Moldova

Sets minimum ICT risk, information security and business continuity requirements for the payment service providers listed in Art. 5(1)(a)-(d) of Law 114/2012. Includes staged incident reporting to the NBM (point 81) and annual submission of penetration test results and a report on significant ICT risks within one month of year-end (point 82). Published in Official Monitor No. 62-65 of 20 February 2025, with phased compliance dates.

NBM regulation on the licensing and registration of non-bank payment service providers. Amended by Executive Board Decisions No. 267 of 31 October 2024 and No. 270 of 10 November 2025.

A strategic guiding document developed with the IFC, with four pillars and an Action Plan for 2024-2028, approved by Executive Board Decision No. 145 of 28 May 2024 and announced in a press release of 6 June 2024. The NBM page does not say whether it is binding and mentions no specific ESG or climate risk rules.

Main cybersecurity statute, listed first in the Cybersecurity Agency's national legal framework. Implementing government decisions in 2024-2025 cover the State Register of Cyber Incidents, critical-sector provider obligations and supervision, and coordinated vulnerability disclosure. Incident notification deadlines were not read.

Regulates the business of insurance and reinsurance and its supervision by the National Bank. Published in Official Monitor No 129-133 of 29 April 2022; the NBM page shows it in force from 1 January 2023.

Requires NBM approval for material outsourcing by banks and sets notification duties after outsourcing. Items 56 and 59(13) address material ICT outsourcing, including cloud risk assessment. Decision item 8 brings it into force one month after Official Monitor publication, a date the English text does not give; the PDF is the December 2021 version.

NBM regulation requiring banks to run an internal AML/CFT programme, apply customer due diligence, keep records and report suspicious activity to the Service. Issued under the NBM Law, the banking law and Law 308/2017, and partially transposes EU Regulation 2015/847. It also restricts bank dealings with foreign virtual asset service providers (items 47 and 57). Published in Official Monitor No. 321-332 of 24 August 2018.

Governs the licensing, organisation and prudential supervision of banks. Published in Official Monitor No 434-439 of 15 December 2017; Art. 146 governs publication of the sanctions the NBM applies under it.

Main AML/CFT statute. It requires reporting entities to adopt AML/CFT programmes and appoint compliance officers (Art. 13), apply customer due diligence (Arts. 5-8), keep records for five years (Art. 9) and report suspicious activity to the Service (Art. 11). Art. 4(11) prohibits providing virtual asset services in Moldova. Amended by Law 146 of 23 July 2026, in force from 13 August 2026; article numbers read from the legis.md text should be checked against the current consolidation.

Establishes the National Integrity Authority and its tasks: collecting declarations, checking assets and personal interests, enforcing conflict-of-interest and incompatibility rules and imposing contravention sanctions (Arts. 5-7). Published in Official Monitor No. 245-246 of 30 July 2016; latest amendment shown is Law 192 of 10 July 2025.

Sets the status, objectives and powers of the National Bank. The NBM's English page presents it as in force from 12 October 1995 and describes the Bank as exclusively responsible for licensing, supervising and regulating financial institutions; sanctions it publishes are cited to this law (Art. 75).