The broadening of scope is itself a supervisory signal distinct from the underlying risk trend: by widening the dashboard category beyond cyber-specific threats to the full ICT risk surface, the central bank is formally capturing operational dependencies, such as third-party and infrastructure outages, that previously may have sat outside the tracked perimeter or been reported under a narrower heading. This is a structural change in how the supervisor frames and monitors resilience, not merely a restatement of one quarter's incident experience.
Other Developments
No other module carried material, dated Slovenia-specific findings this cycle within the scope authorised for this brief.
Cross-Monitor Connections
The operational-resilience signal from Banka Slovenije's dashboard broadening sits within the wider EU resilience-regulation framework governing critical ICT infrastructure for financial entities, and the elevated-and-increasing assessment is consistent with a tightening supervisory posture on third-party dependency risk for banks and payment-system participants operating in Slovenia.
Outlook
With ICT risk assessed as elevated and increasing and the dashboard scope now capturing the full ICT risk surface rather than cyber incidents alone, continued monitoring of server, payment-system and third-party-provider disruption patterns in Slovenia's banking system is likely to remain a supervisory focus area in subsequent Financial Stability Reports from Banka Slovenije.
5 earlier updates not shown here.
Standing brief · as of 8 July 2026
Written before the update above. Where they differ, the update is the more recent position.
Lead Signal
Slovenia's national implementing regulation for the EU's Digital Operational Resilience Act (DORA) remains unresolved more than a year after it was submitted for government procedure on 4 April 2025, even though the underlying EU Regulation has applied directly to Slovenian payment institutions and other financial entities since 17 January 2025. The draft measure would distribute supervisory tasks among Banka Slovenije, the Securities Market Agency (ATVP) and the Insurance Supervision Agency, but whether it has since been adopted or published could not be independently verified this cycle. For payment institutions and e-money issuers operating under Banka Slovenije's authority, this leaves the precise national supervisory-task allocation for ICT-risk oversight, incident reporting and third-party-provider oversight unconfirmed, even as the underlying EU obligations already bind them directly. The gap does not suspend DORA's substantive requirements — which are directly applicable regardless of national implementing-act status — but it does leave open questions about which domestic authority handles which oversight function day to day.
Other Developments
Slovenia's bank-payment-service-provider market continues to consolidate around two groups. Following OTP Bank's 2019 acquisition of SKB and its 2021 acquisition and merger of Nova KBM with Abanka — completed under the OTP banka d.d. name in 2024 — NLB and OTP each now hold roughly 30% of the domestic banking market, together controlling more than half of a banking sector whose 14 licensed institutions held approximately EUR 54.2 billion in total assets at end-2024. NLB Group, an ECB-designated Significant Institution since late 2014, reported 2025 profit after tax of EUR 503.1 million, underscoring its scale relative to the broader market. This concentration sits alongside Banka Slovenije's continuing conduct-side oversight of the non-bank population: providers relying on the ZPlaSSIED limited-network or very-limited-range-of-goods exclusions whose 12-month transaction value exceeds EUR 1,000,000 must notify the central bank and submit annual audit opinions, an active supervisory posture on a population that otherwise sits outside full licensing.
On digital money, Slovenia's Markets in Crypto-Assets (MiCA) implementing act (Official Gazette No. 95/2024) confirms Banka Slovenije and ATVP as the competent domestic MiCA authorities, with e-money-token issuers required to hold EMI or bank authorisation and to notify Banka Slovenije at least 40 working days before offering e-money tokens. A more uncertain data point concerns the legacy virtual-currency/VASP transitional regime: a single-source claim indicates Slovenia's national transition window closed 1 July 2025, ahead of the EU-wide 18-month default that would otherwise run to 1 July 2026 — but the precise national mechanics behind an apparently shortened window were not independently confirmed by a primary source this cycle. If accurate, unauthorised legacy providers face MiCA enforcement exposure of up to EUR 5,000,000 or 5% of annual turnover for serious breaches, rising to EUR 15,000,000 or 15% of turnover for market-abuse breaches, on top of Banka Slovenije's already-active administrative-penalties register, which recorded 97 hits at time of collection.
Consumer-protection pressure is building from a different direction. Online and authorised-push-payment scam losses reached nearly EUR 28 million in Slovenia in 2025 through mid-October across roughly 2,000 cases, nearly matching all of 2024, with cumulative losses since 2020 exceeding EUR 130 million and about three-quarters borne by individuals; the Bank Association of Slovenia has convened a conference urging systemic countermeasures. No dedicated statutory APP-fraud reimbursement scheme currently exists to offset this trend. Slovenia's Consumer Protection Act (CPA-1), in force since 26 January 2023 and implementing three EU consumer directives, remains the operative baseline, with fines up to 5% of annual turnover for widespread infringements.
On product and commercial activity, Aircash, a Croatian-licensed e-money institution operating on an EEA-passported basis, has expanded its cash-digitisation wallet and Mastercard prepaid card product into Slovenia, including a Petrol Slovenija partnership and cash deposit/withdrawal points at over 600 locations. DDD Invoices, a Slovenia-based e-invoicing compliance infrastructure provider, closed a EUR 1.31 million seed round in May 2026 backed by Fil Rouge Capital, 500 Global and angel investors. In banking-adjacent consolidation, NLB Lease&Go and Summit Leasing Slovenia completed their merger in early July 2025, folding into NLB Group's leasing footprint; deal value was not publicly disclosed. Infrastructure-wise, TARGET2-Slovenia and SEPA (SCT/SCT Inst) remain the core settlement corridors, with Bankart's Card Settlement system — governed by EU interchange caps of 0.2% for debit and 0.3% for credit transactions — and the domestic Flik mobile P2P scheme rounding out the domestic payments-rail picture.
Cross-Monitor Connections
Two threads in this cycle warrant flagging to the Financial Intelligence Monitor. Slovenia's most recent MONEYVAL follow-up evaluation (2023) rated the country Compliant on 11 and Largely Compliant on 28 of the FATF's 40 Recommendations, but Highly Effective on none and Substantially Effective on only one of the eleven Immediate Outcomes; money-laundering investigations are rising but remain below what predicate-crime volume would suggest, and Slovenia remains in enhanced follow-up. That effectiveness gap, combined with new MiCA-linked turnover-based enforcement exposure for crypto-asset service providers and e-money-token issuers under the ZPPDFT-2 anti-money-laundering framework, points toward a bank-versus-non-bank supervisory-intensity question that sits at the boundary of WPM's payments-market-access lens and FIM's illicit-finance mandate. WPM does not analyse illicit-finance use of payment instruments directly; that deeper analysis is routed to FIM.
Outlook
Two forward markers matter for the next cycle. First, confirmation of Slovenia's DORA national implementing regulation — whether it has been adopted, published, and how supervisory tasks are actually split among Banka Slovenije, ATVP and the Insurance Supervision Agency — should resolve the current ambiguity. Second, the EU-wide MiCA transitional-period default expires 1 July 2026 for member states that retained the full 18-month window; if Slovenia's own window did indeed close a year earlier as reported, that divergence will already have been tested by then, and a primary-source confirmation of the national mechanics would settle the point. Continuing APP-fraud loss growth, absent a dedicated reimbursement scheme, is likely to keep consumer-protection pressure on Banka Slovenije and the banking sector into the next review period.