SpainReal Decreto-ley 8/2023, Article 4, ICT Risk-Management Obligations of Payment System Operators, Payment Processors and Other Technology Providers
Art. 4 del Real Decreto-ley 8/2023, de 27 de diciembre
In force since .
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a payment system operator, payment scheme operator, electronic payment arrangement operator, payment processor or other technology or technical service provider providing services in Spain, Article 4 binds you, unless you are a payment system operator the European Central Bank considers systemically important.
- Meet the ICT risk-management obligations of Chapter II of Regulation (EU) 2022/2554, reading the Regulation's references to financial entities as references to you (Article 4(1)).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Banco de España, the competent authority for supervising and sanctioning compliance under Article 4(2).
Settledness
A draft law (anteproyecto de ley) published by the Ministry for public consultation would rewrite Article 4 to reach only operators subject to national supervision or oversight and to add Chapter V, Section I of Regulation (EU) 2022/2554; it is a draft and is not recorded as guidance.
- As of
- Open questions
- Which 'otros proveedores de servicios tecnológicos o técnicos que presten servicios en España' (other technology or technical service providers that provide services in Spain) are bound by Article 4(1) of Real Decreto-ley 8/2023 to comply with Chapter II of Regulation (EU) 2022/2554, when the article states no test for who they are?
What this law does
Article 4 of Real Decreto-ley 8/2023, de 27 de diciembre, published in the Boletín Oficial del Estado of , requires payment system operators, payment scheme operators, electronic payment arrangement operators, payment processors and other technology or technical service providers that provide services in Spain to comply with the obligations in Chapter II of Regulation (EU) 2022/2554 (DORA), and reads the Regulation's references to financial entities as references to them.
Under Article 4(2) the Banco de España is the competent authority to supervise compliance and sanction breaches. Under Article 4(3) a breach is an infringement for the purposes of Article 92(f) of Law 10/2014. Article 4(4) does not apply to payment system operators that the European Central Bank considers systemically important.
The decree-law entered into force on , and DORA's requirements for credit, payment and e-money institutions become fully enforceable from .
When LexLint raises it
When your app profile says your app is a payment provider.