Regulation 2025
Regulamentul privind cerințele minime pentru gestionarea riscurilor aferente tehnologiei informației și comunicațiilor, securității informației și continuității activității (Regulation on minimum requirements for ICT risk management, information security and business continuity), Decision No. 29 of 12 February 2025
Issued by National Bank of Moldova (Banca Națională a Moldovei)
Effective: 20 Mar 2025
Plain-English summary
Sets minimum ICT risk, information security and business continuity requirements for the payment service providers listed in Art. 5(1)(a)-(d) of Law 114/2012. Includes staged incident reporting to the NBM (point 81) and annual submission of penetration test results and a report on significant ICT risks within one month of year-end (point 82). Published in Official Monitor No. 62-65 of 20 February 2025, with phased compliance dates.
Who it applies to
Payments & Fintech
Topics
Cybersecurity & IT Risk Payments & Fintech / Digital Assets Operational Risk & Outsourcing
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| ICT incident reporting by payment service providers to the NBM | Deadline Initial notice same or next working day; intermediate 3 days; final 20 days | NBM | official | |
Point 81 of the ICT regulation requires an initial notification of incidents affecting critical functions by the end of the working day (point 81.1), and for significant functions or payment services by the next working day (81.2). An intermediate report follows within 3 days (81.3) and a final report within 20 days of the initial notice (81.4). |
||||
| No obligations match these filters. | ||||
Latest news
-
RBI penalizes Ola Financial Services for KYC compliance failures
25 Sep 2026
The Reserve Bank of India imposed a monetary penalty of ₹3.10 lakh on Ola Financial Services Private Limited for non-compliance with KYC directions under the Payment and Settlement Systems Act, 2007. Following a…