PortugalLei n.º 73/2025, Digital Operational Resilience of the Financial Sector
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- If you are a financial entity within Article 2(1) of Regulation (EU) 2022/2554 (DORA) established in Portugal, including an insurance or reinsurance undertaking or a pension fund management entity, comply with DORA as this Act executes it; the former Caixas Económicas that Article 2(2) lists are outside DORA and the Act.NIST CSF 2.0GV.OC-03
- Report severe ICT-related incidents and any voluntary notification of a significant cyber threat to the competent authority Article 3 gives you: the Banco de Portugal where a credit institution distributes insurance or a credit or payment institution provides crowdfunding services, and otherwise the authority responsible for your prudential supervision (Article 3(2)(a) and (5)).NIST CSF 2.0RS.CO-02
- If you make a voluntary notification of a significant cyber threat under DORA Article 19(2), also send it on the standard templates to the national CSIRTs (Article 5).NIST CSF 2.0RS.CO-03
- Give the competent authority and your clients information that is complete, true, current, clear, objective and lawful, and cooperate with the authorities in crisis-management and contingency exercises that involve cyber-attack scenarios (Article 10(1)(a) and (b)).NIST CSF 2.0ID.IM-02
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.IM-02Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.CO-03Information is shared with designated internal and external stakeholders
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 10 creates administrative offences (contraordenações) punished by fines that the competent authority imposes under Article 8(2); the Act creates no criminal offence.
Penalty structure
Article 11(1)(a) sets a fine for a legal person between EUR 10,000 and EUR 5,000,000 and for a natural person between EUR 5,000 and EUR 2,500,000; Article 11(2) raises the maximum to the greater of three times the economic benefit obtained and, for a legal person, 10 percent of turnover. Negligence halves the maximum (Article 9(2)).
- Rule
- Higher of
- As of
- Minimum
- 10,000
- Currency
- EUR
- Fixed cap
- 5,000,000
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
Banco de Portugal, the Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF) and the Comissão do Mercado de Valores Mobiliários (CMVM), each for the entities it supervises (Articles 3 and 8(2)).
Settledness
- As of
What this law does
The Lei n.º 73/2025, de 23 de dezembro (Act 73/2025 of 23 December) executes Regulation (EU) 2022/2554 (DORA) in Portuguese law and transposes Directive (EU) 2022/2556, amending the sector regimes for credit institutions, securities, insurance, payment services, pension funds, investment firms and asset management.
The Act was published in the Diário da República on and contains no commencement article, so under the default rule of the Act on the publication of legislation it came into force on the fifth day after publication, . Article 3 names the Banco de Portugal, the Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF) and the Comissão do Mercado de Valores Mobiliários (CMVM) as the competent authorities under DORA Article 46 for the entities each supervises.
The Banco de Portugal is the sole authority that receives reports of severe ICT-related incidents and voluntary notifications of significant cyber threats where credit institutions distribute insurance or credit and payment institutions provide crowdfunding services, and where an entity has more than one supervisor the authority responsible for its prudential supervision applies DORA Articles 19 and 22(1).
Article 5 requires a financial entity that makes a voluntary notification of a significant cyber threat under DORA Article 19(2) to send it, on the standard templates, to the national CSIRTs. Article 10(1) makes it an administrative offence to give an authority or clients information that is not complete, true, current, clear, objective and lawful, or to fail to give it.
Article 11 sets the fine for a legal person that is a credit institution, investment firm, insurer, payment institution or other listed financial entity at between EUR 10,000 and EUR 5,000,000, and for a natural person between EUR 5,000 and EUR 2,500,000. Article 11(2) raises the maximum fine to the greater of three times the economic benefit obtained and, for a legal person that is one of those financial entities, 10 percent of turnover.
When LexLint raises it
When your app profile says your app provides financial services.