LexLint.ioBeta

Know the law your code answers to.

Law / Iceland

Digital Operational Resilience of the Financial Market: ICT Risk Management and Testing

Log nr. 78/2025 um stafrænan viðnámsþrótt fjármálamarkaðar, Art. 1, 3 and 5 (Regulation (EU) 2022/2554, Arts. 5 to 16 and 24 to 30)

archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.althingi.is/lagas/nuna/2025078.html

In force since .

A sector security regimes rule binding private bodies.

Instrument type
an act of a legislature
Obligation class
Security

As of .

What it requires

  • Applies to the financial entities within Regulation (EU) 2022/2554 (DORA), which Article 1 of Act 78/2025 gives the force of law in Iceland, other than Byggðastofnun, Lánasjóður sveitarfélaga and Náttúruhamfaratrygging Íslands (Article 12). Reached by declaring that you provide financial services.
  • Meet the ICT risk management requirements of Articles 5 to 14 of Regulation (EU) 2022/2554, or the simplified ICT risk management framework of Article 16 where it applies to you (Act 78/2025, Article 5, items 1 and 2).
  • Meet the Regulation's requirements on digital operational resilience testing, including the testing of ICT tools and systems and, where required, threat-led penetration testing (Articles 24 to 27 of the Regulation, Act 78/2025, Article 5, items 6 to 9).
  • Manage ICT third-party risk as Articles 28 to 30 of the Regulation require, including the contractual provisions on ICT third-party service providers (Act 78/2025, Article 5, items 10 and 11).

These lines are LexLint's reading of the law's text, as of .

If you get it wrong

Penalty structure

Article 5 sets a fine for a legal entity of ISK 500,000 to ISK 800,000,000, which may however be higher or up to 10 percent of total turnover according to the last approved annual accounts of the legal entity; a fine on an individual runs from ISK 100,000 to ISK 65,000,000, and the fine may reach twice the financial gain from the breach.

Rule
Higher of
As of
Minimum
500,000
Currency
ISK
Fixed cap
800,000,000
Turnover percentage cap
10

Who enforces it

Enforcement body

The Financial Supervisory Authority (Fjármálaeftirlitið), which supervises compliance with the Act and may fine a breach of the listed Articles of Regulation (EU) 2022/2554 under Article 5; the Central Bank of Iceland is the competent authority under Article 3.

Settledness

As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 1 of Act 78/2025 gives Regulation (EU) 2022/2554 (DORA) the force of law in Iceland. Article 5 lets the Financial Supervisory Authority fine a person who breaches Articles 5 to 14 of the Regulation on ICT risk management. Article 5 also lets the Authority fine a breach of Articles 24 to 30 of the Regulation on digital operational resilience testing and ICT third-party risk.

Article 3 makes the Central Bank of Iceland the competent authority, with the Financial Supervisory Authority supervising compliance. The Act took effect on .

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app