Portugal: filing with the Banco de Portugal
unknown.
| Accepted formats | unknown No BdP instruction found. Lei 73/2025 empowers the authorities to define 'Os canais e processos operacionais concretos para fins da comunicação às autoridades competentes da informação referente ao registo de informações' (law-firm transcription). source medium confidence |
|---|---|
| Portal | login prerequisites Not confirmed for DORA. BPnet is BdP's general electronic reporting channel (Instrução 1/2007 restricts electronic submissions to Banking Supervision to BPnet; participation requires a 'Contrato de Participação no BPnet' under Instrução 21/2020), but no BdP document read ties the RoI to BPnet. source low confidence |
| 2026 cycle (reference date 31 Dec 2025) | Notes Banco de Portugal's DORA comunicado of 17 January 2025 (read in full 1 Nov 2026): entities must use the ITS 2024/2956 templates, and for the first cycle 'o Banco de Portugal realizará um pedido de informação para disponibilização do registo de informação às entidades supervisionadas até 28 de fevereiro de 2025'. The separate annual subcontracting register under Aviso n.º 8/2023 is kept despite the overlap. No 2026 public notice was found; BdP appears to collect by direct information request. reference date 2025-12-31 source high confidence |
| 2027 cycle (reference date 31 Dec 2026) | reference date 2026-12-31 esa transmission deadline 2027-03-31 source low confidence |
| Who files here | Credit institutions; Payment institutions; E-money institutions; Other entities under Banco de Portugal supervision (Lei 73/2025: 'Entidades sujeitas à sua supervisão') source medium confidence |
| Quirks | Lei n.º 73/2025 of 23 December 2025 implements DORA in Portugal, designates Banco de Portugal, ASF and CMVM as competent authorities for the entities each supervises, makes BdP the national focal point for major ICT incident notifications, and where an entity is supervised by more than one authority 'prevalece a autoridade prudencial para efeitos de reporte e acompanhamento'.; BdP comunicado: duties to 'manter, atualizar e disponibilizar às autoridades competentes um registo de informações' apply from 17 January 2025.; Transitional incident channel named in the same comunicado: major ICT incidents and voluntary cyber-threat notifications go to dora_report@bportugal.pt on the standard template until a regulatory instrument sets the definitive channel. The register itself is requested separately.; Scope stated by BdP for the banking sector: credit institutions, payment institutions, e-money institutions and account information service providers. |
| Notes | BdP comunicado read directly 1 Nov 2026 (previously only via snippets). Still no BdP page on submission mechanics: channel (BPnet is the general electronic channel), 2026/2027 dates and any naming rule are communicated to entities by information request, not published. |
The authority's own documents
- Comunicado do Banco de Portugal sobre o pacote legislativo relativo à resiliência operacional digital do setor financeiro (DORA) (HTTP 403 to automated fetch; seen via snippets) (2025-01)
- Lei n.º 73/2025, de 23 de dezembro (Diário da República) (2025-12-23)
- Abreu Advogados - Implementação do Regulamento DORA (Lei 73/2025 summary; secondary) (2025-12)
- Morais Leitão legal alert - Implementation of the DORA Regulation in Portugal (secondary) (2026-01-13)
- Instrução n.º 21/2020 (BPnet participation contract; general channel) (2020)
Compiled from the authority's published guidance on 31 October 2026, with a source and confidence per field. Low confidence means the authority has not published it in writing and the statement is an inference from standing rules or a third party. Check the authority's page before the window opens, and send corrections to hello@roifile.com.