Czech RepublicAct No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives
Act No. 32/2025 Coll., Parts Two and Three (Banks Act Sections 8b and 25c)
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a bank or a savings and credit co-operative (družstevní záložna) in the Czech Republic, these additions to your sectoral law apply to you alongside Regulation (EU) 2022/2554.
- Cover, among the matters Section 8b(1) of the Banks Act lists, the establishment and management of the networks and information systems you use, as the EU rule on digital operational resilience requires, and ICT business-continuity policies and ICT response and recovery plans that are introduced, managed and tested under DORA Article 11 (Section 8b(1)(f) and (h)).
These lines are LexLint's reading of the law's text, as of . Also read by: Czech National Bank (ČNB) and National Cyber and Information Security Agency (NÚKIB), joint statement of (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Settledness
- As of
- Guidance link
- https://www.cnb.cz/export/sites/cnb/cs/dohled-financni-trh/.galleries/legislativni_zakladna/digitalni_provozni_odolnost/20260624_prohlaseni_cnb_nukib.pdf
- Guidance body
- Czech National Bank (ČNB) and National Cyber and Information Security Agency (NÚKIB), joint statement of
- Open questions
- Which provisions of the Cybersecurity Act (Act No. 264/2025 Coll.) prescribe 'výrazně jiné, přísnější nebo případně i podrobnější požadavky' (markedly different, stricter or more detailed requirements) that a bank must implement in addition to Regulation (EU) 2022/2554?
What this law does
Act No. 32/2025 Coll., promulgated on and in effect from , amends a number of financial-market laws in connection with EU digital-finance rules, among them Regulation (EU) 2022/2554 (DORA).
Part Two adds to the matters listed in Section 8b(1) of the Banks Act, as a new item f, the establishment and management of networks and information systems under the EU rule on the digital operational resilience of the financial sector, and, as a new item h, policies and plans for ICT business continuity and ICT response and recovery plans that are introduced, managed and tested under DORA Article 11.
It also makes the Czech National Bank's evaluation of the risks a bank is or may be exposed to cover the risks found by digital operational resilience testing under Chapter IV of DORA. Part Three makes parallel additions to the Act on savings and credit co-operatives.
When LexLint raises it
When your app profile says your app is a bank.