Is the Nintendo network ban tied to NNID or the console?

Based on a few other links I've found, it appears to be the 3DS and not the account that gets banned.

Take this link for example. It contains the following screenshot:

According to that screenshot, which is from a 3DS, it states that "This device's access to online services has been restricted by Nintendo." The link also states that buying a new 3DS is the solution (worded towards heavy 3DS users, but none the less). Considering that information, it appears to be the 3DS itself.

I found a second link that states:

Players that go online with early, pirated copies of Pokémon Sun & Moon on the Nintendo 3DS are reporting that their systems have been completely banned from accessing Nintendo's servers, including the system's online eShop.

Once again, it mentions that the system is banned and not just the account. It also contains a similar screenshot of the one above.

From this Reddit, the way Nintendo performs the ban is by seeing which 3DS systems accessed the online services prior to the release of the actual game. If they detected that you played the game online before it was released, they would essentially blacklist your MAC address of your device. People who were banned could attempt to spoof their MAC but this is rather difficult and probably even more difficult to do on a 3DS.

Actually, both kinds of ban exist. Device bans are usually handed out for piracy involving firmware modifications, since NNID on such systems has no value as it can be easily re-created. There are NNID bans (e.g. 005-5964) which are applied to people whose wrongdoings can be tied to a NNID, such as some cases of cheating or games bought with a stolen credit card.

In the latter case, factory reset will restore the device's ability to connect to servers, but of course you will lose all the perks that the previous user has illegally acquired.