Italy

Reports the Bank's monitoring of action plans by a sample of non-bank intermediaries for integrating climate and environmental risks into strategy, governance, controls and risk management, with updated good practices.

Instructions issued by the UIF on 18 December 2025 under art. 6(4)(d) and art. 35(3) of Legislative Decree 231/2007. They apply from 1 July 2026, when the 4 May 2011 provision ceases to apply.

Transposes Directive (EU) 2022/2555 on a high common level of cybersecurity. Art. 10 makes the ACN the national competent NIS authority and art. 15 sets CSIRT Italia's incident-management role. Published in Gazzetta Ufficiale no. 230 of 1 October 2024.

National decree implementing MiCAR. Consob handles conduct supervision and authorises specialised crypto-asset service providers after a Banca d'Italia opinion; the Banca d'Italia handles prudential supervision and AML supervision of providers.

Implements the Corporate Sustainability Reporting Directive. It applies to large undertakings and listed SMEs, and to insurers and credit institutions whatever their legal form, and lets listed SMEs omit sustainability information for years starting before 1 January 2028. Published in Gazzetta Ufficiale no. 212 of 10 September 2024.

Protects people who report breaches in public and private entities. It requires internal channels for larger private entities and gives ANAC an external channel, a retaliation-complaint role and power to fine. ANAC presents it as in force from 15 July 2023.

EU regulation of 14 December 2022 on digital operational resilience for the financial sector. The Banca d'Italia presents it as the operative framework for reporting major ICT-related incidents by supervised financial entities, via the INFOSTAT platform, with annual estimates of costs and losses from major incidents.

Sets the rules for the FinTech Committee and for testing innovative products and services in a controlled environment, implementing a delegation in Decree-Law 34/2019; a Banca d'Italia news item dates the decree to 30 April 2021. The Banca d'Italia, Consob and IVASS run the sandbox, which opened for applications in November 2021 and from 3 November to 5 December 2023.

Provvedimento of 24 March 2020 (published 25 March 2020) implementing the record-keeping duty in art. 31 of Legislative Decree 231/2007 for supervised intermediaries.

Provvedimento of 30 July 2019 on customer due diligence by supervised intermediaries. It sets when due diligence applies, how beneficial owners are identified and how ongoing monitoring works.

Provvedimento of 26 March 2019 (published 27 March 2019) setting AML organisation, procedures and internal controls for supervised intermediaries. It covers the AML function, the AML head and the annual risk self-assessment.

IVASS regulation implementing Legislative Decree 231/2007, as amended by Legislative Decree 90/2017, for insurance undertakings and intermediaries. Its consolidated text, amended by IVASS Provisions 111/2021 and 144/2024, sets the AML function (art. 13), its head (art. 15) and the head of suspicious transaction reporting (art. 18).

Supervisory provisions for payment and e-money institutions. The initial text of 17 May 2016 took effect on 1 June 2016 and replaced a 2012 version; amendments followed on 23 July 2019, 22 February 2022, 2 November 2022 and 3 February 2026, the last presented as current. The Banca d'Italia cites the 2022 text in a 2026 fining order.

Sets duties on public administrations to prevent corruption, including a designated anti-corruption officer (art. 1(7)) and a three-year prevention plan adopted by 31 January each year (art. 1(8)). Normattiva shows the original text as published in Gazzetta Ufficiale no. 265 of 13 November 2012.

The Private Insurance Code, published by IVASS in an annotated version dated 19 June 2026 and updated to Legislative Decree 57 of 27 March 2026. It is the primary statute for insurers and insurance intermediaries, with IVASS regulations issued under it (for example Regulation 55 of 11 April 2024 on arts. 190 and 190-bis).

The national data protection code, adapted to the GDPR (Regulation (EU) 2016/679) by Legislative Decree 101/2018 of 10 August 2018. The Garante is the supervisory authority and publishes the code with its deontological rules.

Consolidated law on financial intermediation. Consob's sanctions under it include those for market abuse (art. 187-bis) and for failures to disclose holdings (art. 120, sanctioned under art. 193). Consob lists an update by Legislative Decree 128 of 25 June 2026, in force from 7 August 2026.

Core banking statute setting the powers of the CICR, the Ministry of Economy and Finance and the Banca d'Italia. The Banca d'Italia applies its sanctions provisions (arts. 144 ff.) in its fining orders. The linked PDF is an informational consolidated text of March 2025, updated to Law 28 of 11 March 2025.