Regulatory Alerts2025-09-17
Regulations amending Finansinspektionen’s rules on electronic money institutions regarding DORA compliance
Finansinspektionen amended its regulations for institutions for electronic money and registered issuers to align with the EU Digital Operational Resilience Act (DORA). The changes require undertakings to detail their IT organization, confidentiality measures, and outsourcing strategies in their business plans to demonstrate DORA compliance. Additionally, the rules mandate specific reporting procedures for material events and security incidents while excluding certain outsourcing agreements from the chapter's scope.
Finansinspektionen’s Regulatory Code Publisher: Acting Chief Legal Counsel Sophie Degenne, Finansinspektionen, Sweden, www.fi.se ISSN 1102-7460 This translation is furnished solely for information purposes. Only the printed version of the regulation in Swedish applies for the application of the law. 1 Regulations amending Finansinspektionen’s regulations and general guidelines (FFFS 2011:49) regarding institutions for electronic money and registered issuers; decided on 18 December 2024. Finansinspektionen prescribes pursuant to section 6, points 2, 8, 9 and 11 of the Electronic Money Ordinance (2011:776) with regard to Finansinspektionen’s regulations and general guidelines (FFFS 2011:49) regarding institutions for electronic money and registered issuers in part that Chapter 10, section 4a shall be repealed, and in part that Chapter 1, section 3; Chapter 2, sections 15 and 21; and Chapter 8, section 1 shall have the following wording. Chapter 1 Section 3 Terms and expressions used in these regulations and general guidelines have the same meaning as those defined in Chapter 1, section 2 of the Electronic Money Act (2011:755). DORA Regulation refers in these regulations and general guidelines to Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011. Chapter 2 Section 15 An undertaking shall state in its business plan how it will organise its IT operations for the issuance of electronic money. In particular, the undertaking shall specify how it complies with the provisions set out in the DORA Regulation. The undertaking shall describe in part its systems' functions and areas of use on a general level and in part which confidentiality functions it uses in its operations related to the issuance of electronic money to prevent unauthorised persons from obtaining access to information about an individual's personal or financial circumstances. The undertaking shall also state if the firm shares its premises or technical equipment with other parties and how the firm, when applicable, intends to handle confidentiality issues within its operations related to the issuance of electronic money due to such an arrangement. FFFS 2024:25 Published on 27 December 2024
FFFS 2024:25 2 Section 21 An undertaking shall describe in its business plan the procedures it has for reporting events of material significance to Finansinspektionen pursuant to Chapter 10, sections 4 and 5, and the procedures it has to report payment-related operational incidents and security incidents pursuant to Article 19 of the DORA Regulation. Chapter 8 Section 1 This chapter contains provisions regarding how an institution for electronic money and a registered issuer shall act when entering into, handling and terminating outsourcing agreements that are of material significance to its operations related to the issuance of electronic money. This chapter does not apply to outsourcing agreements subject to Chapter V of the DORA Regulation.
These regulations shall enter into force on 17 January 2025. DANIEL BARR Agneta Blomquist