title: Italy — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/italy/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure limited signal Confirmed confirmed 2026-07-04 Italy's operational-resilience regime for payment/e-money institutions is anchored in the Disposizioni di vigilanza per gli IP e IMEL, updated by Banca d'Italia's 3 February 2026 provvedimento to transpose DORA, its delegated acts, and the PSD2-amending Directive (EU) 2022/2556. Incident reporting to Banca d'Italia is mandatory for banks, IPs and IMELs, and the TIBER-IT framework (jointly adopted by Banca d'Italia, CONSOB and IVASS) supports voluntary advanced cyber-resilience testing. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/italy/) Standing sub-brief · as of 5 July 2026 113 words · last cycle 2026-10-11 #### Operational Resilience & Critical Infrastructure Banca d'Italia's 3 February 2026 update to its Disposizioni di vigilanza per gli IP e IMEL transposes DORA, its delegated acts, and Directive (EU) 2022/2556, and bans outsourcing of operational functions or critical components tied to payment services and e-money issuance. The critical-outsourcing ban forces payment and e-money institutions relying on group or third-party technology or banking-as-a-service providers to re-architect vendor arrangements ahead of DORA supervisory review. #### Outlook Expect Banca d'Italia's DORA supervisory review to test the practical boundaries of the critical-outsourcing ban over the coming cycles, particularly for institutions built on group-provided or white-label technology stacks that may now fall within the banned category of critical components. Periodic update · new data 2026-10-05 #### Operational Resilience & Critical Infrastructure Revolut disclosed a confirmed data breach around 12 September 2026 that exploited the European Investigation Order mechanism under the EU e-Evidence Regulation, a mechanism that became operative on 18 August 2026, via a spoofed institutional PEC mailbox. Funds and core systems were not affected; the breach was limited to customer personal data. Because Revolut serves Italian customers without being an Italian-chartered institution, the incident's resilience implications extended beyond the firm itself into a sector-wide Italian regulatory response. The Garante per la protezione dei dati personali opened an immediate review of Italian banks' access-security controls between 16 and 18 September 2026, writing directly to bank data protection officers to request checks for anomalous communications originating from the compromised PEC address used in the Revolut incident. This review represents a direct engagement with bank access-security controls prompted by a non-bank payment-service-provider incident, illustrating how an operational-resilience event at one type of payments entity can generate supervisory attention toward a different, interconnected part of the payments ecosystem. The review produced a further public update on 30 September 2026 and remained open as of that date, with no published outcome identified. Cross-border supervisory coordination followed directly from the incident: the Garante contacted Lithuania's data protection authority, which holds lead-supervisory-authority status for Revolut, to exchange information, and separately approached Italy's Ministry of Interior to establish whether other financial institutions in Italy had been targeted by the same spoofed-PEC technique. This coordination reach, spanning both a cross-border regulatory counterpart and a domestic security-focused ministry, indicates the review's scope extends beyond a single-institution incident response toward an assessment of whether the underlying technique poses a broader sector risk. #### Outlook The principal item to watch is the outcome of the Garante's bank-security review, not yet published as of this cycle. A finding that other Italian financial institutions were targeted using the same spoofed-PEC technique would extend the operational-resilience implications from a single-firm incident to a sector-wide access-security question, with potential bearing on resilience expectations for Italian banks and payment service providers more broadly. **Sources and findings (4)** 1. T3 [https://www.ipsoa.it/documents/quotidiano/2026/02/19/banca-italia-aggiornate-regole-ip-imel-luce-dora](https://www.ipsoa.it/documents/quotidiano/2026/02/19/banca-italia-aggiornate-regole-ip-imel-luce-dora) retrieved 2026-07-04 2. T1 [https://www.bancaditalia.it/focus/cybersicurezza/norme-cyber/index.html](https://www.bancaditalia.it/focus/cybersicurezza/norme-cyber/index.html) 3. T1 [https://www.bancaditalia.it/focus/cybersicurezza/norme-cyber/index.html](https://www.bancaditalia.it/focus/cybersicurezza/norme-cyber/index.html) 4. T1 [https://www.bancaditalia.it/compiti/sispaga-mercati/normativa-sorveglianza/index.html](https://www.bancaditalia.it/compiti/sispaga-mercati/normativa-sorveglianza/index.html) retrieved 2026-07-04