DORA Article 19: Obligations, Deadlines & Penalties

Financial entities shall report major ICT-related incidents to the relevant competent authority in accordance with paragraph 4. Regulation (EU) 2022/2554, Article 19, Article 19

Member States shall designate a single competent authority as the relevant competent authority responsible for carrying out the functions and duties provided for in this Article where a financial entity is subject to supervision by more than one national competent authority. Regulation (EU) 2022/2554, Article 19, Article 19

Credit institutions classified as significant shall report major ICT-related incidents to the relevant national competent authority designated in accordance with Article 4 of Directive 2013/36/EU. Regulation (EU) 2022/2554, Article 19, Article 19

The relevant national competent authority shall immediately transmit the report of major ICT-related incidents from significant credit institutions to the ECB. Regulation (EU) 2022/2554, Article 19, Article 19

Financial entities shall produce the initial notification and reports using the templates referred to in Article 20 after collecting and analysing all relevant information. Regulation (EU) 2022/2554, Article 19, Article 19

Financial entities shall submit the initial notification and reports to the competent authority. Regulation (EU) 2022/2554, Article 19, Article 19

In the event that a technical impossibility prevents the submission of the initial notification using the template, financial entities shall notify the competent authority about it via alternative means. Regulation (EU) 2022/2554, Article 19, Article 19

The initial notification and reports shall include all information necessary for the competent authority to determine the significance of the major ICT-related incident and assess possible cross-border impacts. Regulation (EU) 2022/2554, Article 19, Article 19

Financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident where it has an impact on the financial interests of clients. Regulation (EU) 2022/2554, Article 19, Article 19

In the case of a significant cyber threat, financial entities shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking. Regulation (EU) 2022/2554, Article 19, Article 19

Financial entities shall, within the time limits to be laid down in accordance with Article 20, submit an initial notification to the relevant competent authority. Regulation (EU) 2022/2554, Article 19, Article 19

Financial entities shall submit an intermediate report after the initial notification as soon as the status of the original incident has changed significantly or the handling of the major ICT-related incident has changed based on new information available. Regulation (EU) 2022/2554, Article 19, Article 19

Financial entities shall submit updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authority. Regulation (EU) 2022/2554, Article 19, Article 19

Financial entities shall submit a final report when the root cause analysis has been completed and when the actual impact figures are available to replace estimates. Regulation (EU) 2022/2554, Article 19, Article 19

In case of outsourcing reporting obligations to a third-party service provider, the financial entity remains fully responsible for the fulfilment of the incident reporting requirements. Regulation (EU) 2022/2554, Article 19, Article 19

Upon receipt of the initial notification and of each report, the competent authority shall, in a timely manner, provide details of the major ICT-related incident to EBA, ESMA or EIOPA. Regulation (EU) 2022/2554, Article 19, Article 19

Upon receipt of the initial notification and of each report, the competent authority shall, in a timely manner, provide details of the major ICT-related incident to the ECB in the case of financial entities referred to in Article 2(1), points (a), (b) and (d). Regulation (EU) 2022/2554, Article 19, Article 19