Iceland

Legal entities carrying on business in Iceland or entered in the company register must record their beneficial owners with the Director of Internal Revenue. Art. 6 requires changes to be reported within two weeks and Art. 11 requires records to be kept for five years after beneficial ownership ends.

Art. 8(1) requires operators of essential services to notify the national cybersecurity team (CSIRT) of serious incidents or risks as soon as possible; the Act sets no fixed deadline in hours or days. Banking and financial market infrastructure operators follow DORA instead. Fjarskiptastofa's site carries a security incident reporting form.

Art. 5 requires workplaces with 50 or more employees on average over a year to adopt written internal reporting procedures drawn up in consultation with staff. The Work Environment Authority publishes a model for workplaces outside the state and municipal sectors.

Art. 2 gives the GDPR the force of law. Arts. 17 to 22 of the Act cover information and access, correction, erasure, restriction and portability, objection and profiling, and automated decision-making, with the exceptions set out there.

Art. 27 requires the controller to notify Persónuvernd of a personal data breach without undue delay and, where possible, within 72 hours of becoming aware, unless the breach is unlikely to pose a risk to individuals. Data subjects must also be told without undue delay when the risk is high.

Art. 28 requires due diligence records, supporting documents and transaction records to be kept for at least five years from the end of the business relationship or from the individual transaction. Supervisors and the FIU may require retention for up to five further years where there is cause.

Art. 8 requires due diligence when a business relationship begins, for single transactions of EUR 15,000 or more, for transfers of EUR 1,000 or more and where money laundering or terrorist financing is suspected. Art. 10 requires identification and verification of the customer and beneficial owner and bars the transaction if due diligence cannot be completed; Arts. 12 and 13 provide for simplified and enhanced due diligence.

Art. 21 requires the responsible officer to report suspicious transactions to the police FIU 'tímanlega' (in good time), after preparing a written internal report under Art. 21(2). The FIU's own page says reports go through goAML and that, where stopping a transaction could hinder an investigation, the report is made as soon as it has taken place.

Art. 6 requires entities that are not exempt to hold a payment institution licence before providing payment services. Art. 4 covers the application and Art. 12 the conditions for granting it; the Financial Supervisory Authority grants the licence.

Art. 25 requires funds received in exchange for e-money to be held safely and kept separate from the institution's own funds, for example in a deposit account at a financial undertaking or in secure, liquid, low-risk assets. Funds received through a payment instrument must be safeguarded within five business days of issue.

Art. 10 requires a payment institution to hold funds received from users securely and keep them separate from its own funds, for example in a deposit account at a financial undertaking or in safe, liquid, low-risk assets. In bankruptcy the funds are treated as segregated claims if the owner can prove ownership, and the Central Bank sets more detailed rules.