Contents
- Who it applies to, and since when
- Penetration tests and scans (points 30, 33)
- Audit of critical systems (points 24–25)
- Incident reporting (point 81)
- Your obligations calendar
- Providers and outsourcing
- NBM, PCI DSS and DORA: where they overlap
- How we build the test for the NBM
- Frequently asked questions
- Sources
In 30 seconds
- The regulation approved by Decision No. 29 of 12.02.2025 has been in force since 20 March 2025; the last compliance deadlines, of 15 months, expired in June 2026 12.
- It applies to banks, payment companies, e-money issuers and postal service providers offering payment services 1.
- Penetration tests on critical systems: at least every 3 years, on production, by internationally certified testers 1.
- An incident affecting critical functions is notified by the end of the working day; the final report, signed by management, within 20 days 1.
- By 31 January, the NBM receives pentest and scan results, plus PCI DSS and SWIFT reports where they exist 1.
Who it applies to, and since when
The regulation on minimum requirements for managing ICT, information security and business continuity risks was approved by NBM Executive Board Decision No. 29 of 12 February 2025, published in the Official Gazette No. 62-65 of 20.02.2025, and has been in force since 20 March 2025 13. It applies to the payment service providers in Art. 5(1)(a)–(d) of Law No. 114/2012: banks, payment companies, e-money issuers and postal service providers 1.
- 3 monthsJune 2025
Incident notification (point 81).
- 9 monthsDecember 2025
Governance, security, penetration tests, operations, incidents, risk assessment and annual reporting (points 4–56, 62, 65–67, 76–80, 82).
- 12 monthsMarch 2026
The first business continuity requirements (points 57, 58.1–58.11).
- 15 monthsJune 2026
Testing and reviewing the continuity plan and the remaining requirements (points 58.12–61, 63–64, 68–75).
Penetration tests and scans (points 30, 33)
The regulation requires an assessment and testing framework that validates that controls actually work (point 33). Specifically 1:
| Point | What it requires |
|---|---|
| 30.1 | Periodic vulnerability scans of critical applications, systems, network equipment and workstations; timely measures or compensating controls 1 |
| 33.1 | Scans and penetration tests proportionate to risk and system importance 1 |
| 33.2 | On critical systems and services: continuously, at least every 3 years, or more often at the NBM’s request 1 |
| 33.3 | Following predefined scenarios validated by the institution, on live production systems 1 |
| 33.4 | By experts with international certifications, e.g. OSCP, CEH, GPEN, CPENT, LPT 1 |
| 33.5 | On major infrastructure or process changes, after major incidents and when launching new internet-facing systems 1 |
Audit of critical systems (points 24–25)
Separately from testing, all critical ICT systems and services undergo an internal or external audit at least every 3 years. The minimum list, where implemented: the domestic automated payment system (SAPI), remote-access payment instruments, SWIFT, core banking, databases, Active Directory, identity and privileged access management, firewall, VPN, electronic document management and messaging 1. Recommendations are remediated in time, proportionate to risk (point 25) 1.
A penetration test of Active Directory, VPN, firewall and internet banking produces technical evidence the audit can use directly — especially for privileged access, where configuration on paper and reality differ most often.
Incident reporting (point 81)
Incidents are notified through the PCSI platform or, if it is unavailable, to [email protected] 1:
- Day 0Initial notification — critical functions
Without delay, by the end of the working day; if the incident occurred less than 2 hours before close, within 4 hours of the start of the next working day (point 81.1).
- Day 1Initial notification — payment services
For incidents affecting significant functions or payment service continuity: by the next working day at the latest (point 81.2).
- ≤ 3 daysIntermediate report
Circumstances, affected systems, estimated impact and measures taken so far (point 81.3).
- ≤ 20 daysFinal report
Signed by a member of the management body: root causes, actual impact and measures to prevent recurrence (point 81.4).
Your obligations calendar
Answer three or four questions and see, in one place, what you send to the NBM and what must be tested, with the regulation point 145.
Your ICT obligations calendar towards the NBM
Indicative, based on the regulation’s text; it does not replace reading it or your dialogue with the NBM.
What you send to the NBM every year
- By 31 January, to the NBM: penetration test results and the latest vulnerability scans on all critical resources, as of December (points 82.1–82.2).
- The year’s PCI DSS assessment report, with the annual reporting (point 82.4).
- The SWIFT CSCF assessment report, if an assessment was carried out (point 82.3).
- Results of continuity tests done without the NBM and the report on significant ICT risks (points 82.5–82.6).
What you test, and how often
- Penetration test of critical ICT systems and services at least every 3 years, on production, following validated scenarios, with certified testers (points 33.2–33.4).
- In the card environment: internal and external penetration test every 12 months (PCI DSS 11.4) — the stricter frequency wins.
- Security testing on major changes, after major incidents and when launching new internet-facing systems (point 33.5).
- Periodic vulnerability scans of critical applications, systems, network equipment and workstations (point 30.1).
- Internal or external audit of all critical ICT systems at least every 3 years — including the domestic payment system, remote payment instruments, SWIFT, core banking, databases, Active Directory, privileged access, firewall, VPN (point 24).
- Testing the continuity plan at least every 2 years and backups at least annually (points 58.12, 38).
- ICT risk profile assessment at least annually and on major changes (point 77); annual security awareness training for all staff (point 34).
- Outsourced card processing: the external auditor holds the QSA qualification, unless the provider already has an annual QSA audit (Decision 28/2025, point 65.4); where relevant, the right to penetration-test outsourced ICT services (point 77.3.2).
Providers and outsourcing
The institution remains fully responsible for the effectiveness of security measures in outsourced functions (point 78), and contracts with ICT providers contain confidentiality, integrity and availability clauses and the obligation to cooperate with supervisory authorities (point 32) 1.
For non-bank providers, the outsourcing regulation (Decision No. 28/2025) adds: the external auditor of outsourced card processing holds the QSA qualification, unless the provider already has an annual QSA audit (point 65.4), and the contract provides, where relevant, for penetration tests of outsourced ICT services (point 77.3.2) 4.
NBM, PCI DSS and DORA: where they overlap
| Aspect | NBM (Decision 29/2025) | PCI DSS v4.0.1 | DORA (EU) |
|---|---|---|---|
| Pentest | Critical systems, ≤ 3 years 1 | Card environment, 12 months 5 | Critical functions, annually; TLPT every 3 years for those identified 6 |
| Testers | International certifications 1 | Qualified, independent 5 | Independent; strict requirements for TLPT 6 |
| Production | Yes, following validated scenarios 1 | The CDE scope 5 | TLPT on production 6 |
DORA does not apply directly in the Republic of Moldova, but it is the European reference for banks with EU shareholders. One testing programme, planned on the strictest frequency, covers all three.
How we build the test for the NBM
- The critical inventory
We start from critical systems and the point 24 list: internet banking, SAPI, SWIFT, core banking, Active Directory, VPN.
- Validated scenarios
Scenarios are written and approved by the institution before the test, as point 33.3 requires.
- Testing on production
With agreed windows, emergency contacts and an immediate stop on any unexpected effect.
- A report for the NBM
Findings with severity, evidence and remediation, plus the testers’ certifications, ready to attach to the January reporting (point 82.1).
- Retest
Confirms findings are closed before reporting.
Frequently asked questions
How often does the NBM require a penetration test?
Which certifications must testers hold?
Is the test done on production?
How quickly is an incident reported to the NBM?
What do we send to the NBM at year end?
Does the regulation also apply to payment companies?
Sources
Every statement about a law or standard links to its official source. Consulted on the date shown.
- NBM — Regulation on minimum requirements for managing ICT, information security and business continuity risks (Executive Board Decision No. 29/2025), PDFbnm.md · accessed 23 October 2026
- NBM — the regulation’s page, with compliance deadlinesbnm.md · accessed 23 October 2026
- State Register of Legal Acts — Decision No. 29/2025legis.md · accessed 23 October 2026
- NBM — Regulation on outsourcing by non-bank payment service providers (Decision No. 28/2025, amended by Decision No. 229/2025)bnm.md · accessed 23 October 2026
- PCI DSS v4.0.1 — SAQ D for Service Providers, r2 (requirements 11.3 and 11.4)pcisecuritystandards.org · accessed 23 October 2026
- Regulation (EU) 2022/2554 (DORA)eur-lex.europa.eu · accessed 23 October 2026
About the authors
The guides are written by the team that does the testing, not a marketing department. We update them when the law, the standard or what we see in testing changes.