Financial services

For a bank, lender, securities firm, payment or crypto-asset provider, and for the team that sells software to one.

In LexLint's library, 382 requirement lines in 85 laws from 39 jurisdictions reach a financial entity or the software it runs.

Whose legal responsibility it is

The same law reads differently from each side, which is why a sector has a door of its own rather than a filter on the library. A run reports each line to the side it belongs to.

The financial entity's own

Lines that bind the bank, lender, securities firm, payment or crypto-asset provider itself.

The entity's, carried out through software

Lines that remain the entity's legal responsibility but are carried out through the software it runs. A supplier's run reports them as its customer's legal responsibility, so the supplier knows what its product is used to meet.

The supplier's own

Lines that bind a supplier itself because it sells to a financial entity.

How to say it in a declaration

regulated_sector: {financial: body} for an app that is a financial entity's own.
regulated_sector: {financial: supplier} for a team that sells software to one.
is_bank, is_lender, is_securities_firm, is_payment_provider, is_crypto_asset_provider name the entity's license class as an activity.
/roles explains the financial axis a run reads.

The laws, by country

European Union 302 lines in 57 laws

Jurisdiction	Instrument	The entity	Through software	The supplier
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6) Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589	5	14
	DORA, Articles 5-16 (ICT Risk Management Framework) Regulation (EU) 2022/2554, Arts. 5-16	8	6
	Consumer Credit Directive, Duty to Assess the Consumer's Creditworthiness Before Lending (Article 18) Directive (EU) 2023/2225, Article 18(1) to (7), (9), first sentence, and (10) and (11)		13
	Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication Commission Delegated Regulation (EU) 2018/389, Arts. 2-9 and 22-36	1	12
	EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06), automated models and model governance EBA Guidelines on loan origination and monitoring (EBA/GL/2020/06)	8	4
	MiFID II Suitability Assessment for Investment Advice and Portfolio Management, Including Automated and Semi-Automated Systems (Article 25(2) and Delegated Regulation 2017/565 Article 54) Directive 2014/65/EU, Article 25(2), supplemented by Commission Delegated Regulation (EU) 2017/565, Article 54	2	10
	DORA Technical Standards on ICT Risk Management Tools, Methods, Processes and Policies and the Simplified ICT Risk Management Framework Commission Delegated Regulation (EU) 2024/1774	4	6
	MiFID II, Recording of Telephone Conversations and Electronic Communications Directive 2014/65/EU, Art. 16(7); Commission Delegated Regulation (EU) 2017/565, Art. 76	2	8
	AI Act, Article 6(2) and Annex III, point 5(b) (creditworthiness and credit-scoring systems: provider duties) Regulation (EU) 2024/1689, Article 6(2) and Annex III, point 5(b)			9
	Anti-Money-Laundering Regulation, Special Categories and Criminal Offence Data Processed by Obliged Entities (Articles 76 and 77(3)) Regulation (EU) 2024/1624, Arts. 76(1)-(4) and 77(3)		9
	DORA Technical Standards on the Standard Forms, Templates and Procedures for Reporting Major ICT-Related Incidents and Notifying Significant Cyber Threats Commission Implementing Regulation (EU) 2025/302		9
	DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing) Regulation (EU) 2022/2554, Arts. 24-27	4	1	3
	EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02), outsourcing a function to a service provider EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02)	6	1	1
	MiFID II Product Governance for Manufacturers and Distributors of Financial Instruments (Articles 16(3) and 24(2) and Delegated Directive 2017/593 Articles 9 and 10) Directive 2014/65/EU, Articles 16(3) and 24(2), supplemented by Commission Delegated Directive (EU) 2017/593, Articles 9 and 10	6	2
	Anti-Money-Laundering Regulation: Reporting of Suspicions to the Financial Intelligence Unit and Prohibition of Disclosure (Articles 69 and 73) Regulation (EU) 2024/1624, Articles 69 and 73		6
	Capital Requirements Directive, Robust Governance Arrangements of Institutions (Article 74(1)) Directive 2013/36/EU, Article 74(1)	5	1
	Consumer Credit Directive, Right to Human Intervention in an Automated Creditworthiness Assessment (Article 18(8)) Directive (EU) 2023/2225, Art. 18(8)		6
	DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301 Regulation (EU) 2022/2554, Article 19		6
	DORA, Articles 31-44 (Oversight of Critical ICT Third-Party Service Providers) Regulation (EU) 2022/2554, Arts. 31-44			6
	DORA, Articles 28-30 (ICT Third-Party Risk Management) Regulation (EU) 2022/2554, Arts. 28-30	2	1	2
	Fourth Anti-Money-Laundering Directive: Reporting of Suspicious Transactions to the Financial Intelligence Unit and Prohibition of Disclosure (Articles 33 and 39) Directive (EU) 2015/849, Articles 33 and 39		5
	Anti-Money-Laundering Regulation, Customer Rights on Decisions Resulting from Automated Processes and AI Systems (Article 76(5)) Regulation (EU) 2024/1624, Art. 76(5)		4
	Consumer Credit Directive, Limits on the Data a Creditworthiness Assessment May Use (Articles 18(3) and 19(5)) Directive (EU) 2023/2225, Arts. 18(3) and 19(5)		4
	DORA Technical Standards on the Classification of ICT-Related Incidents and Cyber Threats and the Materiality Thresholds for Major Incidents Commission Delegated Regulation (EU) 2024/1772		4
	DORA, Article 17 (ICT-Related Incident Management Process and Recording of Incidents) Regulation (EU) 2022/2554, Article 17		4
	MiFID II and MiFIR Records of Services, Activities, Orders and Transactions (Article 16(6) and MiFIR Article 25) Directive 2014/65/EU, Article 16(6), with Regulation (EU) No 600/2014, Article 25(1)		4
	Consumer Rights Directive, Adequate Explanations and Human Intervention in Online Tools for Distance Financial Services Contracts (Article 16d) Directive (EU) 2023/2673, inserting Article 16d(1), (3) and (4) into Directive 2011/83/EU		3
	Crypto-Asset Service Providers, Records of Communication with Clients Commission Delegated Regulation (EU) 2025/1140, Art. 2(2) and Annex, Section 1; Regulation (EU) 2023/1114, Art. 68(9)		3
	Anti-Money-Laundering Regulation, Human Oversight of AI-Generated Information Shared in Partnerships for Information Sharing (Article 75(4), Point (g)) Regulation (EU) 2024/1624, Article 75(4), point (g)		1
	Consumer Rights Directive, Identification in Distance Financial Services Calls Directive 2011/83/EU, Art. 16a(3), first sentence, as inserted by Directive (EU) 2023/2673		1
	Consumer Rights Directive, Notice of Call Recording in Distance Financial Services Calls Directive 2011/83/EU, Art. 16a(3), second sentence, as inserted by Directive (EU) 2023/2673		1
Estonia	Väärtpaberituru seadus Sections 82^15 and 82^16, Algorithmic Trading and Direct Electronic Access Controls Väärtpaberituru seadus, §§ 82^15 and 82^16	1	4
	Act Amending the Financial Supervision Authority Act and Other Acts (DORA Implementation), Credit Institution ICT Risk and Incident Notification RT I, 11.10.2024, 1, §§ 1 and 7 (Credit Institutions Act §§ 82^4 and 92^4)	1	2
	Võlaõigusseadus Section 55^2, Explanations to Consumers and Human Intervention in Online Financial Services Võlaõigusseadus, § 55^2		3
Latvia	Law on Digital Operational Resilience of the Financial Market and the Use of Artificial Intelligence, Articles 7, 8(5)-(7), 10(3)-(4) and 11(2) Finanšu tirgus digitālās darbības noturības un mākslīgā intelekta izmantošanas likums 7. pants, 8. panta piektā līdz septītā daļa, 10. panta trešā un ceturtā daļa, 11. panta otrā daļa	1	5
	Latvijas Bankas noteikumi Nr. 409, ICT Resilience Requirements Outside DORA Latvijas Bankas noteikumi Nr. 409 Prasības digitālās darbības nepārtrauktības un noturības jomā finanšu tirgus dalībniekiem, kuriem nepiemēro Regulu (ES) 2022/2554 (2026. gada 5. janvāris)	2	1
	Financial Market Digital Operational Resilience Law, DORA Provisions 4. līdz 6. un 8. līdz 11. pants (DORA daļa) Finanšu tirgus digitālās darbības noturības un mākslīgā intelekta izmantošanas likums (2025. gada 11. septembris)		2
Croatia	Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing Zakon o potrošačkim kreditima, Narodne novine 86/2026, čl. 24 i 30		5
	Zakon o provedbi Uredbe (EU) 2022/2554, Competent Authorities, Incident Reporting and Fines for Financial Entities čl. 7, 14 i 19, Zakon o provedbi Uredbe (EU) 2022/2554 (NN 136/2024)	1	2
Sweden	Lag (2024:1278), DORA Supplementary Provisions Lag (2024:1278) med kompletterande bestämmelser till EU:s förordning om digital operativ motståndskraft för finanssektorn, 1-5 kap.	2	2
	Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing Konsumentkreditlag (2026:1011), 2 kap. 7 § och 3 kap. 15 §		3
Luxembourg	Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and Reinsurers Loi du 6 février 2025 modifiant la loi modifiée du 7 décembre 2015 sur le secteur des assurances, Art. 181-3		4
	Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms Art. 5 et 20-21 à 20-25, Loi du 1er juillet 2024 (Mémorial A n° 271)	2
Poland	Act of 25 June 2025 on Digital Operational Resilience of the Financial Sector, Supervision and Reporting Provisions Ustawa z dnia 25 czerwca 2025 r. (Dz.U. 2025 poz. 1069) art. 18za do 18zl ustawy o nadzorze nad rynkiem finansowym i art. 133 ust. 2b Prawa bankowego		5	1
Austria	Verbraucherkreditgesetz 2026 (VKrG 2026), Personalized Offers and Automated Creditworthiness Assessment (Sections 13 and 17(5)) Verbraucherkreditgesetz 2026 (VKrG 2026), BGBl. I Nr. 36/2026, Art. 2, §§ 13 and 17 Abs. 5		3
	DORA-Vollzugsgesetz (DORA-VG), Competent Authority, Scope Extension and ICT Risk Penalties DORA-VG, BGBl. I Nr. 112/2024, Art. 1, §§ 2, 3, 7 und 8	1	1
Ireland	European Union (Digital Operational Resilience) (No. 2) Regulations 2025, Competent Authority and Sanctions S.I. No. 20 of 2025, regs. 3 to 7	1	1
	European Union (Digital Operational Resilience) Regulations 2025, ICT Systems and Continuity Duties of Financial Firms S.I. No. 12 of 2025, regs. 2 to 7	1	1
Portugal	Lei n.º 73/2025, Digital Operational Resilience of the Financial Sector Lei n.º 73/2025, de 23 de dezembro (resiliência operacional digital do setor financeiro), artigos 1.º a 12.º		4
Denmark	Lov nr. 1322 af 20. november 2025, Credit Agreements Act Section 7 c(9) to (11), Human Intervention in Automated Creditworthiness Assessment Lov nr. 1322 af 20. november 2025 om ændring af lov om kreditaftaler lov om markedsføring, lov om forbrugslånsvirksomheder og forskellige andre love (Gennemførelse af det reviderede forbrugerkreditdirektiv), § 1, nr. 15 (kreditaftalelovens § 7 c, stk. 9-11)		3
Hungary	2007. évi CXXXVIII. törvény (Bszt.), ICT Resilience of Algorithmic Trading Systems 26/B. §, 2007. évi CXXXVIII. törvény (Bszt.)		3
Malta	Malta DORA Regulations (S.L. 330.20) S.L. 330.20, Malta Financial Services Authority Act (Digital Operational Resilience Act (DORA)) Regulations, 2024 (L.N. 166 of 2024)		3
Finland	Laki Finanssivalvonnasta, Supervision and Sanctions for the Digital Operational Resilience Regulation 38 ja 40 §, Laki Finanssivalvonnasta (878/2008), DORA provisions		2
Germany	Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms WpHG § 80 Abs. 1 Satz 2 Nr. 1 und 4, as amended by Art. 4 Nr. 12 FinmadiG (BGBl. 2024 I Nr. 438)		2
Italy	Decreto legislativo 10 marzo 2025, n. 23, DORA Competent Authorities and Regulatory Powers Artt. 3 e 9, Decreto legislativo 10 marzo 2025, n. 23		2
Czech Republic	Act No. 32/2025 Coll. (Digitalisation of the Financial Market), DORA Provisions for Banks and Savings and Credit Co-operatives Act No. 32/2025 Coll., Parts Two and Three (Banks Act Sections 8b and 25c)	1
Spain	Real Decreto-ley 8/2023, Article 4, ICT Risk-Management Obligations of Payment System Operators, Payment Processors and Other Technology Providers Art. 4 del Real Decreto-ley 8/2023, de 27 de diciembre		1

United States 33 lines in 11 laws

Jurisdiction	Instrument	The entity	Through software	The supplier
United States	Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers 12 CFR Part 53 (OCC); 12 CFR Part 225, Subpart N (Federal Reserve Board); 12 CFR Part 304, Subpart C (FDIC)		1	2
	GLBA Safeguards Rule Breach Notification Amendment 16 CFR Section 314.4(j)		1
US-Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models 3 CCR 702-10, Regulation 10-1-1	1	4
	SB 21-169 (2021), Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models C.R.S. 10-3-1104.9		3
US-Maryland	HB 820 / Ch. 747 (2025), Artificial Intelligence in Health Insurance Utilization Review Md. Code Ann., Ins. §15-10B-05.1		5
US-Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization Ala. SB 63, 2026 Regular Session		4
US-New York	New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent 23 NYCRR 500.17		4
US-Utah	Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) Utah Code 31A-22-650, as amended		4
US-Arizona	Denial of claims; individualized review requirement A.R.S. § 20-3103		2
US-Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition Minn. Stat. § 62M.09, subd. 3(f) (2026 Minn. Laws ch. 124, art. 3, § 6)		1
US-Missouri	Genetic information, insurer and employer restrictions, confidentiality duty Mo. Rev. Stat. Secs. 375.1300, 375.1303, 375.1306, 375.1309		1

Brazil 9 lines in 2 laws

Jurisdiction	Instrument	The entity	Through software	The supplier
Brazil	CMN Resolution 4,893 of 2021, Cybersecurity Policy of Financial Institutions Resolução CMN nº 4.893 de 26 de fevereiro de 2021, arts. 2º, 3º, 3º-A, 6º, 7º, 8º e 22-A, as amended by Resolução CMN nº 5.274, de 18 de dezembro de 2025	3	2
	BCB Resolution 85 of 2021, Cybersecurity Policy of Payment Institutions and Other Authorized Institutions Resolução BCB nº 85 de 8 de abril de 2021, arts. 1º, 2º, 3º, 3º-A, 6º, 7º, 8º e 22-A, as amended by Resolução BCB nº 538, de 18 de dezembro de 2025	3	1

Haiti 7 lines in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions Banque de la République d'Haïti, Circulaire 126, Sur les règles en matière de sécurité informatique, 13 janvier 2022, arts. 1-5	5	2

Dominican Republic 6 lines in 4 laws

Jurisdiction	Instrument	The entity	Through software
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales Ley No. 172-13, Gaceta Oficial No. 10737, 15 de diciembre de 2013, arts. 1-6, 27-28, 42-43, 60 y 63	1	1
	Ley No. 172-13 sobre Protección Integral de los Datos Personales, rights of data subjects and habeas data Ley No. 172-13, arts. 7-26, 44, 71 (rights of data subjects and habeas data)		2
	Ley No. 172-13 sobre Protección Integral de los Datos Personales, special and sensitive categories of data Ley No. 172-13, arts. 66, 75-79 (special categories of data)		1
	Ley No. 172-13 sobre Protección Integral de los Datos Personales, supervision, administrative sanctions, and offences Ley No. 172-13, arts. 29, 81-88 (supervision, administrative sanctions, and offences)	1

Taiwan 5 lines in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit Arts. 24-25 of the Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries… (金融控股公司及銀行業內部控制及稽核制度實施辦法), full-text revision promulgated May 6, 2026 (Financial Supervisory Commission Order Jin-Guan-Yin-Guo-Zi No. 11502710961), effective on promulgation for the articles cited here	4	1

Lebanon 4 lines in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts) Banque du Liban Basic Decision No. 12725 of 28 November 2017 (Basic Circular No. 144 to Banks, also addressed to Financial Institutions) Prevention of Electronic Criminal Acts, Arts. 1-6	2	2

Senegal 4 lines in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
Senegal	Loi n° 2014-02 du 6 janvier 2014 portant réglementation des bureaux d'information sur le crédit dans les Etats membres de l'UMOA, bureaux d'information sur le crédit Loi n° 2014-02 du 6 janvier 2014 portant réglementation des bureaux d'information sur le crédit (loi uniforme UMOA) arts. 4, 35, 41-44, 53, 62 and 71		4

Malaysia 3 lines in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
Malaysia	Credit Reporting Agencies Act, registration and conduct of credit reporting agencies Credit Reporting Agencies Act 2010 (Act 710), ss. 11, 22, 24, 26, 30, 31, 39, 61 and 62		3

Qatar 3 lines in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
Qatar	Qatar Central Bank Artificial Intelligence Guideline Qatar Central Bank Artificial Intelligence Guideline (2024)	1	2

Serbia 2 lines in 2 laws

Jurisdiction	Instrument	The entity	Through software	The supplier
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures Zakon o informacionoj bezbednosti ("Sl. glasnik RS", br. 91/2025), čl. 5-12		1
	Law on Information Security, Incident Reporting Obligations Zakon o informacionoj bezbednosti ("Sl. glasnik RS", br. 91/2025), čl. 13-14, 24-25		1

Yemen 2 lines in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
Yemen	Law No. 40 of 2006 on Electronic Payment Systems and Financial and Banking Operations, Secure-Services and Banking-Confidentiality Duty Law No. 40 of 2006 Regarding Electronic Payment Systems and Financial and Banking Operations, art. 27	1	1

Libya 1 line in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
Libya	Libyan Credit Information Center, Credit Inquiry System Regulation: credit bureau duties, member duties and customer rights Credit Inquiry System Regulation of the Libyan Credit Information Center, 2023 (Central Bank of Libya)		1

State of Palestine 1 line in 1 law

Jurisdiction	Instrument	The entity	Through software	The supplier
State of Palestine	Law by Decree No. 41 of 2022 concerning National Payments, Licensing and Security-Systems Duty Law by Decree No. 41 of 2022 concerning National Payments, Art. 8		1

Lint your app

Every reader and sector: Who it's for.