Regulatory Alerts2026-07-03
Added
Regulation on the notification of major operational or security incidents to the Central Bank of Kosovo
Payment service providers must classify operational or security incidents as major if they meet specific impact thresholds, such as affecting more than 10% of regular transactions with a duration over one hour, impacting over 5,000 users, or causing service downtime exceeding two hours. Providers are required to submit an initial report to the Central Bank of Kosovo within four hours of classification, an intermediate report within three working days if operations are not restored, and a final report within 20 working days after business returns to normal. The regulation mandates the use of a standardized template for all reports and requires continuous assessment of incidents to identify any status changes from major to non-major or vice versa.