Regulation 2024
Decision on Minimum Information-Communication System Management Standards for Financial Institutions (Official Gazette RS No 102/2024)
Issued by National Bank of Serbia
Plain-English summary
Sets minimum ICT management, business continuity and disaster recovery standards for banks, insurers, financial lessors, voluntary pension fund managers, payment and e-money institutions and, for its payment services, the public postal operator. It applies from 1 January 2026 (Section 65) and contains the incident reporting scheme to the NBS (Sections 41-49).
Who it applies to
Banking · NBFC / Non-bank Lending · Insurance · Asset & Wealth Management · Payments & Fintech
Topics
Cybersecurity & IT Risk Operational Risk & Outsourcing
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Report major ICT incidents to the NBS | Deadline Initial report promptly; final report within 15 days of incident end | NBS | official | |
Section 41 classifies major incidents, with classification due within 24 hours of detection, Sections 44-45 require an initial report promptly and Section 47 a final report within 15 days after the incident ends. Applies to banks, insurers, lessors, pension fund managers, payment and e-money institutions from 1 January 2026. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.