Liechtenstein

Sets cyber-security risk-management and incident-reporting duties for medium and large entities in the sectors listed in its annexes, applying the NIS 2 Directive. Significant incidents need an early warning within 24 hours and a notification within 72 hours (Art. 6); fines reach CHF 10,000,000 or 2% of turnover for essential entities (Art. 23).

Sets the conduct rules for banks and investment firms providing investment services and activities, to protect clients and preserve trust in the financial centre. It implements MiFID II and MiFIR; the FMA is the competent authority (Art. 3(1) no. 15, Art. 33).

Governs the licensing and supervision of banks and financial holding companies. Its stated purpose is to protect creditors and investors, preserve trust in the banking system and maintain financial stability. Banks need an FMA licence before starting operations (Art. 16) and unlicensed commercial banking is prohibited (Art. 7).

National act implementing DORA for financial intermediaries. The FMA states it took effect on 1 February 2025, while DORA itself has applied since 17 January 2025.

Implements the EU Markets in Crypto-Assets Regulation. The FMA is the competent authority (Art. 20) and may keep a public register of providers (Art. 21). Art. 31 sets base fine limits of CHF 1,000,000 for legal persons and CHF 500,000 for natural persons, with higher limits for serious, repeated or systematic breaches.

Implements the EU sustainable finance disclosure and taxonomy regulations. The FMA is the competent authority (Art. 4); fines reach CHF 200,000 for listed disclosure breaches (Art. 8) and the FMA publishes final penalties and measures (Art. 13).

Sets ICT governance, risk management, security testing and ICT third-party (outsourcing and cloud) requirements for deposit guarantee schemes, insurance intermediaries, pension institutions and fund management companies. It does not apply to entities covered by DORA. Issued 19 May 2021, last amended 4 December 2024.

Requires legal entities to identify their beneficial owners and report them to the Amt für Justiz, which keeps the electronic register (Art. 6). Reports are due within 30 days of entry in the commercial register and within 30 days of becoming aware of any change (Art. 4(4), (5)); the Act implements Art. 30 and 31 of Directive (EU) 2015/849.

Implements the eIDAS Regulation (EU) No. 910/2014 except its Chapter II (Art. 1). A qualified electronic signature satisfies the written-form requirement of § 886 ABGB unless law or agreement provides otherwise (Art. 3), and the Amt für Kommunikation is the supervisory authority (Art. 11). The Lilex listing shows a single version, in force from 1 July 2019.

Sets the civil-law basis for tokens and the registration and supervision of VT (trustworthy technology) service providers. Providers seated in Liechtenstein must be entered in the FMA register before starting (Art. 12, 19); the FMA supervises them (Art. 39, 43).

Sets the conditions for providing payment services in Liechtenstein and other EEA states. Commercial payment services need an FMA licence valid across the EEA (Art. 7); the Act also covers initial capital (Art. 10) and access to payment systems and accounts.

Implements the GDPR and Directive (EU) 2016/680 nationally. It sets up the Datenschutzstelle (Art. 9-12), limits some information and access rights (Art. 30-37) and sets administrative fines of up to CHF 11 million or 2% of turnover and up to CHF 22 million or 4% of turnover (Art. 40).

FMA guidance, issued under Art. 28(3) SPG, explaining how the FMA interprets the SPG and SPV for all obligated persons, with a special part for sectors such as asset managers, insurers, casinos, real estate brokers and crypto-service providers. In force from 24 April 2018 and last amended 9 May 2025.

Governs supervision of insurance undertakings, with the aim of protecting policyholders from insolvency risk and abuse. Insurers need an FMA licence to start business (Art. 11), and the Act implements Solvency II (Directive 2009/138/EC).

The main AML/CFT statute. It sets customer due diligence (Art. 5), reporting to the FIU (Art. 17), documentation (Art. 20) and internal organisation duties (Art. 22), names the FMA as supervisor for most obligated entities (Art. 23) and carries the penalty provisions the FMA applies (Art. 31).

Establishes the FMA as an independent public-law institution (Art. 2, 3) with the objectives of financial market stability, customer protection, prevention of abuse and compliance with international standards (Art. 4). Art. 5 lists the laws the FMA supervises and enforces, Art. 21a requires it to inform the public on its supervisory activity at least once a year, and Art. 25a lets it publish final decisions on serious breaches.

Sets the status, powers and tasks of the Financial Intelligence Unit. Its core tasks are receiving information, risk-based analysis and reporting to the public prosecutor's office (Art. 4); the FIU is independent in performing them (Art. 3).

Applies to public and private enterprises, subject to the exclusions in Art. 2 to 4 (Art. 1). Sets weekly working-time limits of 45 or 48 hours, depending on the worker group, and 40 hours for young workers (Art. 9); the Amt für Volkswirtschaft monitors compliance (Art. 41). The consolidated text is the version of 1 January 2019.