Provides financial services, in Italy

Art. 10, comma 1, lettera a), Decreto legislativo 10 marzo 2025, n. 23 · Read the law's page

• If you are a bank or a financial intermediary, or a third-party provider of ICT services to one of them, comply with the DORA Regulation articles that Article 144, paragraphs 8-bis and 8-ter, of the Consolidated Banking Act lists, and cooperate with the competent authority in an investigation, inspection or request, or face an administrative fine (Legislative Decree 23/2025, Article 10(1)(a)).

Art. 4, Decreto legislativo 10 marzo 2025, n. 23 · Read the law's page

• If you are a financial entity within Article 2(1) of the DORA Regulation, report each major ICT incident, under Article 19 of that Regulation, to the authority that supervises you: the Bank of Italy, Consob, IVASS or COVIP according to your type (Legislative Decree 23/2025, Article 4(1)).
• If you are a banking or financial market infrastructure entity within Annex I to Directive (EU) 2022/2555, or are identified as critical under Directive (EU) 2022/2557, also give CSIRT Italia your initial notification and each report of a major ICT incident, on the templates and within the time limits set under Article 20 of the DORA Regulation (Article 4(3)).

Artt. 3 e 9, Decreto legislativo 10 marzo 2025, n. 23 · Read the law's page

• If you are a financial entity supervised by Banca d'Italia, Consob, IVASS or COVIP, comply with the DORA Regulation and with the provisions those authorities issue to implement it and the decree (Legislative Decree 23/2025, Articles 3 and 9).when it serves a financial business
• If you are a financial intermediary or Bancoposta, comply with the obligations the decree places on you, which Banca d'Italia supervises (Article 3(3)).when it serves a financial business

D.Lgs. 27 maggio 2022, n. 82, artt. 1(3), 3(2)-(3), 12-14 e 25 · Read the law's page

• If you provide a consumer service listed in Article 1(3) of Legislative Decree 82/2022 (electronic communications, access to audiovisual media, the passenger transport elements, consumer banking, e-books and dedicated software, or e-commerce), design and provide it in conformity with the accessibility requirements of sections III and IV of Annex I, which the decree applies to urban, suburban and regional transport services as well (Articles 3(2) and 12(1)); the decree has effect from 28 June 2025 (Article 25(1)). These provisions implement Articles 4(1), 4(3), 4(5), 13, 14, 15 and 32 of Directive (EU) 2019/882.
• Prepare the information required by Annex IV of the decree on how the service meets the accessibility requirements, include it in your general conditions or an equivalent document, make it available to the public in written and oral form in a manner accessible to persons with disabilities, and keep it while the service is operating (Article 12(2) and Annex IV, point 1).
• If you provide an audiovisual media service, ensure where possible that it is available through more than one sensory channel (Article 12(1)).
• If your website or mobile application gives information on local public transport routes, show also the routes accessible to persons with disabilities (Article 12(3)).
• Put in place the measures needed to keep the service in constant conformity as its features, the applicable requirements and the harmonised standards or technical specifications change (Article 12(4)).
• If the service does not conform, take the corrective measures needed and inform the Agenzia per l'Italia Digitale and the national authorities of the Member States where you provide the service immediately, stating the requirements not met and the measures taken (Article 12(5)).
• On reasoned request, give the Agenzia per l'Italia Digitale and the competent authorities of the Member States the information needed to show conformity, and cooperate in the measures taken to bring the service into conformity (Article 12(6)).
• If you rely on the exceptions of Article 13(1) (a substantial modification that changes the nature of the service, or a disproportionate burden), assess them on the criteria of Annex V, document the assessment, keep the results for not less than five years from the last supply of the service, and give a copy of it on request of the Ministry or the competent authorities of the Member States (Article 13(2) and (3)).
• Renew a disproportionate-burden assessment when the service is changed, when the supervising authority asks, and at least every five years (Article 13(5)).
• Unless you are a microenterprise, inform the competent supervisory authority when you rely on Article 13(1) for a specific service (Article 13(7)); Article 13(1)(b) does not apply to an operator that receives public or private funding to improve accessibility (Article 13(6)).
• A service is presumed to conform to the accessibility requirements that harmonised standards published in the Official Journal of the European Union cover when it conforms to them or to parts of them, and to the requirements that technical specifications cover when it conforms to those specifications or parts of them (Article 14(1) and (2)).
• A transport service that meets the accessible-information requirements of Regulations (EC) 261/2004, 1107/2006, 1371/2007, 1177/2010 and 181/2011 and of the acts under Legislative Decree 57/2019 is deemed to conform to the corresponding requirements of the decree, unless the decree sets further requirements that it must then also meet (Article 4(1)).
• The decree does not apply to pre-recorded time-based media or office file formats published before 28 June 2025, online maps and mapping services (where navigation maps give essential information in an accessible digital mode), third-party content you neither fund, develop nor control, or archive content not updated after 28 June 2025 (Article 1(5)).
• Contracts for services concluded before 28 June 2025 may continue unchanged until they expire, for not more than five years from that date, and until 28 June 2030 you may keep providing your services using products you lawfully used before that date to provide similar services (Article 25(1)).
• Self-service terminals lawfully used before 28 June 2025 may stay in use for similar services until the end of their economically useful life, for not more than twenty years from entry into use (Article 25(2)).

D.Lgs. 27 maggio 2022, n. 82, artt. 21 e 24 · Read the law's page

• If a service listed in Article 1(3) of Legislative Decree 82/2022 is found non-conforming, take the corrective measures the Agenzia per l'Italia Digitale requires within the reasonable and proportionate period it sets (Articles 21(1) and 21(4)); the decree has effect from 28 June 2025 (Article 25(1)). Articles 21 and 24 implement Articles 23 and 30 of Directive (EU) 2019/882.
• If you do not take the corrective measures in time, the Agency sets a reasonable period to block the specific service and, where necessary, to withdraw the mobile application from the store, or adopts measures inhibiting use of the service; the measures are revoked if you comply (Article 21(1)).
• Cooperate with the Agency, and give it the information it requests, in the activities of Article 12(5) and the last sentences of 13(3) and 13(4); a failure to cooperate is fined, save a reasoned refusal where the information could expose you to punitive administrative sanctions or a criminal offence (Article 24(3)).
• Where you are a legal person within Article 3(1-bis) of Law 4/2004, the fine of Article 9(1-bis) of that Law applies to you in every case (Article 24(1), second sentence).