title: Slovenia Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/slovenia/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # Slovenia SI schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 64 sourced findings · 126 sources in the cumulative register 14 Modules baseline.modules[] 64 Findings modules[].findings[] 50 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) ** Law made at European Economic Area level** that applies in Slovenia is covered once, on the [European Economic Area](https://payments.gi/jurisdictions/european-economic-area/) page. This page covers Slovenia’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief ###### Latest update · 19 October 2026 #### Lead Signal Banka Slovenije has broadened the scope of its risk-and-resilience dashboard's ICT-risk category, moving from a cyber-only lens to a category covering all information and communication technology risk, effective from the third quarter of 2026. The change was disclosed in the central bank's October 2026 Financial Stability Report and accompanies a substantive assessment: ICT risk in the Slovenian banking system is now described as elevated and increasing. The report attributes the H1 2026 driver of that trajectory mainly to server and payment-system outages and to disruptions originating with third-party service providers, rather than to malicious cyber incidents narrowly defined. Banka Slovenije notes that the financial damage associated with these H1 2026 incidents was limited, which tempers the severity read even as the direction of travel is clearly upward. The broadening of scope is itself a supervisory signal distinct from the underlying risk trend: by widening the dashboard category beyond cyber-specific threats to the full ICT risk surface, the central bank is formally capturing operational dependencies, such as third-party and infrastructure outages, that previously may have sat outside the tracked perimeter or been reported under a narrower heading. This is a structural change in how the supervisor frames and monitors resilience, not merely a restatement of one quarter's incident experience. #### Other Developments No other module carried material, dated Slovenia-specific findings this cycle within the scope authorised for this brief. #### Cross-Monitor Connections The operational-resilience signal from Banka Slovenije's dashboard broadening sits within the wider EU resilience-regulation framework governing critical ICT infrastructure for financial entities, and the elevated-and-increasing assessment is consistent with a tightening supervisory posture on third-party dependency risk for banks and payment-system participants operating in Slovenia. #### Outlook With ICT risk assessed as elevated and increasing and the dashboard scope now capturing the full ICT risk surface rather than cyber incidents alone, continued monitoring of server, payment-system and third-party-provider disruption patterns in Slovenia's banking system is likely to remain a supervisory focus area in subsequent Financial Stability Reports from Banka Slovenije. _5 earlier updates not shown here._ ###### Standing brief · as of 8 July 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal Slovenia's national implementing regulation for the EU's Digital Operational Resilience Act (DORA) remains unresolved more than a year after it was submitted for government procedure on 4 April 2025, even though the underlying EU Regulation has applied directly to Slovenian payment institutions and other financial entities since 17 January 2025. The draft measure would distribute supervisory tasks among Banka Slovenije, the Securities Market Agency (ATVP) and the Insurance Supervision Agency, but whether it has since been adopted or published could not be independently verified this cycle. For payment institutions and e-money issuers operating under Banka Slovenije's authority, this leaves the precise national supervisory-task allocation for ICT-risk oversight, incident reporting and third-party-provider oversight unconfirmed, even as the underlying EU obligations already bind them directly. The gap does not suspend DORA's substantive requirements — which are directly applicable regardless of national implementing-act status — but it does leave open questions about which domestic authority handles which oversight function day to day. #### Other Developments Slovenia's bank-payment-service-provider market continues to consolidate around two groups. Following OTP Bank's 2019 acquisition of SKB and its 2021 acquisition and merger of Nova KBM with Abanka — completed under the OTP banka d.d. name in 2024 — NLB and OTP each now hold roughly 30% of the domestic banking market, together controlling more than half of a banking sector whose 14 licensed institutions held approximately EUR 54.2 billion in total assets at end-2024. NLB Group, an ECB-designated Significant Institution since late 2014, reported 2025 profit after tax of EUR 503.1 million, underscoring its scale relative to the broader market. This concentration sits alongside Banka Slovenije's continuing conduct-side oversight of the non-bank population: providers relying on the ZPlaSSIED limited-network or very-limited-range-of-goods exclusions whose 12-month transaction value exceeds EUR 1,000,000 must notify the central bank and submit annual audit opinions, an active supervisory posture on a population that otherwise sits outside full licensing. On digital money, Slovenia's Markets in Crypto-Assets (MiCA) implementing act (Official Gazette No. 95/2024) confirms Banka Slovenije and ATVP as the competent domestic MiCA authorities, with e-money-token issuers required to hold EMI or bank authorisation and to notify Banka Slovenije at least 40 working days before offering e-money tokens. A more uncertain data point concerns the legacy virtual-currency/VASP transitional regime: a single-source claim indicates Slovenia's national transition window closed 1 July 2025, ahead of the EU-wide 18-month default that would otherwise run to 1 July 2026 — but the precise national mechanics behind an apparently shortened window were not independently confirmed by a primary source this cycle. If accurate, unauthorised legacy providers face MiCA enforcement exposure of up to EUR 5,000,000 or 5% of annual turnover for serious breaches, rising to EUR 15,000,000 or 15% of turnover for market-abuse breaches, on top of Banka Slovenije's already-active administrative-penalties register, which recorded 97 hits at time of collection. Consumer-protection pressure is building from a different direction. Online and authorised-push-payment scam losses reached nearly EUR 28 million in Slovenia in 2025 through mid-October across roughly 2,000 cases, nearly matching all of 2024, with cumulative losses since 2020 exceeding EUR 130 million and about three-quarters borne by individuals; the Bank Association of Slovenia has convened a conference urging systemic countermeasures. No dedicated statutory APP-fraud reimbursement scheme currently exists to offset this trend. Slovenia's Consumer Protection Act (CPA-1), in force since 26 January 2023 and implementing three EU consumer directives, remains the operative baseline, with fines up to 5% of annual turnover for widespread infringements. On product and commercial activity, Aircash, a Croatian-licensed e-money institution operating on an EEA-passported basis, has expanded its cash-digitisation wallet and Mastercard prepaid card product into Slovenia, including a Petrol Slovenija partnership and cash deposit/withdrawal points at over 600 locations. DDD Invoices, a Slovenia-based e-invoicing compliance infrastructure provider, closed a EUR 1.31 million seed round in May 2026 backed by Fil Rouge Capital, 500 Global and angel investors. In banking-adjacent consolidation, NLB Lease&Go and Summit Leasing Slovenia completed their merger in early July 2025, folding into NLB Group's leasing footprint; deal value was not publicly disclosed. Infrastructure-wise, TARGET2-Slovenia and SEPA (SCT/SCT Inst) remain the core settlement corridors, with Bankart's Card Settlement system — governed by EU interchange caps of 0.2% for debit and 0.3% for credit transactions — and the domestic Flik mobile P2P scheme rounding out the domestic payments-rail picture. #### Cross-Monitor Connections Two threads in this cycle warrant flagging to the Financial Intelligence Monitor. Slovenia's most recent MONEYVAL follow-up evaluation (2023) rated the country Compliant on 11 and Largely Compliant on 28 of the FATF's 40 Recommendations, but Highly Effective on none and Substantially Effective on only one of the eleven Immediate Outcomes; money-laundering investigations are rising but remain below what predicate-crime volume would suggest, and Slovenia remains in enhanced follow-up. That effectiveness gap, combined with new MiCA-linked turnover-based enforcement exposure for crypto-asset service providers and e-money-token issuers under the ZPPDFT-2 anti-money-laundering framework, points toward a bank-versus-non-bank supervisory-intensity question that sits at the boundary of WPM's payments-market-access lens and FIM's illicit-finance mandate. WPM does not analyse illicit-finance use of payment instruments directly; that deeper analysis is routed to FIM. #### Outlook Two forward markers matter for the next cycle. First, confirmation of Slovenia's DORA national implementing regulation — whether it has been adopted, published, and how supervisory tasks are actually split among Banka Slovenije, ATVP and the Insurance Supervision Agency — should resolve the current ambiguity. Second, the EU-wide MiCA transitional-period default expires 1 July 2026 for member states that retained the full 18-month window; if Slovenia's own window did indeed close a year earlier as reported, that divergence will already have been tested by then, and a primary-source confirmation of the national mechanics would settle the point. Continuing APP-fraud loss growth, absent a dedicated reimbursement scheme, is likely to keep consumer-protection pressure on Banka Slovenije and the banking sector into the next review period. trust tier: ai_unverified _Standing brief, as of 8 July 2026._ #### Regulatory Status Slovenia's payments-regulatory posture is that of a fully MiCA- and DORA-exposed eurozone member state built on a PSD2/EMD2 baseline (ZPlaSSIED, in force since 22 February 2018) administered by a single authority, Banka Slovenije, for payment institutions, e-money institutions and account-information service providers. The domestic bank-PSP market is highly concentrated, with NLB and OTP together holding roughly 60% of a EUR 54.2 billion-asset banking sector following the completed 2019-2024 OTP/Nova KBM-SKB integration. MiCA is fully in force via a 2024 implementing act, with Banka Slovenije and ATVP as competent authorities; a single-source, unverified claim holds that Slovenia's legacy-VASP transitional window closed a year ahead of the EU-wide 1 July 2026 default, creating potential enforcement exposure of up to EUR 5,000,000 or 5% of turnover under MiCA. DORA has applied directly to Slovenian financial entities since 17 January 2025, but the national implementing regulation distributing supervisory tasks among Banka Slovenije, ATVP and the Insurance Supervision Agency has an unverified adoption status since its 4 April 2025 government-procedure submission. Conduct-side, Banka Slovenije actively monitors limited-network/telecom-exclusion providers above a EUR 1,000,000 12-month threshold, and standard PSD2/EMD2 safeguarding rules apply to PI/EMI customer funds. Consumer-protection pressure is rising: online/APP scam losses reached nearly EUR 28 million through mid-October 2025, against no dedicated statutory reimbursement scheme, prompting a Bank Association of Slovenia conference call for systemic countermeasures. Banka Slovenije's published administrative-penalties register recorded 97 hits at time of collection. Slovenia's AML/CFT framework (ZPPDFT-2, OMLP-enforced) rates strongly on technical FATF compliance per MONEYVAL's 2023 follow-up but weakly on effectiveness (0 of 11 Immediate Outcomes rated Highly Effective), a gap flagged for Financial Intelligence Monitor follow-up. Payment infrastructure runs through TARGET2-Slovenia and SEPA (SCT/SCT Inst), supplemented by Bankart's Card Settlement system, SIMP-PS/SEPA EKP rails and the domestic Flik P2P scheme, with EU interchange caps (0.2%/0.3%) governing card-scheme economics. Commercial activity this cycle was modest: Aircash's EEA-passported wallet expansion, DDD Invoices' EUR 1.31 million seed round, and the completed NLB Lease&Go/Summit Leasing merger. #### Outlook Slovenia's regulatory trajectory is tightening: MiCA and DORA build-out continues alongside rising APP-fraud losses and an unresolved DORA national-implementation status. The two clearest verification priorities for next cycle are confirming the adoption/publication status of Slovenia's DORA implementing regulation and obtaining primary-source confirmation of the precise length and legal basis of Slovenia's national MiCA transitional window for legacy virtual-currency providers. Continued growth in online/APP scam losses, absent a statutory reimbursement scheme, is likely to keep consumer-protection pressure elevated into the next review period. trust tier: ai_unverified ###### Latest update · 19 October 2026 #### Regulatory Status Banka Slovenije's October 2026 Financial Stability Report broadened the scope of its risk-and-resilience dashboard's ICT-risk category from cyber-only to all information and communication technology risk, effective the third quarter of 2026, and assessed ICT risk in the Slovenian banking system, across both segments, as elevated and increasing. The report attributes the H1 2026 elevation primarily to server and payment-system outages and to third-party service-provider disruptions. This is a supervisory dashboard and assessment development; no new Slovenia-specific legal instrument was identified alongside it this cycle. #### Outlook Whether this elevated-and-increasing trajectory persists, and whether the broadened ICT-risk category is followed by a more formal resilience instrument for Slovenian banks and payment service providers, are the open questions to track in Banka Slovenije's subsequent financial stability reporting. _3 earlier updates not shown here._ ###### Standing brief · as of 11 August 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status Slovenia's payments-regulatory picture this cycle is defined by the full entry into force of the EU Instant Payments Regulation's mandatory-offer obligation, binding on every eurozone payment service provider offering standard SEPA Credit Transfer since 9 October 2025. Slovenia enters this obligation from a position of structural readiness: the domestic Flik rail, operated by Bankart, already carried the large majority of the country's SEPA payment volume before the mandate took effect, and reported scale figures of more than 800,000 users and approximately two million monthly transactions are directionally consistent with that pre-existing dominance, though those specific figures rest on a secondary industry source rather than a Bank of Slovenia primary disclosure. The mandate itself also brings two anti-fraud obligations into force for Slovenian providers, bank and non-bank alike: payee-name-to-IBAN verification and user-customisable per-transaction and per-day payment limits. #### Outlook The operationally significant question for Slovenia going forward is how consistently payee-name-to-IBAN verification and the accompanying payment-limit controls are implemented across bank and non-bank providers, since the underlying account-holder name data quality is not uniform across all participating institutions by default. No further Slovenia-specific instant-payments milestone is evidenced in the current regulatory horizon. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access Confirmed confirmed 2026-07-05 Payment services authorised/supervised under ZPlaSSIED (transposing PSD2) by Banka Slovenije. MiCAR EMT issuers require prior authorisation as an EMI or bank; must notify Banka Slovenije >=40 working days before public offer and >=20 working days before white-paper publication. Standing sub-brief · as of 8 July 2026 318 words · last cycle 2026-07-08 #### Licensing, Authorisation & Market Access Slovenia's payment-services and e-money regime rests on the Payment Services, Services for Issuing Electronic Money and Payment Systems Act (ZPlaSSIED), in force since 22 February 2018 and transposing PSD2 and EMD2. Banka Slovenije is the sole authorising and supervisory authority for payment institutions, e-money institutions (including waiver variants) and account-information service providers; there is no dedicated digital-bank licensing track distinct from the standard credit-institution regime. This positions Banka Slovenije as the single point of contact for both bank and non-bank market entrants, a structural feature that shapes how quickly new payment-service models can reach the Slovenian market relative to jurisdictions that split authorisation across multiple bodies. Market access sits against a heavily consolidated bank-PSP landscape. Following OTP Bank's 2019 acquisition of SKB and its 2021 acquisition and merger of Nova KBM with Abanka — the combined entity renamed OTP banka d.d. in 2024 — NLB and OTP each now hold roughly 30% of Slovenia's domestic banking market. That concentration means non-bank entrants relying on EU passporting or Banka Slovenije authorisation are competing for distribution and partnership access against two dominant incumbents controlling roughly 60% of sector assets between them, rather than a fragmented field of smaller banks. For payment institutions and EMIs seeking correspondent or safeguarding-account relationships with Slovenian credit institutions, this concentration is a structural fact of the market rather than a regulatory constraint, but it bears directly on negotiating leverage and account-access terms for smaller non-bank entrants. #### Outlook Absent a change to ZPlaSSIED's statutory architecture, Banka Slovenije's single-authority model is likely to remain the standing baseline for market access. The more relevant forward question is competitive: with NLB and OTP together holding roughly 60% of banking-sector assets, non-bank payment institutions and EMIs entering Slovenia will continue to depend on securing workable safeguarding and settlement-account relationships with a concentrated bank-PSP tier, a dynamic worth monitoring alongside any further OTP Group regional consolidation. no periodic updates on record for this sub-brief ** Sources and findings (5)** 1. T1 [https://www.bsi.si/en/payment-systems/payment-services-and-electronic-money-issuance-services](https://www.bsi.si/en/payment-systems/payment-services-and-electronic-money-issuance-services) retrieved 2026-07-05 2. T1 [https://www.bsi.si/en/payment-systems/supervision-of-non-bank-payment-service-providers-and-financial-market-infrastructures](https://www.bsi.si/en/payment-systems/supervision-of-non-bank-payment-service-providers-and-financial-market-infrastructures) retrieved 2026-07-05 3. T1 [https://www.bsi.si/en/payment-systems/supervision-of-non-bank-payment-service-providers-and-financial-market-infrastructures](https://www.bsi.si/en/payment-systems/supervision-of-non-bank-payment-service-providers-and-financial-market-infrastructures) retrieved 2026-07-05 4. T3 [https://thebanks.eu/articles/banks-in-Slovenia](https://thebanks.eu/articles/banks-in-Slovenia) retrieved 2026-07-05 5. T1 [https://www.bsi.si/storage/uploads/71fa8fcd-6b27-43fd-bacb-fb43728a80b2/20251231-LIST-OF-NOTIFICATIONS-OF-PAYMENT-INSTITUTIONS.pdf](https://www.bsi.si/storage/uploads/71fa8fcd-6b27-43fd-bacb-fb43728a80b2/20251231-LIST-OF-NOTIFICATIONS-OF-PAYMENT-INSTITUTIONS.pdf) retrieved 2026-07-05 ### W1b Conduct, Safeguarding & Promotions Confirmed confirmed 2026-07-05 Safeguarding follows the standard PSD2/EMD2 segregation model (client funds held in a separate account with an authorised credit institution or invested in liquid assets), supervised by Banka Slovenije; limited-network and telecom exclusions from ZPlaSSIED are actively monitored via a dedicated register and annual auditor attestations, with EBA Guidelines on the limited-network exclusion applied directly. Standing sub-brief · as of 8 July 2026 276 words · last cycle 2026-07-08 #### Conduct, Safeguarding & Financial Promotions Conduct-side supervision in Slovenia centres on two mechanisms. First, Banka Slovenije maintains an active register of providers relying on ZPlaSSIED's limited-network or very-limited-range-of-goods exclusions; where a provider's trailing 12-month transaction value exceeds EUR 1,000,000, it must notify Banka Slovenije and submit annual audit opinions, an obligation applied per EBA/GL/2022/02 as transposed via Official Gazette 79-1798/2022. This is a meaningful conduct-monitoring lever over a population that otherwise sits outside full payment-institution licensing, and it distinguishes Slovenia's approach from jurisdictions where limited-network exclusions receive lighter ongoing scrutiny. Second, payment institutions and e-money institutions operating in Slovenia must safeguard customer funds through segregation from own funds — either via a separate safeguarding account with an authorised credit institution or through investment in liquid assets — with the segregation required by close of business the day following receipt of funds. Firms offering only payment-initiation or account-information services are exempt from this safeguarding obligation, consistent with their non-custodial function. This is the standard PSD2/EMD2 safeguarding baseline as applied nationally; no bespoke Slovenian variant beyond the EU framework was identified this cycle. The bank-versus-non-bank distinction is explicit here: safeguarding accounts must sit with an authorised credit institution, meaning non-bank PI/EMI safeguarding compliance depends on maintaining a workable banking relationship in a market where two banking groups hold roughly 60% of sector assets. #### Outlook The EUR 1,000,000 notification-and-audit threshold for limited-network exclusions is likely to remain the key conduct-monitoring lever on the non-bank population absent a legislative change. Continued growth in Slovenia's online/APP scam losses (see W10) may increase pressure on Banka Slovenije to tighten safeguarding or conduct oversight further, though no such proposal was identified this cycle. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.bsi.si/en/financial-stability/institutions-under-supervision/service-providers-excluded-from-the-provisions-of-zplassied](https://www.bsi.si/en/financial-stability/institutions-under-supervision/service-providers-excluded-from-the-provisions-of-zplassied) retrieved 2026-07-05 2. T3 [https://www.innreg.com/blog/payment-and-electronic-money-pi-licenses-emi-licenses-europe-the-definitive-guide](https://www.innreg.com/blog/payment-and-electronic-money-pi-licenses-emi-licenses-europe-the-definitive-guide) retrieved 2026-07-05 3. T3 [https://www.rppp.si/wp-content/uploads/2019/07/20190711_ZPlaSSIED-and-PSD2-provisions-on-SCA.pdf](https://www.rppp.si/wp-content/uploads/2019/07/20190711_ZPlaSSIED-and-PSD2-provisions-on-SCA.pdf) retrieved 2026-07-05 4. T1 [https://www.bsi.si/en/financial-stability/institutions-under-supervision/service-providers-excluded-from-the-provisions-of-zplassied](https://www.bsi.si/en/financial-stability/institutions-under-supervision/service-providers-excluded-from-the-provisions-of-zplassied) retrieved 2026-07-05 ### W2 Stablecoins & Digital Money Confirmed confirmed 2026-07-05 MiCA is fully in force in Slovenia via the Act Implementing the Regulation on Markets in Crypto-Assets (Official Gazette No. 95/2024). Competence is split: Banka Slovenije authorises and supervises e-money-token (EMT) issuers (as EMI or bank), while ATVP (Securities Market Agency) is the CASP/ART authority. Slovenia's national transitional regime for legacy virtual-currency/VASP providers expired 1 July 2025 without a simplified conversion path. Horizon · 2026-07-01 (±quarter) EU-wide MiCA transitional-period default deadline (comparator context for Slovenia's earlier close)_in_force_pending · TT3_ Horizon · 2026-07-01 (±quarter) EU-wide MiCA transitional-period default expiry (member states retaining the full window)_in_force_pending · TT3_ Horizon · 2026-07-01 (±quarter) EU-wide MiCA transitional-period default expiry (member states retaining the full window)_in_force_pending · T_ Horizon · 2026-07-01 (±quarter) EU-wide MiCA transitional-period default deadline (comparator context for Slovenia's earlier close)_in_force_pending · TT3_ Standing sub-brief · as of 8 July 2026 307 words · last cycle 2026-07-08 #### Stablecoins & Digital Money Slovenia's crypto-asset regime is now fully anchored in MiCA. The Act Implementing the Regulation on Markets in Crypto-Assets (Official Gazette No. 95/2024) designates Banka Slovenije and the Securities Market Agency (ATVP) as competent MiCA authorities. E-money-token issuers must hold authorisation as either an e-money institution or a bank, and must notify Banka Slovenije at least 40 working days before offering e-money tokens to the public and at least 20 working days before publishing a white paper — a sequencing requirement that gives the central bank meaningful pre-launch visibility over stablecoin-type products entering the Slovenian market. A more contested data point concerns the transition away from Slovenia's pre-MiCA virtual-currency/VASP regime. A single third-tier source indicates the national transitional window for legacy providers expired 1 July 2025 without a simplified authorisation-conversion procedure, which — if accurate — would represent a shortened national window relative to the EU-wide 18-month default that runs to 1 July 2026 in member states that did not shorten it. This claim was flagged during baseline research as conflating a possible national policy choice with the EU-wide default, and a primary Banka Slovenije or Official Gazette citation confirming the precise national mechanics was not located this cycle. The distinction matters commercially: if the window has indeed already closed, legacy virtual-currency providers still operating in Slovenia without MiCA authorisation are already outside the transitional safe harbour and exposed to enforcement action (see W7), a full year before peers in jurisdictions retaining the full EU default would face the same exposure. #### Outlook Two things should resolve this ambiguity next cycle: a primary-source confirmation of Slovenia's actual national transitional-window length and legal basis, and observation of whether the EU-wide 1 July 2026 default expiry triggers any additional Slovenian enforcement activity distinguishable from action already taken against providers whose (shorter) national window lapsed a year earlier. no periodic updates on record for this sub-brief ** Sources and findings (5)** 1. T1 [https://www.bsi.si/en/banka-slovenije-fintech-innovation-contact-point](https://www.bsi.si/en/banka-slovenije-fintech-innovation-contact-point) retrieved 2026-07-05 2. T3 [https://www.scorechain.com/resources/crypto-glossary/mica-slovenia-2025](https://www.scorechain.com/resources/crypto-glossary/mica-slovenia-2025) retrieved 2026-07-05 3. T1 [https://www.bsi.si/en/banka-slovenije-fintech-innovation-contact-point](https://www.bsi.si/en/banka-slovenije-fintech-innovation-contact-point) retrieved 2026-07-05 4. T3 [https://www.licentium.io/hub/slovenia](https://www.licentium.io/hub/slovenia) retrieved 2026-07-05 5. T1 [https://www.bsi.si/en/banking-supervision/aml-cft](https://www.bsi.si/en/banking-supervision/aml-cft) retrieved 2026-07-05 ### W3 Operational Resilience & Critical Infrastructure moved Probable confirmed 2026-07-05 Banka Slovenije's October 2026 Financial Stability Report broadens its risk-dashboard treatment of ICT risk from cyber-only to all ICT risk from Q3 2026; H1 2026 incidents were mainly server/payment-system outages and third-party service-provider disruptions with limited financial damage, but both cyber and broader ICT risk segments are assessed as elevated and increasing. Movement — CHANGED Banka Slovenije broadened ICT-risk dashboard scope to all ICT risk from Q3 2026 and assesses ICT risk as elevated and increasing._October 2026 Financial Stability Report reflects a scope change and a risk-level assessment not previously on record._ Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/slovenia/) Standing sub-brief · as of 8 July 2026 229 words · last cycle 2026-10-18 #### Operational Resilience & Critical Infrastructure The EU's Digital Operational Resilience Act (Regulation (EU) 2023/2554) has applied directly to Slovenian financial entities, including payment institutions, since 17 January 2025. DORA establishes a harmonised digital operational resilience framework covering ICT risk management, harmonised incident-reporting deadlines, and EU-level oversight by the European Supervisory Authorities of critical ICT third-party providers — obligations that bind Slovenian PSPs regardless of the status of any national implementing legislation. That national implementing picture, however, remains unresolved. A proposed Regulation on the implementation of the EU regulation on digital operational resilience — which would distribute supervisory tasks among Banka Slovenije, ATVP and the Insurance Supervision Agency — was submitted for government procedure on 4 April 2025. Whether it has since been adopted or published was not independently verified this cycle, a gap flagged during baseline research as warranting confidence downgrade pending confirmation. In practical terms, Slovenian PSPs are already subject to DORA's substantive obligations but face uncertainty over exactly which domestic authority handles which supervisory function — incident-reporting receipt, third-party-provider oversight coordination, and enforcement — until the national implementing act's status is confirmed. #### Outlook Resolving the adoption/publication status of Slovenia's DORA implementing regulation is the single most concrete verification task carried into the next cycle for this module. Until then, Slovenian PSPs should be treated as operating under confirmed EU-level DORA obligations but an unconfirmed national supervisory-task allocation. Periodic update · new data 2026-10-19 #### Operational Resilience & Critical Infrastructure Banka Slovenije's October 2026 Financial Stability Report records a formal broadening of the scope of its risk-and-resilience dashboard's ICT-risk category. Previously confined to cyber risk specifically, the category now encompasses all information and communication technology risk, a change the report dates to the third quarter of 2026. This is a supervisory-instrument change rather than solely a commentary on incident experience: Banka Slovenije has widened the aperture through which it formally tracks operational risk for the institutions it supervises, bringing infrastructure, system-availability and third-party-dependency risk explicitly inside the same monitoring frame previously reserved for cyber-specific threats. Alongside the scope change, the central bank assesses ICT risk in the Slovenian banking system as elevated and increasing. The report identifies the principal drivers of that trajectory through the first half of 2026 as server and payment-system outages together with disruptions originating from third-party service providers, rather than malicious cyber incidents narrowly defined. This distinction matters for how the finding should be read: the escalation is substantially an operational-continuity and vendor-dependency story rather than a story about adversarial cyber activity. For payment-system participants specifically, outages affecting payment infrastructure sit directly within the operational-resilience perimeter this module tracks, and third-party service-provider disruption is a recurring theme in resilience regimes generally, given the degree to which banks and payment institutions rely on outsourced infrastructure, cloud services and vendor-operated payment rails. Notably, Banka Slovenije qualifies the escalation by noting that the financial damage associated with the H1 2026 incidents driving this trend was limited. This is a meaningful qualifier: the elevated-and-increasing assessment describes a trend in risk exposure and incident frequency or pattern, not a report of material financial loss to date. Reading the two findings together, the picture is one of a growing operational-risk surface, now formally captured under a broadened supervisory metric, where the realised financial consequences so far have been contained even as the underlying exposure trend moves in the wrong direction. The broadening of the dashboard category itself is the more structurally significant of the two developments for institutions operating in Slovenia's payment and banking sector. A scope change of this kind typically signals that the supervisor intends to track, and likely report on, a wider set of operational dependencies going forward than it previously disclosed under a narrower cyber-only heading. For banks and payment-system participants, this suggests that outage patterns, infrastructure resilience, and third-party/vendor dependency arrangements are now explicitly within the supervisory lens Banka Slovenije uses to assess system-wide resilience, rather than being addressed only incidentally through cyber-specific reporting channels. #### Outlook Given the stated elevated-and-increasing trajectory and the newly broadened ICT-risk dashboard scope, continued attention to server and payment-system outage patterns, and to third-party service-provider dependency risk specifically, is likely to remain a feature of Banka Slovenije's financial-stability reporting in subsequent periods. Whether the contained financial-damage profile observed in H1 2026 persists as the broader ICT risk category accumulates further incident data under the new scope is not yet established from the material reviewed this cycle. **4 earlier distinct update(s)** Periodic update · new data 2026-10-19 #### Operational Resilience & Critical Infrastructure Banka Slovenije's October 2026 Financial Stability Report records a scope change to its internal risk-and-resilience dashboard: the ICT-risk category, previously limited to cyber risk, was broadened in the third quarter of 2026 to capture all information and communication technology risk. This is a supervisory-tool change rather than a new rule for firms, but it is material because it changes what the central bank is formally watching and, by extension, what kind of event is likely to surface in future reporting on the Slovenian banking and payment system. The substantive assessment attached to that broadened category is that ICT risk, across both the original cyber segment and the newly added wider ICT segment, is elevated and increasing. Banka Slovenije attributes this during the first half of 2026 primarily to two drivers: server and payment-system outages, and disruptions originating with third-party service providers. The naming of third-party service providers as a distinct driver is significant for how operational-resilience exposure in Slovenia should be read. It signals that a meaningful share of the risk sits not in banks' and payment service providers' own infrastructure but in the vendors and outsourced service arrangements they depend on, a dependency that is often harder for a single institution to control directly and that a dashboard broadened to all ICT risk is now positioned to capture more fully than a cyber-only lens would have done. No new Slovenia-specific statute, regulation, or supervisory instrument accompanies this dashboard and assessment change this cycle. The development sits at the level of supervisory monitoring and public reporting rather than binding rule-making, and should be read accordingly: it documents how Banka Slovenije currently characterises and tracks ICT exposure in the sector, not a new compliance obligation imposed on banks or payment service providers operating in Slovenia. Taken together, the scope broadening and the elevated-and-increasing assessment point toward a tightening supervisory posture on operational resilience in Slovenia, consistent with the general direction of travel under EU-level operational-resilience expectations for the financial sector, even though no Slovenia-specific legal instrument has been identified this cycle to formalise that posture. The practical significance for institutions operating in the Slovenian market is that outage and third-party-disruption events that might previously have been captured only under a cyber-incident lens are now within the scope of a dashboard explicitly covering all ICT risk, which plausibly changes what gets flagged, counted, and reported on going forward. #### Outlook The near-term question is whether the elevated-and-increasing trajectory recorded for Q3 2026 persists, worsens, or stabilises in Banka Slovenije's subsequent financial stability reporting, and whether the broadened ICT-risk category is accompanied in a future cycle by a more formal resilience instrument rather than remaining a dashboard-level supervisory tool. The explicit naming of third-party service-provider disruption as a driver also makes third-party and outsourcing risk management a plausible area for closer supervisory attention in Slovenia going forward, though no specific instrument addressing that point was identified this cycle. Periodic update · new data 2026-10-18 #### Operational Resilience & Critical Infrastructure Banka Slovenije has broadened the ICT-risk category in its risk-and-resilience dashboard, effective from the third quarter of 2026. The category previously covered cyber risk only; it now encompasses all information and communication technology risk, including technical failures, data loss, and business interruption arising from hardware or software errors at banks or at their service providers. The change is set out in the central banks October 2026 Financial Stability Report, which states that the scope of cyber risks was broadened to encompass all ICT risks. Alongside the scope broadening, Banka Slovenije assesses ICT risk in the Slovenian banking system as elevated and increasing. The central bank attributes this trajectory mainly to two drivers observed in the first half of 2026: server and payment-system outages, and disruptions originating at third-party service providers. The central bank notes that the financial damage arising from these H1 2026 incidents was limited, a qualification that tempers the severity of the elevated assessment without altering its direction. The decision to fold third-party service-provider disruption and infrastructure outages into the same dashboard category previously reserved for cyber risk is itself a structurally significant supervisory judgment. It indicates that Banka Slovenije now treats deliberate cyber-attack and mundane infrastructure or vendor failure as sitting on the same risk continuum for monitoring purposes, rather than as separate categories warranting separate dashboards. For payment-system participants and banks operating in Slovenia, this suggests that resilience expectations from the supervisor are likely to extend to vendor and infrastructure dependency management with the same weight previously reserved for cyber-defence posture. No further detail on the specific incidents underlying the H1 2026 outage and disruption pattern, nor on any supervisory response beyond the dashboard reclassification itself, has been identified in the material reviewed this cycle. #### Outlook The elevated and increasing characterisation of ICT risk suggests continued central-bank attention to server, payment-system, and third-party-service resilience is likely through subsequent reporting periods, though no specific forward commitment or scheduled review date beyond the current October 2026 Financial Stability Report has been confirmed in the material reviewed this cycle. Periodic update · new data 2026-10-04 #### Operational Resilience & Critical Infrastructure Slovenia's payments infrastructure has fully absorbed the EU Instant Payments Regulation. SEPA Instant Credit Transfers (SCT Inst) became mandatory for Slovenian banks to receive starting 9 January 2025, mandatory to send by October 2025, and the full euro-area roll-out of instant payments took effect on 9 October 2025. This regulatory timeline is subject to a EUR 50,000 per-transaction ceiling. This finding carries Confirmed confidence, sourced directly from Banka Slovenije as the primary regulator, and is corroborated by two independent secondary sources describing the same mandatory-adoption timeline for Slovenian payment service providers. Slovenia's operational-resilience posture for instant payments is distinguished by the coexistence of two parallel rails. Ahead of the EU-wide SCT Inst mandate, all Slovenian payment service providers had already agreed to establish FLIK, a domestic instant-payments scheme. The continued operation of FLIK alongside the now-mandatory SCT Inst infrastructure indicates that Slovenian banks and non-bank payment service providers built out instant-payments capability domestically before the EU-wide regulatory deadline reached full effect, which likely eased the operational burden of achieving SCT Inst compliance by 9 October 2025 compared with a market building instant-payments capability from a standing start. Carrying the bank-PSP versus non-bank payment-institution/e-money-institution distinction into this picture: the underlying claim identifies the relevant entity as Banka Slovenije acting in a bank/PSP-oriented regulatory capacity, with the SCT Inst mandate applying across the banking and savings-bank sector as the primary rail participants; the material available this cycle does not specify whether non-bank payment institutions or e-money institutions operating in Slovenia face an equivalent or a differentiated compliance timeline under the same regulation. No operational friction, outage, or resilience incident tied to either rail was identified in the material available this cycle; the finding here is one of successful, on-schedule regulatory absorption rather than of any disruption event. #### Outlook The item to watch is whether transaction volumes migrating onto the now-mandatory SCT Inst rail, running alongside the pre-existing domestic FLIK scheme, generate any operational-resilience pressure as adoption scales following the 9 October 2025 full-roll-out date. No further regulatory milestones or gaps specific to Slovenia's operational-resilience posture were identified in the material available this cycle. Periodic update · new data 2026-09-11 #### Operational Resilience & Critical Infrastructure Slovenia has completed the full compliance timeline under the EU Instant Payments Regulation (2024/886). Mandatory instant-payment receipt capability became effective for Slovenian banks on 9 January 2025, with mandatory sending capability following on 9 October 2025. This two-stage timeline, receipt before sending, reflects the regulation's phased approach and is now fully behind Slovenian banks as of this reporting cycle, meaning the compliance question for Slovenia has shifted from readiness to steady-state operation. The underlying settlement infrastructure is built on the Eurosystem's TIPS (TARGET Instant Payment Settlement) platform combined with the SEPA Instant Credit Transfer (SCT Inst) scheme, under which instant payments between commercial banks and savings banks in the euro area are executed in seconds. This is confirmed by Banka Slovenije as the national licensing and prudential authority, and independently corroborated by third-party payments-infrastructure commentary describing SCT Inst as mandatory for all Slovenian banks as of the January 2025 receipt deadline, with sending following in October 2025. What is distinctive about Slovenia's position within this euro-area-wide rollout is the maturity of pre-existing domestic instant-payment behaviour. Independent evidence on Flik, a domestic instant-payment application, indicates over 80 per cent of SEPA transactions in Slovenia were already being processed instantly ahead of the regulatory mandate reaching full effect. This suggests the operational and resilience demands the Instant Payments Regulation imposes, near-continuous availability, fraud-screening at instant-settlement speed, and irrevocability of completed transfers, have already been substantially load-tested by pre-existing domestic volume rather than being wholly new operational burdens introduced by the regulation itself. The bank-versus-non-bank distinction is material here: the Instant Payments Regulation's compliance obligations documented this cycle attach specifically to banks (payment service providers offering standard credit transfers), while the domestic Flik infrastructure operates via Bankart, a non-bank payment-services intermediary layered on top of the regulated bank rails. No SI-specific finding this cycle addresses resilience-testing outcomes, incident reporting, or DORA-specific critical-infrastructure designations for the underlying settlement rails; the finding this cycle is limited to confirmation that the compliance timeline itself is now complete and operative. #### Outlook The operational question for Slovenia going forward is less about compliance completion and more about sustained performance: whether the TIPS/SCT Inst infrastructure maintains availability and fraud-control standards at the transaction volumes implied by Flik's domestic adoption figures, particularly at peak load as instant payments shift from an early-adopter feature to the default euro-area experience. Watch for any Banka Slovenije disclosure on operational-resilience testing or incident history tied to the now-fully-operative instant-payments infrastructure in Slovenia. **Sources and findings (4)** 1. T3 [https://www.dlapiper.com/en/insights/publications/2025/02/application-of-the-digital-operational-resilience-act---dora](https://www.dlapiper.com/en/insights/publications/2025/02/application-of-the-digital-operational-resilience-act---dora) retrieved 2026-07-05 2. T1 [https://www.eba.europa.eu/activities/direct-supervision-and-oversight/digital-operational-resilience-act](https://www.eba.europa.eu/activities/direct-supervision-and-oversight/digital-operational-resilience-act) retrieved 2026-07-05 3. T1 [https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/operational-resilience/joint-technical-standards-major-incident-reporting](https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/operational-resilience/joint-technical-standards-major-incident-reporting) retrieved 2026-07-05 4. T4 [https://copla.com/blog/compliance-regulations/dora-regulations-in-slovenia-and-impact-for-all-industries/](https://copla.com/blog/compliance-regulations/dora-regulations-in-slovenia-and-impact-for-all-industries/) retrieved 2026-07-05 ### W4 Scheme & Network Compliance Probable confirmed 2026-07-05 Card-scheme and interchange rules in Slovenia follow the pan-EU baseline directly: the Interchange Fee Regulation (EU) 2015/751 caps consumer debit/credit interchange at 0.2%/0.3% for domestic and cross-border transactions, and Slovenia sits within Mastercard's and Visa's standard EEA intra-region interchange schedules. Domestic card clearing/settlement runs through Bankart's Card Settlement payment system under a Banka Slovenije-supervised legal framework. Standing sub-brief · as of 8 July 2026 196 words · last cycle 2026-07-08 #### Scheme & Network Compliance Card-scheme compliance in Slovenia operates within the EU's Interchange Fee Regulation (EU) 2015/751, which caps interchange at 0.2% for debit and 0.3% for credit card transactions, directly applicable in Slovenia since 8 June 2015 for both domestic and cross-border transactions. Slovenia sits within Mastercard's and Visa's standard EEA intra-region interchange schedules, meaning no bespoke national interchange variance was identified this cycle; the European Commission's implementation-review report separately flags Slovenia-specific data gaps on merchant service charges, an under-indexed area for independent scheme-level corroboration. Domestically, Bankart operates Slovenia's Card Settlement payment system, with Banka Slovenije acting as settlement agent on a daily net-settlement basis. The system incorporates a twice-yearly loss-sharing scheme among direct participants and charges a EUR 1,678.93 per-month, per-card-product participant clearing fee. This scheme rulebook dates to an October 2020 vintage, so the fee figures in particular should be treated as indicative pending reconfirmation of current currency. #### Outlook With EU-wide interchange caps stable and no scheme-rule change identified this cycle, the near-term monitoring priority for this module is reconfirming Bankart's current fee schedule, given the underlying rulebook's 2020 vintage, and watching for any Commission follow-up on the flagged Slovenia-specific merchant-service-charge data gap. no periodic updates on record for this sub-brief ** Sources and findings (5)** 1. T2 [https://www.mastercard.com/europe/en/business/support/merchant-interchange-rates.html](https://www.mastercard.com/europe/en/business/support/merchant-interchange-rates.html) retrieved 2026-07-05 2. T3 [https://en.wikipedia.org/wiki/Interchange_fee](https://en.wikipedia.org/wiki/Interchange_fee) retrieved 2026-07-05 3. T2 [https://www.bankart.si/wp-content/uploads/2020/10/Card-Settlement-payment-system_v3.0._october-2020.pdf](https://www.bankart.si/wp-content/uploads/2020/10/Card-Settlement-payment-system_v3.0._october-2020.pdf) retrieved 2026-07-05 4. T3 [https://www.bankart.si/en/payment-systems-and-services/](https://www.bankart.si/en/payment-systems-and-services/) retrieved 2026-07-05 5. T1 [https://competition-policy.ec.europa.eu/system/files/2021-10/IFR_report_card_payment.pdf](https://competition-policy.ec.europa.eu/system/files/2021-10/IFR_report_card_payment.pdf) retrieved 2026-07-05 ### W5 Payment Corridor Dynamics Probable confirmed 2026-07-05 As a eurozone member since 2007, Slovenia's core payment corridors run through TARGET2-Slovenia for high-value settlement and SEPA (SCT/SCT Inst) for retail credit transfers, with Bankart operating the domestic SIMP-PS clearing system for internal credit transfers and direct debits. A domestic instant P2P scheme, Flik, supplements SEPA Instant adoption for mobile-based transfers. Standing sub-brief · as of 8 July 2026 175 words · last cycle 2026-07-08 #### Payment Corridor Dynamics Slovenia's core payment corridor runs through TARGET2-Slovenia, Banka Slovenije's own component within the pan-European TARGET2 platform, giving Slovenian banks, savings banks and the Central Securities Clearing Corporation real-time gross settlement of high-value euro payments in central-bank money. As a standing eurozone-membership infrastructure fact, this corridor is unlikely to change materially absent a Eurosystem-wide platform migration. Domestically, Flik — a mobile-based peer-to-peer instant-transfer solution enabling transfers via mobile number or email across participating Slovenian bank apps — supplements growing SEPA Instant Credit Transfer adoption, alongside Bankart's SIMP-PS and SEPA EKP retail clearing rails. The Flik claim rests on a single vendor-blog source; a primary Banka Slovenije or Bankart citation for Flik-specific adoption figures was not located this cycle, so usage-volume claims about the scheme should be treated as directional rather than confirmed. #### Outlook TARGET2-Slovenia and SEPA (SCT/SCT Inst) should remain the stable core corridor baseline. The more useful next-cycle task is sourcing a primary Banka Slovenije or Bankart citation for Flik's actual adoption figures, to move that claim from vendor-sourced to independently confirmed. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.bsi.si/en/media/posts/launch-of-the-target2-payment-system](https://www.bsi.si/en/media/posts/launch-of-the-target2-payment-system) retrieved 2026-07-05 2. T1 [https://www.bsi.si/en/payment-systems/supervision-of-non-bank-payment-service-providers-and-financial-market-infrastructures](https://www.bsi.si/en/payment-systems/supervision-of-non-bank-payment-service-providers-and-financial-market-infrastructures) retrieved 2026-07-05 3. T3 [https://www.nlbgroup.com/int-en/about-nlb-group/nlb-group-markets/bankart](https://www.nlbgroup.com/int-en/about-nlb-group/nlb-group-markets/bankart) retrieved 2026-07-05 4. T4 [https://www.transfi.com/blog/slovenias-payment-rails-how-they-work---sepa-instant-payments-mobile-banking](https://www.transfi.com/blog/slovenias-payment-rails-how-they-work---sepa-instant-payments-mobile-banking) retrieved 2026-07-05 ### W6 Industry Structure & Commercial Probable confirmed 2026-07-05 The Slovenian banking/PSP market is concentrated and consolidating: 14 licensed banking institutions with total assets of roughly EUR 54.2 billion at end-2024, dominated by NLB and OTP banka (each around 30% share) following OTP's acquisitions of SKB (2019) and Nova KBM/Abanka (2021, renamed OTP banka in 2024), with foreign ownership (Italian, Hungarian, Austrian groups) accounting for over 60% of the sector. Standing sub-brief · as of 8 July 2026 237 words · last cycle 2026-07-08 #### Industry Structure & Commercial Dynamics Slovenia's banking sector comprises 14 licensed institutions supervised by Banka Slovenije, holding total assets of approximately EUR 54.2 billion at end-2024, up 2.2% year-on-year, with sector capitalisation at 19.7%. The top three banks control over 50% of sector assets, reflecting a sustained consolidation trend. NLB and OTP each hold roughly 30% of the domestic banking market following the completed integration of OTP Bank's 2019 acquisition of SKB and its 2021 acquisition and merger of Nova KBM with Abanka, renamed OTP banka d.d. in 2024 — meaning the two groups together control roughly 60% of sector assets, a level of concentration that shapes competitive dynamics for both bank and non-bank entrants relying on EU passporting or Banka Slovenije authorisation. NLB Group, Slovenia's largest banking and financial group, has been an ECB-designated Significant Institution since late 2014, placing it under direct ECB supervision rather than solely Banka Slovenije oversight. NLB reported 2025 profit after tax of EUR 503.1 million, a scale marker consistent with its position as the largest Slovenian bank by assets. #### Outlook With the OTP/Nova KBM-SKB integration now fully bedded in and NLB continuing to post strong profitability, further consolidation pressure is more likely to come from below — smaller banks or non-bank entrants seeking scale or partnership — than from another top-tier merger. Any further OTP Group regional consolidation activity is worth monitoring for spillover effects on the Slovenian market structure. no periodic updates on record for this sub-brief ** Sources and findings (5)** 1. T4 [https://grokipedia.com/page/List_of_banks_in_Slovenia](https://grokipedia.com/page/List_of_banks_in_Slovenia) retrieved 2026-07-05 2. T3 [https://practiceguides.chambers.com/practice-guides/acquisition-finance-2025/slovenia](https://practiceguides.chambers.com/practice-guides/acquisition-finance-2025/slovenia) retrieved 2026-07-05 3. T3 [https://en.wikipedia.org/wiki/NLB_Group](https://en.wikipedia.org/wiki/NLB_Group) retrieved 2026-07-05 4. T3 [https://en.wikipedia.org/wiki/List_of_banks_in_Slovenia](https://en.wikipedia.org/wiki/List_of_banks_in_Slovenia) retrieved 2026-07-05 5. T4 [https://tracxn.com/d/explore/fintech-startups-in-slovenia/75cf4fbjdePCeE5STj0a6vi335xFNITZ3IJRt_XBpKM/companies](https://tracxn.com/d/explore/fintech-startups-in-slovenia/75cf4fbjdePCeE5STj0a6vi335xFNITZ3IJRt_XBpKM/companies) retrieved 2026-07-05 ### W7 Legal & Litigation Probable confirmed 2026-07-05 Banka Slovenije maintains a formal, published register of administrative penalties/measures imposed on supervised entities (97 recorded hits at time of collection), operating under its general enforcement powers over PIs, EMIs and banks; MiCA introduces new turnover-based enforcement exposure for CASPs and EMT issuers, and Slovenia applied no simplified transition for legacy virtual-currency providers, itself an enforcement-relevant policy choice. Standing sub-brief · as of 8 July 2026 237 words · last cycle 2026-07-08 #### Legal & Litigation Banka Slovenije maintains a published 'Information on Banka Slovenije Measures Imposed' register recording administrative penalties against supervised entities; the searchable database held 97 hits at time of collection. As a point-in-time snapshot, this figure will move cycle-to-cycle and should not be read as a static baseline, but its existence and public accessibility mark Slovenia's enforcement posture as reasonably transparent relative to jurisdictions without an equivalent public register. A newer enforcement dimension arises from MiCA. Slovenian crypto-asset service providers and e-money-token issuers face legal-person fines of up to EUR 5,000,000 or 5% of annual turnover for serious breaches, with natural-person fines up to EUR 700,000, rising to EUR 15,000,000 or 15% of turnover for market-abuse breaches. The principal risk vectors flagged are unauthorised operation and reliance on the reportedly expired national transitional window for legacy virtual-currency providers (see W2) — though, as with that transition claim, the specific fine ceilings rest on a single third-tier source and should be treated as indicative pending a primary ATVP or Banka Slovenije enforcement-framework citation. No named individual court rulings or landmark payments litigation specific to Slovenian PSPs were identified this cycle beyond the aggregate penalties-register count. #### Outlook The next verification priority for this module is confirming the MiCA fine ceilings against a primary ATVP or Banka Slovenije source, and watching the Banka Slovenije penalties register for any enforcement action specifically tied to the reportedly expired legacy-VASP transitional window. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://bsi.si/en/financial-stability/banking-system-supervision/supervisory-disclosure/publication-of-administrative-penalties](https://bsi.si/en/financial-stability/banking-system-supervision/supervisory-disclosure/publication-of-administrative-penalties) retrieved 2026-07-05 2. T3 [https://www.licentium.io/hub/slovenia](https://www.licentium.io/hub/slovenia) retrieved 2026-07-05 3. T3 [https://ezine.eversheds-sutherland.com/global-aml-guide/slovenia](https://ezine.eversheds-sutherland.com/global-aml-guide/slovenia) retrieved 2026-07-05 4. T3 [https://www.rppp.si/wp-content/uploads/2019/07/20190711_ZPlaSSIED-and-PSD2-provisions-on-SCA.pdf](https://www.rppp.si/wp-content/uploads/2019/07/20190711_ZPlaSSIED-and-PSD2-provisions-on-SCA.pdf) retrieved 2026-07-05 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-07-05 Merchant card acquiring in Slovenia is processed principally through Bankart's Card Settlement payment system on behalf of participating banks, with dispute/chargeback and refund mechanics governed by the EEA-wide SEPA direct-debit refund rules and PSD2 SCA requirements; the acquiring risk layer benefits from centralised POS/ATM servicing under Bankart's mature processing capabilities. Standing sub-brief · as of 8 July 2026 155 words · last cycle 2026-07-08 #### Merchant Acquiring & Risk Bankart's Card Settlement payment system underpins Slovenian merchant card-acquiring infrastructure. Its loss-sharing scheme, calculated twice yearly, allocates loss shares among direct participants (issuers) based on settled transaction volumes, with provision for an extraordinary calculation if defined risk criteria are met — a structural risk-mutualisation mechanism sitting alongside the same rulebook's clearing-fee and settlement-agent arrangements described under W4. For card-not-present dispute and chargeback mechanics specifically, Slovenia does not appear to operate a bespoke national acquiring-dispute regime; instead, SEPA direct-debit refund rules (an eight-week customer refund-request right) and PSD2 Strong Customer Authentication requirements shape how disputes are resolved. This is a generic EU-wide mechanic rather than Slovenia-specific primary sourcing, and should be read accordingly. #### Outlook Absent a Slovenia-specific acquiring-dispute framework, EU-wide SCA and SEPA refund mechanics will continue to govern chargeback and dispute resolution for card-not-present acquiring. The Bankart loss-sharing scheme's twice-yearly cadence is the more distinctly national risk-management feature worth continued tracking. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T2 [https://www.bankart.si/wp-content/uploads/2020/10/Card-Settlement-payment-system_v3.0._october-2020.pdf](https://www.bankart.si/wp-content/uploads/2020/10/Card-Settlement-payment-system_v3.0._october-2020.pdf) retrieved 2026-07-05 2. T3 [https://www.bankart.si/en/payment-systems-and-services/](https://www.bankart.si/en/payment-systems-and-services/) retrieved 2026-07-05 3. T4 [https://stripe.com/resources/more/payments-in-slovenia](https://stripe.com/resources/more/payments-in-slovenia) retrieved 2026-07-05 4. T2 [https://www.bankart.si/wp-content/uploads/2020/10/Card-Settlement-payment-system_v3.0._october-2020.pdf](https://www.bankart.si/wp-content/uploads/2020/10/Card-Settlement-payment-system_v3.0._october-2020.pdf) retrieved 2026-07-05 ### W9 Product Innovation & Market Development Probable confirmed 2026-07-05 Product innovation in Slovenia is EU-directive-led rather than domestically distinctive: the Flik mobile P2P instant-payment scheme, growing mobile/digital banking adoption, a Banka Slovenije fintech innovation contact point for regulatory clarification, and cross-border e-money wallet expansion (e.g., Aircash) into the Slovenian market represent the principal innovation vectors, alongside nascent MiCA-regulated crypto-asset services. Standing sub-brief · as of 8 July 2026 188 words · last cycle 2026-09-05 #### Product Innovation & Market Development Aircash, a Croatian-licensed e-money institution operating on an EEA-passported basis, has expanded its cash-digitisation e-money wallet and Mastercard prepaid card product into Slovenia, including a partnership with Petrol Slovenija and cash deposit/withdrawal points at over 600 Slovenian locations. This is a non-bank product-access expansion built entirely on EU passporting rather than a fresh Slovenian authorisation, illustrating how the bank-concentrated domestic market (see W6) coexists with cross-border non-bank product entry. The claim rests on the company's own website; a primary Banka Slovenije EEA-passporting-register cross-check confirming Aircash's Slovenian notification status was not completed this cycle. Separately, DDD Invoices, a Slovenia-based API-driven e-invoicing compliance infrastructure provider, closed a EUR 1.31 million seed funding round — backed by Fil Rouge Capital, 500 Global and angel investors — reported May 2026. This adjacent payments-compliance infrastructure investment is noted here as a dated product-development marker; see W13 for its treatment as a discrete commercial event. #### Outlook Confirming Aircash's EEA-passporting notification status with Banka Slovenije directly would upgrade that claim from company-sourced to independently verified. Beyond that, product-innovation activity in Slovenia this cycle remains modest relative to larger EU markets. Periodic update · new data 2026-08-11 #### Product Innovation & Market Development The EU Instant Payments Regulation's mandatory-offer obligation is now fully binding: every eurozone payment service provider offering standard SEPA Credit Transfer must also offer SEPA Instant Credit Transfer, and must do so at no extra cost, a requirement that took effect on 9 October 2025 and applies to bank and non-bank providers alike. Slovenia's position within this EU-wide shift is distinctive. The domestic instant-payment rail, Flik, operated by Bankart, already carried the large majority of the country's SEPA transaction volume before the mandate came into force, meaning the regulation formalised an existing domestic market practice into a binding pan-European obligation rather than compelling new infrastructure build-out in this jurisdiction. Scale figures reported for Flik, more than 800,000 users and approximately two million monthly transactions, corroborate that pre-mandate dominance, though these figures are drawn from a secondary industry source rather than a Bank of Slovenia primary disclosure and are accordingly treated as a dashboard-level data point rather than a standing-brief finding in their own right; the regulatory-mandate finding itself, by contrast, rests on the EU-wide legal instrument and is treated as standing-brief material. The regulation pairs the universal-offer requirement with two mandatory anti-fraud features applicable across the SEPA area, Slovenia included: payee-name-to-IBAN verification, which checks that the name entered by a payer matches the name registered against the destination account before an instant transfer completes, and user-customisable payment limits set per transaction and per day. Both obligations apply uniformly to bank and non-bank payment service providers offering instant credit transfer, meaning the operational and technical burden of implementing payee verification and limit-setting functionality falls across the full range of account-servicing institutions active in the Slovenian market, not solely on incumbent banks. #### Outlook With the mandatory-offer deadline now in force and Slovenia's domestic rail already operating at the scale the mandate anticipates, the more consequential question going forward is how the mandatory anti-fraud features bed in operationally across bank and non-bank providers. Payee-name-to-IBAN verification depends on accurate, up-to-date account-holder name data held by every participating provider, and any divergence in how that verification and the accompanying payment-limit controls are implemented across the market would be the next material development to watch in this domain. No further Slovenia-specific instant-payments milestone is evidenced in the current regulatory horizon. **Sources and findings (5)** 1. T1 [https://www.bsi.si/en/banka-slovenije-fintech-innovation-contact-point](https://www.bsi.si/en/banka-slovenije-fintech-innovation-contact-point) retrieved 2026-07-05 2. T4 [https://www.transfi.com/blog/slovenias-payment-rails-how-they-work---sepa-instant-payments-mobile-banking](https://www.transfi.com/blog/slovenias-payment-rails-how-they-work---sepa-instant-payments-mobile-banking) retrieved 2026-07-05 3. T4 [https://aircash.eu/about-us/](https://aircash.eu/about-us/) retrieved 2026-07-05 4. T4 [https://grokipedia.com/page/List_of_banks_in_Slovenia](https://grokipedia.com/page/List_of_banks_in_Slovenia) retrieved 2026-07-05 5. T3 [https://fintech.global/2026/05/15/modest-week-in-fintech-with-677m-raised-in-14-deals/](https://fintech.global/2026/05/15/modest-week-in-fintech-with-677m-raised-in-14-deals/) retrieved 2026-07-05 ### W10 Consumer Protection & APP Fraud Probable confirmed 2026-07-05 Consumer protection runs on the harmonised EU Consumer Protection Act (CPA-1, effective 26 January 2023, implementing the Sale of Goods, Digital Content and Omnibus Directives), enforced with turnover-based fines for widespread infringements. There is no dedicated Slovenian APP-fraud reimbursement scheme comparable to the UK's PSR regime; online/payment scam losses are rising sharply, with police and the Bank Association flagging systemic concern in 2025. Standing sub-brief · as of 8 July 2026 238 words · last cycle 2026-07-08 #### Consumer Protection & APP Fraud Slovenia's Consumer Protection Act (CPA-1 / ZVPot-1) became applicable 26 January 2023, implementing Directives (EU) 2019/2161, 2019/770 and 2019/771. It carries turnover-based fines of up to 5% of annual turnover for widespread infringements and EUR 500 to 50,000 for other offences, forming the harmonised consumer-protection baseline against which payments-sector conduct is measured. Against that baseline, online and authorised-push-payment scam losses have risen sharply: nearly EUR 28 million in losses through mid-October 2025 across roughly 2,000 cases, nearly matching the full-year 2024 total, with cumulative losses since 2020 exceeding EUR 130 million and approximately 75% borne by individual victims rather than institutions. The Bank Association of Slovenia convened a conference in response, urging systemic countermeasures. Notably, no dedicated statutory APP-fraud mandatory reimbursement scheme — of the kind seen in some other European markets — currently exists in Slovenia to offset these losses, a gap the banking-industry association itself has flagged. This is a recognised WPM under-indexed area for financial-promotion and consumer-redress enforcement in smaller EU member states, warranting deeper coverage next cycle. #### Outlook With scam losses already close to matching 2024's full-year total by mid-October 2025 and no statutory reimbursement scheme in place, continued growth in APP-fraud losses is likely, absent either a national reimbursement mandate or a material shift in fraud-prevention practice by Slovenian PSPs. The Bank Association's conference call for systemic countermeasures is a marker worth tracking for any resulting policy proposal. no periodic updates on record for this sub-brief ** Sources and findings (5)** 1. T3 [https://www.schoenherr.eu/content/slovenia-new-requirements-for-consumer-facing-industries](https://www.schoenherr.eu/content/slovenia-new-requirements-for-consumer-facing-industries) retrieved 2026-07-05 2. T3 [https://english.news.cn/20251024/7cf0aa7fe574493bafe72018cd0e082f/c.html](https://english.news.cn/20251024/7cf0aa7fe574493bafe72018cd0e082f/c.html) retrieved 2026-07-05 3. T3 [https://english.news.cn/20251024/7cf0aa7fe574493bafe72018cd0e082f/c.html](https://english.news.cn/20251024/7cf0aa7fe574493bafe72018cd0e082f/c.html) retrieved 2026-07-05 4. T4 [https://stripe.com/resources/more/payments-in-slovenia](https://stripe.com/resources/more/payments-in-slovenia) retrieved 2026-07-05 5. T3 [https://www.zbs-giz.si/en/](https://www.zbs-giz.si/en/) retrieved 2026-07-05 ### W11 AML/CFT & Financial Crime [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/slovenia/#sec-dom-D7) Probable confirmed 2026-07-05 Sentinel.gi payments-context position: Slovenia's AML/CFT regime rests on the Prevention of Money Laundering and Terrorist Financing Act (ZPPDFT-2), enforced by the Ministry of Finance's Office for Money Laundering Prevention (OMLP) as central authority, with sectoral supervision split across Banka Slovenije, ATVP and the Insurance Supervision Agency. MONEYVAL's most recent evaluation found Slovenia Compliant/Largely Compliant on the great majority of FATF technical-compliance recommendations but flagged persistent effectiveness gaps, particularly on proactive ML investigation relative to predicate-crime risk. Standing sub-brief · as of 8 July 2026 201 words · last cycle 2026-07-08 #### AML/CFT & Financial Crime Slovenia's anti-money-laundering framework is enforced under the Prevention of Money Laundering and Terrorist Financing Act (ZPPDFT-2; Official Gazette Nos. 48/22 and 145/22), with the Office for Money Laundering Prevention (OMLP) as central authority and sectoral supervisors — including Banka Slovenije — retaining primary supervisory responsibility for their regulated populations. This intelligence is Sentinel.gi-fed W11 provenance carried per methodology; no original illicit-finance analysis is performed here, with deeper AML analysis routed to the Financial Intelligence Monitor. Slovenia's most recent MONEYVAL follow-up evaluation (2023) rated the country Compliant on 11 and Largely Compliant on 28 of the FATF's 40 Recommendations — a strong technical-compliance showing — but Highly Effective on none and Substantially Effective on only one of the eleven Immediate Outcomes, indicating a substantial gap between formal rule adoption and demonstrated effectiveness. Slovenia remains in enhanced follow-up, with money-laundering investigations rising but still not commensurate with predicate-crime volume. #### Outlook See the Financial Intelligence Monitor for deeper analysis of Slovenia's AML/CFT effectiveness gap. From a payments-market-access perspective, the technical-compliance/effectiveness divergence is relevant primarily insofar as it may shape future supervisory intensity toward payment institutions and e-money issuers, particularly non-bank entities newly captured by MiCA's AML exposure (see W2, W7). no periodic updates on record for this sub-brief ** Sources and findings (6)** 1. T3 sentinel.ezine.eversheds-sutherland.com/global-aml-guide/slovenia 2. T? FIM (sentinel.gi) per-JID baseline profile — Slovenia — Slovenia's AML/CFT regime rests on the Prevention of Money Laundering and Terrorist Financing Act (ZPPDFT-2), transposing EU AMLD, supervised by the FIU (UPPD, Ministry of Finance) and Banka Slovenije for banks. A free public beneficial-ownership register is maintained via AJPES. MONEYVAL rates Slovenia largely compliant technically (all Recommendations bar R.5 at LC/C) but the country remains in enhanced follow-up, with persistently low money-laundering conviction rates relative to predicate-crime investigations. 3. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness 4. T1 FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-003) — Sanctions: OFSI divergence 5. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: legal-gap 6. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: enforcement-absence ### W12 Correspondent Banking, Settlement & Access Probable confirmed 2026-07-05 As a euro-area member, Slovenia's settlement access runs through TARGET2-Slovenia (Banka Slovenije-operated RTGS component) for central-bank-money settlement, with the largest domestic banks (NLB, UniCredit Banka Slovenija, and others) offering correspondent banking services to regional and international counterparties; no material de-risking or correspondent-banking withdrawal event specific to Slovenia was identified in this collection pass. Standing sub-brief · as of 8 July 2026 186 words · last cycle 2026-07-08 #### Correspondent Banking, Settlement & Access Correspondent banking and settlement access in Slovenia runs primarily through TARGET2-Slovenia, Banka Slovenije's own component within the centralised TARGET2 platform, providing Slovenian banks and savings banks with central-bank-money settlement access. This is the same standing eurozone-infrastructure fact underlying the W5 corridor analysis, and no material Slovenia-specific correspondent-banking de-risking or account-closure event was identified this cycle. At the institutional level, UniCredit Banka Slovenija — the fourth-largest Slovenian bank by market share at 6.67% in 2025 — provides correspondent banking services alongside retail, private, corporate and institutional banking within the pan-European UniCredit Group network. This module's analytical spine is the asymmetry between bank-PSP access to correspondent networks like UniCredit's pan-European infrastructure and non-bank PI/EMI reliance on domestic safeguarding-account relationships (see W1b) — a structural feature of the Slovenian market rather than an emerging event this cycle. #### Outlook Absent a documented de-risking event, this module's baseline should hold. The persistent gap in this cycle's research — no Slovenia-specific correspondent-banking account-closure event identified — is itself worth flagging as a coverage item for next cycle rather than treated as evidence of an absence of risk. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.bsi.si/en/media/posts/launch-of-the-target2-payment-system](https://www.bsi.si/en/media/posts/launch-of-the-target2-payment-system) retrieved 2026-07-05 2. T4 [https://thebanks.eu/banks/17702](https://thebanks.eu/banks/17702) retrieved 2026-07-05 3. T1 [https://www.bsi.si/en/financial-stability/institutions-under-supervision/eea-states-credit-institutions-in-slovenia](https://www.bsi.si/en/financial-stability/institutions-under-supervision/eea-states-credit-institutions-in-slovenia) retrieved 2026-07-05 4. T4 [https://www.remitly.com/us/en/swift-codes/slovenia/bsljsi2xxxx/banka-slovenije-bank-of-slovenia](https://www.remitly.com/us/en/swift-codes/slovenia/bsljsi2xxxx/banka-slovenije-bank-of-slovenia) retrieved 2026-07-05 ### W13 Commercial Intelligence (M&A, Investment & Product) limited signal Probable confirmed 2026-07-05 Trailing-12-month commercial activity in Slovenia's payments-adjacent space is dominated by continued banking-sector consolidation aftershocks (OTP/Nova KBM-SKB integration, NLB Lease&Go/Summit Leasing merger) and modest but present fintech seed-stage funding, led by DDD Invoices' e-invoicing compliance infrastructure round. Standing sub-brief · as of 8 July 2026 102 words · last cycle 2026-09-11 #### Commercial Intelligence (M&A, Investment & Product) Two discrete commercial events mark Slovenia's trailing-twelve-month window. DDD Invoices, an API-driven e-invoicing compliance infrastructure provider, closed a EUR 1.31 million seed funding round in May 2026, led by Fil Rouge Capital and 500 Global with angel-investor participation. Separately, NLB Lease&Go and Summit Leasing Slovenia completed their merger in early July 2025, consolidating NLB Group's leasing and adjacent-finance footprint in Slovenia under the combined NLB Lease&Go entity; deal value was not publicly disclosed. #### Outlook No further Slovenia-specific commercial events were identified this cycle. Both entries above are dated markers rather than developing situations requiring standing-brief treatment. Periodic update · new data 2026-09-11 #### Commercial Intelligence & Fintech Flik, Slovenia's domestic instant-payment application operated via the payments infrastructure provider Bankart, is confirmed to have over 800,000 users exchanging approximately two million transactions monthly. This adoption figure is a discrete commercial-intelligence data point about a specific, named product's usage, distinguishing it from a structural market-wide trend claim: it describes Flik's own installed base and transaction throughput rather than a general statement about Slovenian payments-market structure. The significance of this figure sits in its timing relative to the regulatory calendar. Flik's adoption, and the associated finding that more than 80 per cent of SEPA transactions in Slovenia are already processed instantly, predates the EU Instant Payments Regulation's full mandatory-sending deadline of 9 October 2025 for Slovenian banks. Flik is therefore a product that achieved significant domestic scale ahead of, rather than in response to, the regulatory mandate that has now made instant payments compulsory across the euro area. This is a commercially notable pattern: a non-bank-adjacent domestic payment product built meaningful transaction volume in a market before regulation required the underlying capability industry-wide. No further specificity on Flik's ownership structure, revenue model, or competitive positioning relative to other domestic or pan-European instant-payment products was located this cycle. The finding here is limited strictly to the adoption metric itself, sourced independently from the regulatory compliance-timeline finding tracked separately under Operational Resilience & Critical Infrastructure. #### Outlook Watch for whether Flik's transaction-volume growth continues at pace now that SCT Inst is mandatory across all Slovenian banks rather than being a differentiator for early-adopter institutions, and for any commercial developments, such as expanded merchant acceptance or cross-border interoperability announcements, that would elevate Flik's user-adoption story into a broader Slovenian fintech-market narrative. **Sources and findings (4)** 1. T3 [https://fintech.global/2026/05/15/modest-week-in-fintech-with-677m-raised-in-14-deals/](https://fintech.global/2026/05/15/modest-week-in-fintech-with-677m-raised-in-14-deals/) retrieved 2026-07-05 2. T3 [https://en.wikipedia.org/wiki/NLB_Group](https://en.wikipedia.org/wiki/NLB_Group) retrieved 2026-07-05 3. T3 [https://practiceguides.chambers.com/practice-guides/acquisition-finance-2025/slovenia](https://practiceguides.chambers.com/practice-guides/acquisition-finance-2025/slovenia) retrieved 2026-07-05 4. T4 [https://tracxn.com/d/geographies/slovenia/MqqTYQpms3Zdt99rMUzg_BQVo4RReKLiz0lGA7oi82w](https://tracxn.com/d/geographies/slovenia/MqqTYQpms3Zdt99rMUzg_BQVo4RReKLiz0lGA7oi82w) retrieved 2026-07-05 ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for Slovenia| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{"legal_accessibility": {"per_product": {"account_to_account": "regulated", "cards": "regulated", "prepaid_emoney": "licensed-emi", "stablecoin": "emerging-regime"}}}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 0 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 64 finding(s), 126 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).