Is a lender, in Portugal

Decreto-Lei n.º 82/2022, de 6 de dezembro, serviços, arts. 2.º n.º 3 a 5, 4.º, 5.º, 13.º a 15.º, 25.º, 34.º, 36.º e 38.º · Read the law's page

• If you provide a service listed in Article 2(3) of Decreto-Lei 82/2022 to consumers, provide it only if it meets the accessibility requirements of the Decree-Law, which Portaria 220/2023 sets out in Annex I (Art. 4(1), Art. 13(1)); the Decree-Law has applied since 28 June 2025 (Art. 39(1)).
• If you offer e-commerce services, banking or financial services, electronic communications services, services that give access to audiovisual media services, or the websites, mobile applications, e-tickets and travel information of passenger transport, expect the supervising authority of your sector to check these services against the accessibility requirements (Art. 2(3), Art. 25(1), Art. 28(1)).
• Explain how your services meet the applicable accessibility requirements, in writing and orally, in a manner accessible to persons with disabilities, and keep that information for as long as the service is available (Art. 13(2)(b)); the explanation goes in the terms and conditions or an equivalent document (Annex II, point 1).
• Keep procedures that maintain the conformity of the service when its characteristics, the accessibility requirements or the harmonised standards change (Art. 13(2)(c)).
• If a service does not conform, adopt the corrective measures needed and inform the competent authorities of every Member State where you provide it, with the information on the non-conformity and the measures taken (Art. 13(2)(d)); give the supervising authority, on a reasoned request, the information and documentation it needs, in Portuguese among other languages, and cooperate with its actions (Art. 13(2)(e) and (f)).
• If you rely on the fundamental-alteration or disproportionate-burden defence, assess it yourself, document the assessment and keep the results for five years from the last time the service was supplied, and give the authority a copy on request (Art. 14(2) and (3)).
• If you rely on the disproportionate-burden defence for a service, update the assessment for each category or type of service when the service changes, when the authority asks, and at least every five years (Art. 14(6)); you cannot rely on it if you receive public or private funding, other than your own resources, made available to improve accessibility (Art. 14(7)).
• If you rely on the fundamental-alteration or disproportionate-burden defence for a specific service, inform the competent authority of the Member State where you provide it (Art. 14(8)).
• If you provide passenger air, bus, rail or waterborne transport services, meeting the accessible-information and accessibility-information requirements of Regulations (EC) 261/2004, (EC) 1107/2006, (EC) 1371/2007, (EU) 1177/2010 and (EU) 181/2011 counts as meeting the corresponding requirements of the Decree-Law, and its additional requirements still apply (Art. 5(1) and (3)).
• If you are a microenterprise providing services, the Decree-Law does not apply to you (Art. 2(5)(b)); Article 3 takes the definition from Directive (EU) 2019/882, Article 3(23): an enterprise which employs fewer than 10 persons and which has an annual turnover not exceeding EUR 2 million or an annual balance sheet total not exceeding EUR 2 million.
• A service provider whose facilities were lawfully in use before 28 June 2025 may keep providing the covered services with the products it lawfully used for similar services until 28 June 2030 (Art. 38(1)); self-service terminals used for services before that date may stay in use until the end of their economic useful life, for no more than 20 years after entering into service (Art. 38(4)).

Portaria n.º 220/2023, de 20 de julho, arts. 1.º a 4.º e anexos I e II · Read the law's page

• If you provide a service covered by Decreto-Lei 82/2022, make your websites, their online applications and your mobile services, including mobile applications, accessible in a consistent and adequate way by making them perceivable, operable, understandable and robust (Portaria 220/2023, Art. 2(2)(a), Annex I, Section III(c)); the Portaria names no technical standard.
• Provide information on how your service works, and on its accessibility features and interoperability with assistive devices, through more than one sensory channel, in an understandable and perceivable form, in text formats that can be rendered in other ways, and with a textual alternative for non-text content (Annex I, Section III(b)).
• Where you offer support services such as technical assistance, call centres or training, give information on the accessibility of the service and its compatibility with assistive technologies in accessible modes of communication (Annex I, Section III(d)).
• If you provide consumer banking services, offer identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and keep information at or below level B2 of the Common European Framework of Reference for Languages (Annex I, Section IV(e)).
• If you provide e-commerce services, give accessible information on the accessibility of the products and services sold, and make identification, security and payment functions perceivable, operable, understandable and robust (Annex I, Section IV(g)).
• If you provide an electronic communications service, provide real-time text in addition to voice, total conversation where you provide video, and synchronised voice, text and video in emergency communications passed to the most appropriate public safety answering point (Annex I, Section IV(a)).
• If you provide a service that gives access to audiovisual media services, provide perceivable, operable, understandable and robust electronic programme guides, and transmit subtitles for the deaf and hard of hearing, audio description, spoken subtitles and sign language interpretation with adequate quality, in sync with sound and video, and under the user's control (Annex I, Section IV(b)).
• If you provide passenger air, bus, rail, maritime or inland waterway transport services, provide information on the accessibility of vehicles, infrastructure and assistance, and on smart ticketing and real-time travel information (Annex I, Section IV(c)); for urban, suburban and regional transport services make the self-service terminals you use accessible (Annex I, Section IV(d)).
• If you provide e-books, deliver text and audio synchronised, do not block assistive technology, give access to the content structure, and supply accessibility metadata (Annex I, Section IV(f)).
• If you manufacture a product within Decreto-Lei 82/2022, design it so that persons with disabilities can perceive, use, understand and operate it, with more than one sensory channel, alternatives to speech and to colour, adjustable magnification, brightness and contrast, and accessible information on its operation and accessibility features (Annex I, Sections I and II; self-service terminals meet Section I only).
• If you rely on the disproportionate-burden defence, base the assessment on the ratio of the net costs of compliance to the total cost of making, distributing or importing the product or providing the service, on the estimate of the costs and benefits to you against the benefits to persons with disabilities, and on the ratio of the net costs to your net turnover (Art. 3, Annex II as republished by Declaração de Retificação 17/2023).

Lei n.º 73/2025, de 23 de dezembro (resiliência operacional digital do setor financeiro), artigos 1.º a 12.º · Read the law's page

• If you are a financial entity within Article 2(1) of Regulation (EU) 2022/2554 (DORA) established in Portugal, including an insurance or reinsurance undertaking or a pension fund management entity, comply with DORA as this Act executes it; the former Caixas Económicas that Article 2(2) lists are outside DORA and the Act.when it serves a financial business
• Report severe ICT-related incidents and any voluntary notification of a significant cyber threat to the competent authority Article 3 gives you: the Banco de Portugal where a credit institution distributes insurance or a credit or payment institution provides crowdfunding services, and otherwise the authority responsible for your prudential supervision (Article 3(2)(a) and (5)).when it serves a financial business
• If you make a voluntary notification of a significant cyber threat under DORA Article 19(2), also send it on the standard templates to the national CSIRTs (Article 5).when it serves a financial business
• Give the competent authority and your clients information that is complete, true, current, clear, objective and lawful, and cooperate with the authorities in crisis-management and contingency exercises that involve cyber-attack scenarios (Article 10(1)(a) and (b)).when it serves a financial business