Banco de Portugal has opened for public consultation, until 26 August 2026, a draft Instruction aiming to repeal, in its entirety, Banco de Portugal Instruction No. 4/2021, concerning the duty and reporting requirements for the annual assessment of operational and security risks of payment services.

Banco de Portugal Instruction No. 4/2021 establishes the duty and reporting requirements for the annual assessment of operational and security risks of payment services provided under the Legal Framework for Payment Services and Electronic Money (“RJSPME”), which transposed Directive (EU) 2015/2366 (PSD2), and the Guidelines of the European Banking Authority on ICT and security risk management (EBA/GL/2019/04).

Following the entry into application of Regulation (EU) 2022/2554 (the DORA Regulation — Digital Operational Resilience Act), concerning digital operational resilience for the financial sector, a harmonised regulatory framework was introduced at European level, covering, among other matters, the management and reporting of risks associated with information and communication technologies (ICT). In particular, pursuant to Article 6(5) of the DORA Regulation, financial entities other than microenterprises are now required to review and document their ICT risk management framework at least once a year, as well as to submit a report on the review of that framework to their respective competent authorities.

In this context, keeping Instruction No. 4/2021 in force would result in a duplication of the reporting requirements to which payment service providers are subject.