Is a payment provider, in Liechtenstein

Gesetz vom 5. Dezember 2024 zur Durchführung der Verordnung (EU) 2022/2554 (EWR-DORA-Durchführungsgesetz; EWR-DORA-DG), LGBl. 2025 Nr. 121, Art. 2, 9 · Read the law's page

• This binds a financial entity and an ICT third-party service provider within Article 2 of the EEA DORA Implementation Act, subject to the exceptions in Article 2(3) of Regulation (EU) 2022/2554 (reached by declaring that you hold a financial-services license). Regulation (EU) 2022/2554 applies as national law under Article 11 until its incorporation into the EEA Agreement.
• Meet the ICT risk management requirements of Articles 5 to 14 of Regulation (EU) 2022/2554, or the simplified requirements of Article 16(1) and (2) where they apply (Article 9(2)(a)).
• Carry out the digital operational resilience tests required by Articles 24 and 25 of Regulation (EU) 2022/2554 (Article 9(2)(a)).
• Manage ICT third-party risk under Articles 28 and 29 of Regulation (EU) 2022/2554 and include in contracts for ICT services the terms Article 30 requires (Article 9(2)(a)).
• Provide the FMA with complete and correct information and comply with its orders (Article 9(2)(b) and (c)).

Gesetz vom 5. Dezember 2024 zur Durchführung der Verordnung (EU) 2022/2554 (EWR-DORA-Durchführungsgesetz; EWR-DORA-DG), LGBl. 2025 Nr. 121, Art. 9 Abs. 2 Bst. a Ziff. 3 and Art. 19 of the Regulation · Read the law's page

• This binds a financial entity within Article 2 of the EEA DORA Implementation Act, subject to the exceptions in Article 2(3) of Regulation (EU) 2022/2554 (reached by declaring that you hold a financial-services license). The reporting duty rests on the financial entity, which stays fully responsible if it outsources the reporting to a third-party service provider (Article 19(5) of the Regulation). Regulation (EU) 2022/2554 applies as national law under Article 11 until its incorporation into the EEA Agreement.
• Report major ICT-related incidents to the FMA, as the relevant competent authority, with an initial notification, an intermediate report and a final report within the time limits laid down under Article 20 of Regulation (EU) 2022/2554 (Article 19(1) and (4) of the Regulation).
• Inform your clients without undue delay as soon as you become aware of a major ICT-related incident that has an impact on their financial interests, and of the measures taken to mitigate its adverse effects (Article 19(3) of the Regulation).
• File the reports Article 19 requires completely, correctly and on time (Article 9(2)(a) of the Act).