title: European Economic Area — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/european-economic-area/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure 1 gap Confirmed confirmed 2026-06-20 Instant Payments Regulation staggered EEA-wide compliance: VoP applied to euro-area PSPs from 9 October 2025; first mandatory EBA reporting occurred 9 April 2026; non-euro-area EEA PSPs face a later 2027 compliance track for VoP (9 July 2027). Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open its jurisdiction pages on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/) Open gap — wpm-int-3 No operational resilience/DORA, scheme-rule, merchant-acquiring or correspondent-banking development was identified at the EEA bloc level this cycle._Merchant-acquiring ops, legal infrastructure, and commercial intelligence vectors were not actively searched this cycle within the search budget available._ Horizon · 2026-Q1 (± a quarter) DORA Level 2 measures finalisation and end-March 2026 Register of Information filings_Adopted, not yet in force · Tier 3 source_ Horizon · 2026-Q4 (± more than a year) EEA EFTA-pillar incorporation of DORA/MiCA enters into force_Adopted, not yet in force · Tier 1 source_ Horizon · 2027-07-09 (± a year) IPR Verification-of-Payee extended to non-euro-area EEA PSPs_Adopted, not yet in force · Tier 3 source_ Horizon · 2027-04-09 (± a quarter) Instant Payments Regulation EMI send/receive deadline_Adopted, not yet in force_ Standing sub-brief · as of 20 June 2026 248 words · last cycle 2026-10-06 #### Operational Resilience & Critical Infrastructure DORA is the harmonised EEA operational-resilience regime. It entered into force on 16 January 2023 and applied in full from 17 January 2025 with no transition period, harmonising ICT risk management, incident reporting, resilience testing and ICT third-party oversight across financial entities — including payment institutions, electronic money institutions and CASPs. The absence of any transition period is the defining feature: obligations were live in full from day one of application, applying equally to bank and non-bank entities. One scope detail remains unsettled — the count of financial-entity types is disputed across Tier-1 sources, with ESMA stating 21 and EIOPA and secondary sources stating 20. The application dates are Confirmed-grade; the entity-type count is recorded as a gap pending reconciliation. The oversight architecture for third parties is now the operational frontier. The ESAs with competent authorities oversee critical ICT third-party service providers. First Registers of Information were due 30 April 2025, with national regulators filing to the ESAs by end-March 2026, and non-compliance risks fines of up to 10% of annual turnover. Several Level 2 measures remain pending, which means the framework is still maturing even as enforcement intensifies through 2026. #### Outlook The trajectory is established rather than escalating: the regime is in full force, and the live questions are enforcement intensity and the finalisation of pending Level 2 measures. The end-March 2026 Register of Information filings to the ESAs are the next concrete milestone, with the disputed entity-type count flagged for reconciliation. Periodic update · new data 2026-10-06 #### Operational Resilience & Critical Infrastructure The Digital Operational Resilience Act has applied to payment institutions and electronic money institutions since 17 January 2025, and its scope is broader than full-authorisation status alone might suggest. Articles 2 and 64 of Regulation (EU) 2022/2554 bring payment institutions and electronic money institutions within DORA's scope regardless of whether they operate under full authorisation or under a national exemption, meaning exempted electronic money institutions are not outside the regime simply because they benefit from a lighter-touch licensing exemption elsewhere in the framework. For firms in scope, this requires maintaining a register of information on contractual arrangements with ICT third-party service providers, and ensuring that contracts supporting critical or important functions include the specific terms required under Article 30, covering matters such as service levels, data location, and exit arrangements. The operational-resilience significance of this requirement extends directly into the safeguarding and settlement infrastructure discussed elsewhere in this cycle's findings. Reconciliation platforms and similar outsourced ICT systems that support fund segregation and safeguarding processes fall within the category of critical or important outsourced functions where they underpin a payment institution's core payment or e-money services. This connects DORA's register-and-contract-terms requirement directly to the practical mechanics of safeguarding compliance: a firm relying on an outsourced reconciliation platform to demonstrate that customer funds remain properly segregated must also ensure that platform is captured in its DORA ICT third-party register and governed by Article 30-compliant contractual terms. A separate but related instant-payments-driven operational-resilience obligation runs on its own confirmed timetable. Regulation (EU) 2024/886, the Instant Payments Regulation, requires euro-area electronic money institutions to be able to send and receive instant euro credit transfers by 9 April 2027, with payee verification obligations in the euro area already in force from 9 October 2025. Unlike the still-pending PSD3/PSR file, this timetable is fixed under an already-adopted Regulation, making it one of the more operationally certain deadlines facing euro-area electronic money institutions over the next eighteen months, and one that itself depends on the same underlying payment-processing infrastructure that DORA's ICT third-party requirements are designed to make resilient. #### Outlook The DORA ICT third-party register and Article 30 contract-term requirements are already live obligations, not pending ones, and firms should treat reconciliation and safeguarding-support platforms as within scope of critical-function classification where they underpin core payment services. The Instant Payments Regulation's 9 April 2027 send-and-receive deadline for euro-area electronic money institutions, and the earlier 9 July 2027 send deadline for non-euro EMIs receiving from that date, represent fixed, already-binding dates against which operational readiness can be planned with more certainty than the still-unadopted PSD3/PSR text allows. **2 earlier distinct update(s)** Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure The Instant Payments Regulation (Reg (EU) 2024/886) continues its staggered EEA-wide compliance rollout, with the operational resilience implications differing materially between euro-area and non-euro-area PSPs. Verification-of-Payee, the mechanism requiring payer PSPs to check that the payee name matches the intended account before an instant payment is executed, applied to euro-area PSPs from 9 October 2025. The first mandatory EBA reporting deadline for PSPs under the IPR fell on 9 April 2026, requiring PSPs to report on payment activity dating back to 22 October 2022, a reporting scope that reaches well before the reporting deadline itself and requires firms to have retained and be able to reconstruct historical payment-activity data across that period. For non-euro-area EEA PSPs, the operational resilience timeline is materially longer: these PSPs are not required to provide the Verification-of-Payee service until 9 July 2027, nearly two years after the euro-area deadline. This creates a genuinely two-speed operational resilience landscape within the same regulatory instrument: euro-area payment infrastructure has already had to build and operate VoP checking and historical reporting capability, while non-euro-area EEA infrastructure has a materially longer runway to build the equivalent capability. The retrospective reporting scope reaching back to 22 October 2022 is a significant operational-resilience point in its own right: PSPs subject to the 9 April 2026 reporting deadline needed to have systems and data retention in place capable of reconstructing over three years of payment activity for the purposes of the first mandatory report, which is a materially more demanding operational requirement than a purely forward-looking reporting obligation would have been. #### Outlook The next marker for non-euro-area EEA PSPs is 9 July 2027, when Verification-of-Payee obligations extend to their operations. Firms operating across both euro-area and non-euro-area EEA jurisdictions should treat the intervening period as a window in which they operate two distinct instant-payments compliance postures within a single legal instrument, rather than assuming uniform EEA-wide application. Periodic update · new data 2026-09-14 #### Operational Resilience & Critical Infrastructure The Digital Operational Resilience Act was incorporated into the EEA Agreement by the EEA Joint Committee in February 2026, in the same written procedure that also incorporated the Markets in Crypto-Assets Regulation. This is confirmed with high confidence via primary EFTA Secretariat sourcing. Incorporation into the EEA Agreement, however, is a distinct legal step from entry into force at the national level within the EEAs EFTA pillar: the Regulation enters into force in Iceland, Liechtenstein and Norway only once each of those states has satisfied its own national constitutional requirements for incorporating EEA-relevant EU legislation. This two-step structure creates a temporal fragmentation risk between the EU-27 track, where DORA has already been in force and generating compliance obligations for financial entities and their critical ICT third-party providers, and the EFTA-pillar track, where the same obligations remain formally pending until constitutional clearance is complete in all three states. This is assessed as a probable, elevated-impact development: it does not change what DORA requires, but it does mean that the operational-resilience compliance clock is currently running at two different speeds within a single economic area, for firms that might reasonably assume EEA-wide simultaneity given the Agreements single-market character. For payment service providers with cross-border operations spanning both the EU-27 and the EFTA pillar, this asymmetry has practical significance for group-wide operational-resilience programme design: a firm cannot treat DORA compliance as uniformly binding across all EEA jurisdictions on the same timeline, and must track the constitutional-clearance status of Iceland, Liechtenstein and Norway individually rather than assuming simultaneous entry into force alongside the EU-27. The specific completion timeline for constitutional clearance in each of the three EFTA states was not established by this cycles research, and that absence of a firm date is recorded here as an open point rather than assumed to resolve by any particular quarter. #### Outlook The pace of constitutional clearance in Iceland, Liechtenstein and Norway is the key variable to track for operational-resilience compliance planning across the EFTA pillar. Firms with group entities in those three jurisdictions should expect continued asymmetry with EU-27 DORA obligations until each states clearance process concludes, and should not assume a single EEA-wide effective date for operational-resilience requirements in the interim. 1 further periodic run re-emitted the standing brief unchanged and is not shown. **Sources and findings (4)** 1. T1 ESMA (Tier-1) 2. T1 EIOPA (Tier-1) 3. T3 digital-operational-resilience-act.com (ESA framework summary) 4. T3 CybelAngel / DLA Piper