LatviaFinancial Market Digital Operational Resilience Law, DORA Provisions
4. līdz 6. un 8. līdz 11. pants (DORA daļa) Finanšu tirgus digitālās darbības noturības un mākslīgā intelekta izmantošanas likums (2025. gada 11. septembris)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you are a financial market participant listed in Article 4 of the Law (for example a credit institution, payment institution, electronic money institution, investment firm, insurance or reinsurance undertaking, trading venue or crypto-asset service provider), meet the digital operational resilience requirements of Regulation (EU) 2022/2554 (DORA); if you are one of the Article 5 entities, meet DORA's simplified framework.NIST CSF 2.0GV.OC-03
- Inform Latvijas Banka of all material changes, including any circumstance that may adversely affect your further operation, and of changes in the information you gave it (Article 9).no control in the NIST CSF 2.0
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Law's sanctions are warnings, fines and administrative measures that Latvijas Banka applies; it creates no criminal offence.
Penalty structure
Article 10(1) sets the ceiling for a legal person at EUR 5,000,000 or 3 percent of total annual turnover, whichever is higher, and for a natural person at EUR 700,000, for the Regulation (EU) 2022/2554 breaches Article 11(1) lists.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 5,000,000
- Turnover percentage cap
- 3
Who enforces it
Enforcement body
Latvijas Banka (Bank of Latvia), the supervisor of digital operational resilience under Article 8(1) of the Law and Article 46 of Regulation (EU) 2022/2554.
Settledness
- As of
What this law does
The Finanšu tirgus digitālās darbības noturības un mākslīgā intelekta izmantošanas likums (Financial Market Digital Operational Resilience and Use of Artificial Intelligence Law) was adopted by the Saeima on , published in Latvijas Vēstnesis No. 188 on and took effect on .
Its digital-operational-resilience half applies Regulation (EU) 2022/2554 (DORA) to the 24 classes of financial market participant that Article 4 lists, among them credit institutions, payment institutions, electronic money institutions, investment firms, insurance and reinsurance undertakings, trading venues and crypto-asset service providers.
Article 5 puts the entities that DORA Article 16 covers under the simplified framework, and Article 6(1) takes savings and loan associations, giro settlement institutions, small insurers and small alternative investment fund managers out of DORA while Article 6(3) lets Latvijas Banka set ICT risk-management, information-security and ICT-operations requirements for them.
Article 8 makes Latvijas Banka the supervisor of digital operational resilience under DORA Article 46, gives it the investigatory and sanctioning powers of DORA Article 50(2), and lets it set the methodology for assessing losses from major ICT-related incidents and the way major ICT-related incidents are reported.
A financial market participant covered by Articles 4 and 5 must inform Latvijas Banka of all material changes, including any circumstance that may adversely affect its further operation, and of changes in the information it has given the Bank.
Article 10(1) lets Latvijas Banka issue a warning or fine a legal person up to EUR 5,000,000 or 3 percent of total annual turnover, whichever is higher, and a natural person up to EUR 700,000, for breaching the Regulation (EU) 2022/2554 requirements that Article 11(1) lists. The Law also applies Regulation (EU) 2024/1689 (the AI Act) to the same participants in Article 7 and the provisions that follow it, which is a separate regime from DORA.
When LexLint raises it
When your app profile says your app provides financial services.