The rule applies to both hardware and software wallets. They must provide an initial warning about serious vulnerabilities within 24 hours. Then, within 72 hours, they must submit a full notification. A final report will be required 14 days after mitigation or remediation measures have been developed, and in the case of serious incidents — within a month.
The measure took effect on Friday as part of the EU’s broader cybersecurity rules. It applies to all products containing digital elements and available in the EU. Violations are subject to fines of up to €15 million or 2.5% of annual global turnover, whichever is higher. Providing false, incomplete, or misleading information is punishable by a fine of up to €5 million.