Art.19 Reporting of major ICT-related incidents

Financial entities report major ICT-related incidents to their single designated competent authority (significant credit institutions report to the national authority, which passes the report to the ECB), using the Article 20 templates, with an alternative channel where a technical problem blocks the initial notification; Member States may also require copies to NIS2 authorities or CSIRTs. Under Commission Delegated Regulation (EU) 2025/301, Article 5, the clocks are: initial notification as early as possible and within 4 hours of classifying the incident as major, but no later than 24 hours after becoming aware of it (Art. 5(1)(a)); where the incident is classified as major only after that 24-hour point, within 4 hours of classification (Art. 5(2)); intermediate report within 72 hours of submitting the initial notification even if nothing has changed, plus a further updated intermediate report promptly, and at the latest once regular activities are recovered (Art. 5(1)(b)); final report at the latest one month after the intermediate report or, where updates were filed, the latest updated intermediate report (Art. 5(1)(c)). An entity that cannot meet a deadline must tell the authority and give reasons before it expires (Art. 5(3)). A deadline falling on a weekend or bank holiday may move to noon of the next working day (Art. 5(4)), except for initial and intermediate submissions by credit institutions, central counterparties, trading venue operators and NIS2 essential or important entities (Art. 5(5)), and competent authorities may withdraw that relief from other significant or systemic entities (Art. 5(6)). Where a major incident affects the financial interests of clients, they are told without undue delay about it and the mitigation taken (Art. 19(3)). Significant cyber threats may be notified voluntarily. Reporting may be outsourced, but the entity stays responsible (Art. 19(5)).

Source: DORA (Regulation (EU) 2022/2554), Art.19. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.