EU regulatory register · DORA
Article 23Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions
CELEX 32022R2554 · Read on 2026-08-18
Short answer
The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions, payment institutions, account information service providers, and electronic money institutions.
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/dora-2022-2554/artikel-23 · Short answer as data · Official text
DORA, digital operational resilience in short
Financial entities must manage ICT risk, report major ICT incidents, test resilience and govern ICT providers by contract.
- Who is covered by DORA?
- What does Article 30 require in ICT contracts?
- How fast must an ICT incident be reported?
Source: NovaCopilot
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions, payment institutions, account information service providers, and electronic money institutions.
Follow-up questions
Guidance and secondary law
Authority guidance and the delegated or implementing acts that fill the article, with the primary source at the issuing body. Read 2026-08-31.
- Technical standard (RTS) · EBA/ESMA/EIOPA2024-01-17RTS/ITS on classification and reporting of major ICT-related incidents (JC 2023-85)
Classification thresholds and reporting formats for major ICT incidents under Articles 17-23.
Article 17, 18, 19, 20, 21, 22, 23
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit