Portugal’s Insurance and Pension Funds Supervisory Authority (ASF) has published its 12th Regulatory Update, detailing digital operational resilience reporting duties under Regulatory Standard No. 6/2026-R, approved on Oct. 20, 2026. The standard amends existing supervisory reporting and insurance distribution rules to support supervision under the EU’s Digital Operational Resilience Act (DORA), replacing overlapping domestic requirements. It covers insurers and reinsurers headquartered in Portugal, Portuguese branches of insurers and reinsurers from third countries, and pension fund management companies. Portuguese insurance, reinsurance and ancillary insurance intermediaries are also covered if they employ at least 250 people or have both annual turnover exceeding EUR 50 million and an annual balance sheet total exceeding EUR 43 million.
Covered entities must submit a register of contractual arrangements for information and communication technology (ICT) services by Feb. 28 each year, reflecting their position on Dec. 31 of the previous year. ASF may grant exemptions or adjust reporting frequency or format on proportionality grounds. Firms must also notify planned ICT contracts supporting critical or important functions and instances when an existing function becomes critical or important. Major ICT incidents require an initial notification followed by intermediate and final reports under European requirements, while significant cyber threats may be reported voluntarily. Estimates of aggregate annual costs and losses from major ICT incidents, alongside reviews of ICT risk management frameworks, must be retained and supplied to ASF on request. Smaller pension fund management companies are subject to the review requirement for the simplified ICT risk management framework. Participation in, or withdrawal from, arrangements for sharing information about cyberattacks must also be notified. Credit institutions distributing insurance submit their ICT contract registers to the banking supervisor, with Banco de Portugal alone receiving their incident reports and voluntary cyber threat notifications.