Norway

Implements Regulation (EU) 2022/2554 (DORA) and Directive (EU) 2022/2556: ICT risk management, incident reporting, resilience testing, ICT contracts and oversight of ICT third-party providers. Finanstilsynet says the DORA-loven and the DORA-forskriften (lovdata.no/forskrift/2025-06-24-1296) are in force since 1 July 2025 and, for many supervised entities, replace the ICT Regulation (IKT-forskriften).

Implements Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets. Finanstilsynet says it extends the transfer-information requirements of TFR I to crypto-asset service providers and puts them under AML duties on the same basis as payment service providers.

Applies the EU Markets in Crypto-Assets Regulation (EU) 2023/1114 as Norwegian law: issuing, public offering and admission to trading of crypto-assets, crypto-asset services and market abuse. Finanstilsynet supervises crypto-asset service providers. Level 2 rules are in the Regulation of 25 June 2025 no. 1311 (kryptoeiendelsforskriften).

Finanstilsynet lists this act first among the laws that apply to all entities under its supervision. Finanstilsynet's DORA page cites its section 1-2 for the definition of the firms under supervision.

Norway's implementation of the EU CSRD, amending the Accounting Act and other laws. The government says the largest listed companies report from financial year 2024 and some smaller financial institutions and group parents from 2025. Finanstilsynet controls listed issuers' sustainability reporting under the Securities Trading Act section 19-1. The European sustainability reporting standards are to be set in a separate regulation.

Passed by the Storting on 7 December 2023. Providers of essential services and digital service providers must assess risk, apply security measures (sections 7 and 10) and report significant incidents (sections 8 and 11); administrative fines are possible under section 17. NSM says the act and its regulation entered into force on 1 October 2025 and that NIS2 is not yet in Norwegian law.

Requires organisations obliged to register to submit beneficial-owner information to the Brønnøysund Register Centre within 14 days, and allows daily coercive fines. The Register Centre also cites Chapter 4, section 14 of the Anti-Money Laundering Act.

Sets risk assessment, written routines, customer due diligence, ongoing monitoring, investigation and reporting of suspicious circumstances to Økokrim, a ban on tipping off, training and internal control for reporting entities. Finanstilsynet imposes administrative fines under sections 49 and 50.

Passed on 15 June 2018 and in force from 20 July 2018. It makes the GDPR Norwegian law and sets national rules where the GDPR allows choices, including exceptions to data subjects' access and information rights (chapter 4). It establishes Datatilsynet and Personvernnemnda.

Norwegian act on electronic trust services including electronic signatures, linked from Nkom's eIDAS page, which says it entered into force on 15 June 2018. Trust service providers must report security incidents that significantly affect their services to Nkom.

Main act for banks, finance companies, insurers and other financial institutions. Finanstilsynet's licensing pages cite it for payment institution licences (section 2-10), e-money issuance (section 2-4), starting capital (section 3-4), own funds (section 13-6) and safeguarding of customer funds (section 13-18).

Listed by Finanstilsynet under banking and finance. It adapts the EU capital requirements rules (CRR/CRD IV) to Norway. Finanstilsynet's page on banking supervision describes ICAAP and SREP reviews of banks' risk and capital needs.

The national securities market act listed by Finanstilsynet, applied together with the EU Market Abuse Regulation and Short Selling Regulation through the Securities Trading Regulations. Finanstilsynet cites its section 19-1 second paragraph for its control of listed issuers' periodic financial reporting.

Finanstilsynet lists this act among the laws on insurance and pensions, together with the Insurance Mediation Act, the Act on mandatory occupational pensions and the Financial Institutions Act.

Sets Norges Bank's aim of monetary stability and financial system stability (section 1-2), its sole right to issue banknotes and coins (section 3-4) and its role in the settlement system and payment system oversight (sections 1-3 and 3-3). Norges Bank's English page states it entered into force on 1 January 2020 and replaced the Act of 24 May 1985 No. 28.