LiechtensteinEEA DORA Implementation Act (EWR-DORA-DG), Reporting of Major ICT-Related Incidents
Gesetz vom 5. Dezember 2024 zur Durchführung der Verordnung (EU) 2022/2554 (EWR-DORA-Durchführungsgesetz; EWR-DORA-DG) LGBl. 2025 Nr. 121, Art. 9 Abs. 2 Bst. a Ziff. 3 and Art. 19 of the Regulation
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a financial entity and an ICT third-party service provider within Article 2 of the EEA DORA Implementation Act, subject to the exceptions in Article 2(3) of Regulation (EU) 2022/2554 (reached by declaring that you hold a financial-services license). Regulation (EU) 2022/2554 applies as national law under Article 11 until its incorporation into the EEA Agreement.
- Report major ICT-related incidents to the FMA, as the relevant competent authority, with an initial notification, an intermediate report and a final report within the time limits laid down under Article 20 of Regulation (EU) 2022/2554 (Article 19(1) and (4) of the Regulation).
- Inform your clients without undue delay as soon as you become aware of a major ICT-related incident that has an impact on their financial interests, and of the measures taken to mitigate its adverse effects (Article 19(3) of the Regulation).
- File the reports Article 19 requires completely, correctly and on time (Article 9(2)(a) of the Act).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
The cap applies to a legal person; a natural person faces a fine of up to CHF 200,000.
- Rule
- Fixed only
- As of
- Currency
- CHF
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The Financial Market Authority (FMA) Liechtenstein, the competent authority under Regulation (EU) 2022/2554.
What this law does
Article 2 of the EEA DORA Implementation Act applies the Act to financial entities and ICT third-party service providers, subject to the exceptions in Article 2(3) of Regulation (EU) 2022/2554. Article 11 of the EEA DORA Implementation Act makes Regulation (EU) 2022/2554 national law until its incorporation into the EEA Agreement.
Article 9 of the EEA DORA Implementation Act fines a person who fails to submit the reports required by Article 19 of Regulation (EU) 2022/2554 to the FMA correctly, completely or on time. Article 19 of Regulation (EU) 2022/2554 requires financial entities to report major ICT-related incidents to the relevant competent authority.
When LexLint raises it
When your app profile says your app provides financial services.