Is a lender, in Kosovo

Rregullore për Sistemet e Informacionit dhe Menaxhimin e Rrezikut Kibernetik · Read the law's page

• This duty binds every financial institution licensed or supervised by the Central Bank of the Republic of Kosovo, other than a non-bank financial institution that carries out only foreign exchange activities and an insurance intermediary (reached by declaring that you provide financial services in Kosovo). Obligations scale with each institution's size, risk profile and complexity, but every bank must meet them all, and institutions must comply from 1 June 2026.
• Keep a governance and internal control framework for ICT and cyber risk, have your board of directors approve every information systems policy (ICT, information security and cyber), and assess and review the policies each year (governance and organisation article).
• Designate a person or unit responsible for information security that is independent of other units and reports to the chief executive, and appoint a chief information and technology officer and a chief information security officer with the expertise needed; tell the BQK 30 days before each appointment, and the BQK may object (governance and organisation article, paragraphs 7 and 8). An institution that under the proportionality article decides not to appoint these roles must still secure sufficient expertise, experience and independence.
• Establish a risk management framework that assigns an owner to each identified technology risk and runs a repeated cycle of risk assessment, treatment and monitoring, and review it regularly (risk management framework article).
• Run a process for regular vulnerability scanning and address the risks found without delay; carry out penetration tests of external digital services at least once a year if you are a bank and at least every two years if you are another financial institution, and after any major system change (vulnerability scanning and penetration testing articles).
• Review, update and test your business continuity and disaster recovery plans at least once a year or after significant changes to ICT systems or business processes (business continuity and disaster recovery article).
• Have the internal audit function audit IT, cybersecurity controls, governance, compliance and outsourcing, on an annual audit plan your board approves, and report high-risk findings to the board without undue delay (audit article).

Rregullore për Sistemet e Informacionit dhe Menaxhimin e Rrezikut Kibernetik, Neni 31 · Read the law's page

• This duty binds every financial institution licensed or supervised by the Central Bank of the Republic of Kosovo, other than a non-bank financial institution that carries out only foreign exchange activities and an insurance intermediary (reached by declaring that you provide financial services in Kosovo). Obligations scale with each institution's size, risk profile and complexity, but every bank must meet them all, and institutions must comply from 1 June 2026.
• Notify and report each incident to the BQK no later than 4 hours after you discover it; the initial report or notification gives information on the significant threat and the affected systems (incident management article, paragraph 10; Annex 1).
• Telephone the BQK officials immediately, while the report is being prepared, and have your chief information security officer sign the written report (Annex 1, notes c and d).
• Submit an interim report within 72 hours (Annex 1, note a, counts the 72 hours from the occurrence of the incident) and the final report within 30 days, using the models in Annexes 1 and 2, and provide updates whenever there is a development until the closing report is submitted (incident management article, paragraph 10; Annex 1, note a).
• Report cyber incidents and technological failures to the relevant regulatory authorities as the incident management article provides (incident reporting article).
• Report immediately any incident that involves a malfunction, breach or adverse result of an artificial intelligence system you use (artificial intelligence article, paragraph 11).