Close survey popup

User survey


Help us improve dora-info.eu by taking a 2-minute user survey.

Survey icon

Reporting of major ICT-related incidents and voluntary notification of significant cyber threats


TL;DR The Digital Operations Resilience Act from the EU states that financial entities must report major ICT-related incidents to the relevant competent authority within a certain time frame. Credit institutions deemed significant must report such incidents to relevant national competent authorities, who can then transmit the reports to the ECB. These reports should include all necessary information for the competent authority to assess possible cross-border impacts, and Member States may additionally require that these reports be sent to designated or established CSIRTs. Financial entities may also, on a voluntary basis, notify significant cyber threats to the relevant competent authority. In the case of a major ICT-related incident, clients must be informed without undue delay. These reporting obligations may be outsourced to a third-party service provider, but the financial entity remains responsible for their fulfilment. Upon receipt of the reports, the competent authority shall inform other relevant public authorities based on their competences. EBA, ESMA, or EIOPA and the ECB shall assess the incidents and notify relevant competent authorities in other Member States, while the ECB shall notify the members of the European System of Central Banks. ESMA has responsibility to notify competent authorities in host Member States if there is significant cross-border activity.
  1. Financial entitiesas defined in Article 2, points (a) to (t) shall report major ICT-related incidentsmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; to the relevant competent authorityas defined in Article 46 as referred to in Article 46 in accordance with paragraph 4 of this Article.

    Where a financial entity is subject to supervision by more than one national competent authorityas defined in Article 46 referred to in Article 46, Member States shall designate a single competent authorityas defined in Article 46 as the relevant competent authorityas defined in Article 46 responsible for carrying out the functions and duties provided for in this Article.

    Credit institutionsmeans a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (32); classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, shall report major ICT-related incidentsmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; to the relevant national competent authorityas defined in Article 46 designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit that report to the ECB.

    For the purpose of the first subparagraph, financial entitiesas defined in Article 2, points (a) to (t) shall produce, after collecting and analysing all relevant information, the initial notification and reports referred to in paragraph 4 of this Article using the templates referred to in Article 20 and submit them to the competent authorityas defined in Article 46. In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entitiesas defined in Article 2, points (a) to (t) shall notify the competent authorityas defined in Article 46 about it via alternative means.

    The initial notification and reports referred to in paragraph 4 shall include all information necessary for the competent authorityas defined in Article 46 to determine the significance of the major ICT-related incidentmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; and assess possible cross-border impacts.

    Without prejudice to the reporting pursuant to the first subparagraph by the financial entity to the relevant competent authorityas defined in Article 46, Member States may additionally determine that some or all financial entitiesas defined in Article 2, points (a) to (t) shall also provide the initial notification and each report referred to in paragraph 4 of this Article using the templates referred to in Article 20 to the competent authoritiesas defined in Article 46 or the computer security incident response teams (CSIRTscomputer security incident response teams) designated or established in accordance with Directive (EU) 2022/2555.

  2. Financial entitiesas defined in Article 2, points (a) to (t) may, on a voluntary basis, notify significant cyber threatsmeans a cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident; to the relevant competent authorityas defined in Article 46 when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authorityas defined in Article 46 may provide such information to other relevant authorities referred to in paragraph 6.

    Credit institutionsmeans a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (32); classified as significant, in accordance with Article 6(4) of Regulation (EU) No 1024/2013, may, on a voluntary basis, notify significant cyber threatsmeans a cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident; to relevant national competent authorityas defined in Article 46, designated in accordance with Article 4 of Directive 2013/36/EU, which shall immediately transmit the notification to the ECB.

    Member States may determine that those financial entitiesas defined in Article 2, points (a) to (t) that on a voluntary basis notify in accordance with the first subparagraph may also transmit that notification to the CSIRTscomputer security incident response teams designated or established in accordance with Directive (EU) 2022/2555.

  3. Where a major ICT-related incidentmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; occurs and has an impact on the financial interests of clients, financial entitiesas defined in Article 2, points (a) to (t) shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incidentmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; and about the measures that have been taken to mitigate the adverse effects of such incident.

    In the case of a significant cyber threatmeans a cyber threat the technical characteristics of which indicate that it could have the potential to result in a major ICT-related incident or a major operational or security payment-related incident;, financial entitiesas defined in Article 2, points (a) to (t) shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking.

  4. Financial entitiesas defined in Article 2, points (a) to (t) shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii) submit the following to the relevant competent authorityas defined in Article 46:

    1. an initial notification;

    2. an intermediate report after the initial notification referred to in point (a), as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incidentmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; has changed based on new information available, followed, as appropriate, by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authorityas defined in Article 46;

    3. a final report, when the root cause analysis has been completed, regardless of whether mitigation measures have already been implemented, and when the actual impact figures are available to replace estimates.

  5. Financial entitiesas defined in Article 2, points (a) to (t) may outsource, in accordance with Union and national sectoral law, the reporting obligations under this Article to a third-party service provider. In case of such outsourcing, the financial entity remains fully responsible for the fulfilment of the incident reporting requirements.

  6. Upon receipt of the initial notification and of each report referred to in paragraph 4, the competent authorityas defined in Article 46 shall, in a timely manner, provide details of the major ICT-related incidentmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; to the following recipients based, as applicable, on their respective competences:

    1. EBA, ESMA or EIOPA;

    2. the ECB, in the case of financial entitiesas defined in Article 2, points (a) to (t) referred to in Article 2(1), points (a), (b) and (d);

    3. the competent authoritiesas defined in Article 46, single points of contact or CSIRTscomputer security incident response teams designated or established in accordance with Directive (EU) 2022/2555;

    4. the resolution authorities, as referred to in Article 3 of Directive 2014/59/EU, and the Single Resolution Board (SRBdefined in-line) with respect to entities referred to in Article 7(2) of Regulation (EU) No 806/2014 of the European Parliament and of the Council (37)Regulation (EU) No 806/2014 of the European Parliament and of the Council of 15 July 2014 establishing uniform rules and a uniform procedure for the resolution of credit institutions and certain investment firms in the framework of a Single Resolution Mechanism and a Single Resolution Fund and amending Regulation (EU) No 1093/2010 (OJ L 225, 30.7.2014, p. 1)., and with respect to entities and groupsmeans a group as defined in Article 2, point (11), of Directive 2013/34/EU; referred to in Article 7(4)(b) and (5) of Regulation (EU) No 806/2014 if such details concern incidents that pose a risk to ensuring critical functions within the meaning of Article 2(1), point (35), of Directive 2014/59/EU; and

    5. other relevant public authoritiesmeans any government or other public administration entity, including national central banks. under national law.

  7. Following receipt of information in accordance with paragraph 6, EBA, ESMA or EIOPA and the ECB, in consultation with ENISA and in cooperation with the relevant competent authorityas defined in Article 46, shall assess whether the major ICT-related incidentmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; is relevant for competent authoritiesas defined in Article 46 in other Member States. Following that assessment, EBA, ESMA or EIOPA shall, as soon as possible, notify relevant competent authoritiesas defined in Article 46 in other Member States accordingly. The ECB shall notify the members of the European System of Central Banks on issues relevant to the payment system. Based on that notification, the competent authoritiesas defined in Article 46 shall, where appropriate, take all of the necessary measures to protect the immediate stability of the financial system.

  8. The notification to be done by ESMA pursuant to paragraph 7 of this Article shall be without prejudice to the responsibility of the competent authorityas defined in Article 46 to urgently transmit the details of the major ICT-related incidentmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; to the relevant authority in the host Member State, where a central securities depositorymeans a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014; has significant cross-border activity in the host Member State, the major ICT-related incidentmeans an ICT-related incident that has a high adverse impact on the network and information systems that support critical or important functions of the financial entity; is likely to have severe consequences for the financial markets of the host Member State and where there are cooperation arrangements among competent authoritiesas defined in Article 46 related to the supervision of financial entitiesas defined in Article 2, points (a) to (t).