Greece
6 regulators · 13 laws & regulations · 5 obligations · 19 enforcement actions
Greece is a parliamentary republic under Article 1 of its Constitution.
Regulatory pulse · 90 days
Laws & Regulations Enforcement NewsOverview
Greece is a parliamentary republic under Article 1 of its Constitution. It has been a member of the European Union since 1 January 1981, of the Schengen area since 1 January 2000 and of the euro area since 1 January 2001. The Hellenic Statistical Authority (ELSTAT) estimates the resident population at 10.37 million on 1 January 2025, and the IMF puts nominal GDP at EUR 248.4 billion in 2025. The IMF names tourism and shipping services, food and beverages, and petroleum and chemicals as the main exports, with the EU, the United States and the United Kingdom as the main markets. Greek law is largely codified, from the Civil Code and Criminal Code to the procedural codes, and case law is only an indirect source of law.
In its 2026 Article IV consultation (press release of 27 May 2026), the IMF Executive Board commended Greece's very strong fiscal performance and found the banking system resilient under stress tests, with risks tilted to the downside. The FATF mutual evaluation published in September 2019 reported that Greece rates its money laundering risk as medium-high, with the proceeds of drug trafficking, corruption and tax offences among the main threats, and money or value transfer services, the legal professions and real estate agents as high-risk sectors. Greece rated its terrorist financing risk as medium-low, mainly linked to domestic far-left and anarchist extremist groups. The Bank of Greece directs supervised firms to a second national risk assessment, published by the Ministry of Economy and Finance. The sources reviewed do not name cyber risk as a national threat.
The Bank of Greece supervises credit institutions, insurers and certain other financial institutions under Article 55A of its Statute, within the Single Supervisory Mechanism, where the European Central Bank directly supervises significant banks. It also authorises payment and e-money institutions and checks the AML/CFT compliance of the institutions it supervises. Law 4557/2018, amended by Law 4734/2020 and later laws, is the core AML/CFT statute; suspicious transaction reports go to the Anti-Money Laundering Authority, the national financial intelligence unit, which alone investigates them. The Hellenic Capital Market Commission is the AML/CFT supervisor of investment firms and shares supervision of crypto-asset providers with the Bank of Greece under Law 5193/2025. The Hellenic Data Protection Authority oversees the GDPR and Law 4624/2019, the National Transparency Authority is the external whistleblowing channel under Law 4990/2022, and the National Cybersecurity Authority supervises the NIS2 rules under Law 5160/2024.
According to the Ministry of Foreign Affairs, Unit B (the Financial Sanctions Unit) of the Anti-Money Laundering Authority is the authority for the actions under Article 43 of Law 4557/2018. It applies asset freezes and bans on financial services under UN Security Council resolutions and EU measures. The Ministry's Directorate B6 handles dual-use export restrictions under Regulation (EU) 833/2014, whose maritime transport provisions fall to the Ministry of Maritime Affairs and Insular Policy. The FATF's 2019 evaluation found that Greece applied UN Security Council Resolution 1267 sanctions without delay through national measures that make up for gaps in the EU framework. The sources reviewed do not describe how exposure to non-EU sanctions arises for firms operating in Greece.
Recent enforcement
Open tracker →| Date | Entity | Regulator | Action | Source |
|---|---|---|---|---|
| Oct 2026 | Αποκεντρωμένη Διοίκηση Αιγαίου (Decentralised Administration of the Aegean) | HDPA | Monetary Penalty Remedial Direction | official |
| Jul 2026 | ΕΕΤΑΑ | HDPA | Monetary Penalty Remedial Direction | official |
| Jul 2026 | ΥΚΟΙΣΟ (Υπουργείο Κοινωνικής Συνοχής και Οικογένειας) | HDPA | Monetary Penalty Remedial Direction | official |
| Jul 2026 | NBL MONEY TRANSFER PAYMENT FOUNDATION S.A. | Bank of Greece | Licence Action | official |
| Jul 2026 | Ελληνικό Ανοικτό Πανεπιστήμιο (Hellenic Open University) | HDPA | Remedial Direction | official |
Industry compliance
Essential obligations
All obligations →| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Incident notification to the National Cybersecurity Authority (NIS2) | Early warning 24 hours; update 72 hours; final report 1 month | NCSA | official | |
Article 16 of Law 5160/2024 imposes stages of notification on essential and important entities: an early warning within 24 hours, a fuller update within 72 hours, an intermediate report on request and a final report within one month. Notices go to the NCSA CSIRT; central government and first- and second-tier local government notify the CSIRT of the National Intelligence Service with a copy to the NCSA. |
||||
| Personal data breach notification to the HDPA | Within 72 hours where feasible | HDPA | official | |
The HDPA states that controllers must notify it without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to risk individuals' rights and freedoms, using its online form, and must record every breach internally. Where the risk is high, individuals must also be informed. |
||||
| Major ICT incident reporting and ICT third-party register (DORA) | Deadlines per RTS (EU) 2025/301 | Bank of Greece | official | |
Supervised institutions send completed major-incident templates through a secure channel to the Bank of Greece, with notification deadlines set by RTS (EU) 2025/301 and forms by ITS (EU) 2025/302. Under Chapter V they must keep a register of information on contractual arrangements with ICT third-party providers and report it regularly. |
||||
| Authorisation of payment and e-money institutions | Before starting activity | Bank of Greece | official | |
Executive Committee Act 164/2/13.12.2019 sets the conditions for authorising payment and e-money institutions, including qualifying holdings, board positions and minimum professional indemnity insurance or comparable guarantees. Chapter I section 7 and Chapter III section 7 set measures for safeguarding the funds of payment service users and e-money holders. |
||||
| Periodic conformity assessment audit of qualified trust service providers | At least every 24 months | EETT | official | |
Art. 9 of EETT Regulation 837/1B provides for conformity assessment body audits of qualified trust service providers at least every 24 months, with the content of the report set by Art. 10. EETT's trust services page adds that the audit is at the provider's own expense and that the reports go to EETT for approval. |
||||
| No obligations match these filters. | ||||
Quick links — official sites
Newsletter
Get CRCGS Weekly
A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.