Greece

Greek-language Bank of Greece act adopting the EBA travel rule guidelines for payment service providers and crypto-asset service providers it supervises. The guidelines implement Regulation (EU) 2023/1113.

Part C sets the national framework for Regulation (EU) 2023/1114 (MiCA): permitted entity forms, competent authorities and their powers, and administrative measures and penalties. The Bank of Greece cites it for its role over credit, e-money and payment institutions that issue tokens or provide crypto-asset services, and Article 106 for its penalty powers.

Greek NIS2 transposition, hosted here by ENISA. The National Cybersecurity Authority supervises essential and important entities and acts as single point of contact, CSIRT and cyber crisis management authority; the Authority's site cites Article 16 for staged incident notification.

The Bank of Greece applies MiCA to credit, e-money and payment institutions that issue tokens or provide crypto-asset services, and links a register page for white papers, service providers and issuers. ESMA's list of competent authorities splits Greek responsibilities between the HCMC and the Bank of Greece.

The Bank of Greece presents DORA as the operative rule on ICT risk management, incident reporting, resilience testing and ICT third-party risk for supervised financial entities. It receives major ICT incident reports and the register of information on ICT third-party arrangements.

Sets the terms for the Bank of Greece Regulatory Sandbox. The initial test lasts up to six months and may be extended once by up to six more, with a twelve-month maximum. Applicants must be institutions the Act covers, such as credit, payment and e-money institutions, leasing and factoring companies or insurers, and the product must be innovative and intended for the Greek market.

Amends Law 4557/2018 on money laundering and terrorist financing, including Article 13 (ordinary due diligence), Article 22 (reports to the Authority) and Article 30 (retention of records and data, amended by Article 21 of this law).

Sets the terms for authorising payment and e-money institutions and registering account information service providers, including qualifying holdings, board positions, professional indemnity insurance or equivalent guarantee, supervisory rules and safeguarding of users' funds. It also governs the public register under Article 14 of Law 4537/2018.

Greece's national data protection act. It sets out the HDPA's investigative and corrective powers (Art. 15), limits on access rights and on the Article 34 GDPR notification duty (Art. 33) and administrative fines on public bodies of up to EUR 10,000,000 (Art. 39). The HDPA states that it repealed Law 2472/1997 except for provisions kept by Article 84.

Greece's core AML/CFT statute, incorporating Directives (EU) 2015/849 and, through Law 4734/2020, 2018/843. It sets out cases for customer due diligence (Art. 12), due diligence measures (Art. 13) and their timing (Art. 14), reports to the Authority (Art. 22), record keeping (Art. 30), the designated executive in credit and financial institutions (Art. 38) and the Authority as FIU (Art. 47). The linked Bank of Greece PDF carries the original 2018 Gazette text without amendments.

Greek law on the distribution of insurance products, listed by the Bank of Greece as the national legislation for the insurance distribution sector.

Greek payment services law, transposing PSD2 in Part A. The Bank of Greece cites it for the public register of payment institutions (Art. 14) and the limited-network exemption notification (Art. 37(3)), and it applied Articles 13 and 24 when revoking a payment institution's licence in February 2026.

Transposes the Solvency II Directive into Greek law. It is the national statute the Bank of Greece lists as its insurance regulatory framework.