for one flat annual rate.
The price you join at is the price you keep, for as long as you stay licensed. One flat rate, no modules, no per-seat.
One Saturday a month we sit down with your team and work through the whole thing together: the playbooks, the self-audit assessments and the maturity scorecards. You leave with your own scores, your gaps written down and a plan you actually understand, because you produced it, not us. Join on Teams or come in person; same day, same price.
Book it with a support request. No call needed. Not ready? Send a free support request anyway and we answer within one business day.
Frameworks fail on adoption, not content. So we don't parachute in to run your change programme; we empower you to host it. The Suite hands your own facilitators the digital tools and the prep to stand up a clear adoption and change strategy inside your organisation: the sessions to run, the order to run them in, the material to put in front of each audience, and the record of what was decided. Your organisational change management doesn't get let down by a framework nobody was equipped to land.
Want someone alongside you the first time? That is what the monthly Readiness Audit Prep day is for.
Regulation changes; your practice updates. When an instrument is replaced or a new obligation lands (PSD3 and the Payment Services Regulation are the next ones coming for payments firms), the register changes and every den refreshes online, without you lifting anything. The next regulation is an update you already own, not a transformation programme.
INCLUDED IN THE LICENCE, ALWAYSFinancial services and payments are one practice here, not two products. Payments is simply where governance gets tested hardest: money moves in seconds, scheme rulebooks change on a fixed calendar, and the supervisor expects evidence on demand, not next quarter. The Suite carries payments as a domain of its own: ten processes, twelve controls and its own standards for the work a payment institution, e-money institution, in-house payments department or fintech actually runs on, with a payments governance self-assessment and maturity scorecard in the same licence.
Named ownership for every rail you run: SEPA credit transfer, instant credit transfer, direct debit mandates, card acquiring and issuing. Scheme rulebook change calendars tracked as work, and a release discipline that survives mandatory scheme windows.
Strong Customer Authentication and the governance of every exemption you claim, transaction monitoring thresholds with an owner and a review cadence, fraud-rate reporting, and a decision trail an examiner can follow from rule to outcome.
Match, close-match and no-match handling, the customer warning wording, and the operational controls the Instant Payments Regulation has required of euro-area providers since 9 October 2025, with the non-euro dates already on the register.
Scoping and segmentation of the cardholder data environment, tokenisation and key management, vulnerability scanning and penetration testing, and a standing evidence pack for PCI DSS v4.0.1, including the future-dated requirements that are now simply requirements.
Daily reconciliation that balances to the cent, break ageing and escalation with real thresholds, suspense and nostro discipline, and safeguarding of client funds with segregation evidence your auditor can follow without asking you for a screenshot.
Screening inside the payment flow, funds-transfer information requirements on the message itself, alert handling with SLAs that are measured, unusual-transaction reporting, and an unbroken audit trail from alert to decision to filing.
DORA applied where it bites: processors, acquirers, gateways and core providers on a critical-provider register, contractual clauses checked, exit plans that have been tested, resilience testing scheduled, and the incident-reporting clock understood before you need it.
Scheme timelines run as controls rather than reminders, dispute and refund SLAs with an owner, root cause fed back into the process that caused it, and complaint handling that stands up to conduct supervision.
The Cyberbeveiligingswet carries the ten measures of Article 21(2) into Dutch law, and has done since 15 August 2026. A supervisor does not ask whether you have a policy. It asks which process does the work, who owns it, and what evidence exists. These are the answers, already written.
Across the EU, boards are asking a new question of every cloud contract: where does our data live, which governments could reach it, and how fast could we leave? The Suite treats digital sovereignty the way it treats payments: as governed work, not a slogan. A dedicated process governs jurisdiction exposure, data residency, encryption key custody and Data Act-ready exit plans; a Sovereign Cloud Readiness Assessment, a Transfer Impact Assessment template and a sovereign cloud vendor evaluation matrix ship in the same licence. Checks and balances, not vendor marketing.
My son gave me the name. I was always working, often grumpy. And, in fairness, I'm a bit round with a big beard. The grumpiness had a source: years of watching brilliant people in financial services spend their evenings reconciling screenshots into audit binders that created nothing.
So I built the way out, and put the bear in the den, where he belongs: inside the organisation, guarding it. The bear stays grumpy so you don't have to be.
Grumpy Bear is small on purpose. What you licence is the framework. It exists because two people spent their careers inside the problems it solves. One built regulated process at Fortune 100 scale, across sectors and across borders, which is the operating model the nine general domains describe. The other keeps the payments rails honest, which is the specialism that sits on top of them.
Over 25 years in business process outsourcing with some of the world's largest Fortune 100 organisations: running regulated processes at scale, standing up controls that survive audit, and moving work between countries, systems and providers without losing the evidence trail. The Suite is that experience written down and made reusable.
Six years building and supporting the payments infrastructure behind one of the Netherlands' most recent technology unicorns: the daily reality of acquiring, settlement, reconciliation and keeping payment rails running through growth, migrations and scheme mandates. He keeps the payments content honest: what a governance framework claims has to match what the people on the rails actually do at 03:00.
No sales calls, no discovery sessions, no pipeline. Support requests are free. Ask what you need to know about the framework, payments coverage, licensing, the monthly prep day or an existing den, and you get a written answer by email.
Prefer your own mail client? Write to hello@grumpybear.nl; the same one business day commitment applies.
Eleven domains, eighty-one processes and seventy-two controls, kept current for one flat annual rate. Nothing to install, nothing to re-map, and nothing to explain to your IT team.
Three AI governance standards landed this month and the framework already carries all three. EN 18286 is the first harmonised standard under the AI Act, ISO/IEC 27090 covers security threats to AI systems, and ISO/IEC 23894 covers AI risk management. That is what a flat annual rate buys: when the register moves, every den moves with it.