Decision on the Application of Guidelines on ICT and Security Risk Management

Official Gazette of the Republic of Slovenia, No. 39/25

ID: SKLE14045

SOP: 2025-01-1493

Adopted: 26 May 2025

Published: 29 May 2025

Effective from: 30 May 2025

Type of Act: Decision

Competent Authority: Bank of Slovenia

Adopting Body: Bank of Slovenia

Forms

The electronic edition of the Official Gazette is the official edition from 1 January 2006. Before this date, official editions were published in paper form.

Text

Pursuant to the third paragraph of Article 13 of the Banking Act (Official Gazette of the RS, No. 92/21 and 123/21 – ZBNIP, 2/25 – Constitutional Court Decision and 17/25, hereinafter: ZBan-3), the eleventh paragraph of Article 243 of the Act on Payment Services, Electronic Money Issuance Services and Payment Systems (Official Gazette of the RS, No. 7/18, 9/18 – correction, 102/20, 113/24 and 17/25 – ZPlaSSIED-2B, hereinafter: ZPlaSSIED) and the first paragraph of Article 31 of the Act on the Bank of Slovenia (Official Gazette of the RS, No. 72/06 – official consolidated text, 59/11 and 55/17), the Council of the Bank of Slovenia issues

D E C I S I O N

on the application of guidelines on ICT and security risk management

Article 1

(Purpose and scope of application of the guidelines)

(1) The European Banking Authority published on its website on 28 November 2019 the Guidelines on ICT and security risk management (hereinafter: ICT) (EBA/GL/2019/04; hereinafter: EBA/GL/2019/04 guidelines) on the application of which the Bank of Slovenia decided by the Decision on the Application of Guidelines on ICT and Security Risk Management (Official Gazette of the RS, No. 52/20).

(2) Pursuant to Article 16(1) of Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority) and amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L No. 331 of 15 December 2010, p. 12), last amended by Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the European Union Agency for Cybersecurity and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010 and (EU) No 1095/2010 (OJ L No. 2024/1620, of 19 June 2024) (hereinafter: Regulation (EU) 1093/2010), the European Banking Authority published on its website on 11 February 2025 the Guidelines on amending Guidelines EBA/2019/04 on ICT and security risk management (EBA/GL/2025/02; hereinafter: EBA/GL/2025/02 guidelines).

(3) The guidelines referred to in the second paragraph cover aspects of the management of relationships with payment users, supplementing risk management measures in accordance with the Digital Operational Resilience Act and related regulatory technical standards that payment service providers must adopt in accordance with Article 95(1) of Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010 and repealing Directive 2007/64/EC (OJ L No. 337 of 23 December 2015, pp. 35–127), last amended by Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024 amending Regulations (EU) No 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 regarding instant credit transfers in euros (OJ L No. 2024/886, of 19 March 2024); (hereinafter: Directive (EU) 2015/2366), in order to manage operational and security risks related to payment services provided. The guidelines set out requirements for establishing, implementing and monitoring security measures that payment service providers must adopt in accordance with Article 95(1) of Directive (EU) 2015/2366 to manage operational and security risks related to the payment services they provide.

(4) The guidelines are addressed to:

financial institutions as defined in Article 4(1) of Regulation (EU) 1093/2010, which are payment service providers as defined in point (a), point (b) and point (d) of Article 1(1) of Directive (EU) 2015/2366, including natural or legal persons entitled to an exemption in accordance with Article 32 or 33 of Directive (EU) 2015/2366, and legal persons exempted under Article 9 of Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L No. 267 of 10 October 2009, p. 7), last amended by Directive (EU) 2015/2366, and
competent authorities as defined in point (vii) of Article 4(2) of Regulation (EU) No 1093/2010.

Article 2

(Content of the decision and scope of application of the guidelines)

(1) By this decision, the Bank of Slovenia determines the application of the EBA/GL/2019/04 guidelines and the EBA/GL/2025/02 guidelines and all future amendments to the EBA/GL/2019/04 guidelines, unless the Bank of Slovenia decides otherwise for a specific amendment to the guidelines, for:

payment service providers as defined in points 1 to 6 of the first paragraph of Article 20 of the ZPlaSSIED, and
the Bank of Slovenia, when in accordance with the ZPlaSSIED, in its capacity as the competent authority, it exercises the powers and tasks of supervision over the payment service providers referred to in point 1 of this paragraph.

(2) Payment service providers referred to in point 1 of the first paragraph of this Article shall fully take into account the provisions of the guidelines in the part addressed to payment service providers.

(3) The Bank of Slovenia, when performing supervisory tasks and powers, shall fully take into account the provisions of the guidelines in the part relating to the performance of tasks and powers of the competent authority.

Article 3

(Revocation of the decision)

With the entry into force of this decision, the Decision on the Application of Guidelines on ICT and Security Risk Management (Official Gazette of the RS, No. 52/20) ceases to be in force.

Article 4

(Entry into force)

This decision shall enter into force the day following its publication in the Official Gazette of the Republic of Slovenia.

Ljubljana, 27 May 2025

Primož Dolenc

Deputy Chairman

of the Council of the Bank of Slovenia