meta_id 3340369

On July 1, 2026, Albania's Bank of Albania (Banka e Shqipërisë) adopted Decision No. 30 approving the "Regulation on Digital Operational Resilience," which establishes comprehensive requirements for financial institutions to manage information and communication technology (ICT) risks and ensure the security of networks and information systems supporting their operations. The regulation applies to banks, payment institutions, electronic money institutions, account information service providers, crypto-asset token issuers, and third-party ICT service providers operating in Albania. It establishes unified requirements for ICT risk management, including governance frameworks, incident reporting procedures, testing protocols, and third-party service provider oversight. Financial institutions must implement robust systems to identify, assess, and mitigate ICT risks proportionate to their size and complexity. The regulation requires institutions to maintain business continuity plans, conduct regular security testing including penetration testing, and establish incident response procedures. Institutions must report major ICT-related incidents to the Bank of Albania within specified timeframes: initial notification within four hours of classification, intermediate reports within 72 hours, and final reports within one month. The regulation also requires institutions to voluntarily notify the Bank of significant cyber threats and to implement policies governing contracts with third-party ICT service providers supporting critical functions. The regulation enters into force on January 1, 2028. Until Albania's accession to the European Union, certain provisions concerning critical third-party ICT service provider oversight and cross-border incident reporting will not apply. Financial institutions must begin implementing the regulation's requirements and report progress to the Bank of Albania quarterly beginning January 1, 2027. The regulation supersedes the previous guidance on major incident reporting issued February 7, 2024.