What must a financial entity report after a major ICT incident?

Financial services firm

Financial entities listed in Article 2 of DORA, including payment institutions, investment firms and insurers.

Yes, major ICT-related incidents must be reported to the competent authority.

Classify incidents, submit initial, intermediate and final reports and inform affected clients.

not_in_register

1. Classify the incident under the DORA criteria
2. Submit the initial notification
3. Submit the intermediate report
4. Submit the final report

Three reports under Article 19(4); the exact time limits are set in the regulatory technical standards.

• DORA Art. 18
• DORA Art. 19
• DORA Art. 20

sha256 860c26296bb9d3a8b63deab9df539b6f26a38b40d78b64611caee9e5997b249f · read 2026-10-15 · Source: NovaCopilot

• When must a listed company disclose a cyber incident?
• Must a non-bank financial firm report a data breach to the FTC?
• What is needed before offering a crypto-asset to the public in the EU?
• Do I need a licence to provide crypto-asset services in the EU?
• What is required to issue an asset-referenced token in the EU?

• eu:dora (action_kit)
• agent:eu:business:aml-customer-due-diligence (business_agent)
• agent:eu:business:aml-suspicious-transaction-report (business_agent)
• agent:eu:business:mica-asset-referenced-token (business_agent)
• agent:eu:business:mica-casp-authorisation (business_agent)
• agent:eu:business:mica-e-money-token (business_agent)
• agent:eu:business:mica-white-paper (business_agent)
• agent:us:business:glba-safeguards-notice (business_agent)
• agent:us:business:sec-cyber-incident (business_agent)