Major incident reporting

Preamble (Recitals 1 – 8)

Recitals

Article 1

General provisions

Article 2

General information to be provided in the major incident initial notification, intermediate and final reports

Article 3

Content of initial notifications

Article 4

Content of intermediate reports

Article 5

Content of final reports

Article 6

Time limits for the initial notification and intermediate report and final reports referred to in Article 19(4) of Regulation (EU)2022/2554

Article 7

Content of the voluntary notification of significant cyber threat

Article 8

Entry into force

Article 6Note: This article is based on the final draft from the ESAs and is not yet adopted. Time limits for the initial notification and intermediate report and final reports referred to in Article 19(4) of Regulation (EU)2022/2554

  1. The time limits for the submission of the initial notification and the intermediate and final reports as referred to in Article 19(4)(a) to (c) of Regulation (EU)2022/2554 shall be as follows:

    1. the initial report shall be submitted as early as possible within 4 hours from the moment of classification of the incident as major, but no later than 24 hours from the moment the financial entity has become aware of the incident;

    2. An intermediate report shall be submitted the latest within 72 hours from the submission of the initial notification even where the status or the handling of the incident have not changed as referred to in Article 19(4)(b) of Regulation (EU) 2022/2554. Financial entitiesas defined in Article 2, points (a) to (t) shall submit without undue delay an updated intermediate report, in any case, when regular activities have been recovered.

    3. the final report shall be submitted no later than one month from the submission of the latest updated intermediate report.

  2. Where an incident that has not been classified as major within the 24 hours is classified as major at a later stage, the financial entity shall submit the initial notification within the four-hours after the classification of the incident.

  3. Where financial entitiesas defined in Article 2, points (a) to (t) are unable to submit the initial notification, intermediate report or final report within the timelines as set out in paragraph 1, financial entitiesas defined in Article 2, points (a) to (t) shall inform the competent authorityas defined in Article 46 without undue delay, but no later than the respective time limit for submission of the notification/report, and shall explain the reasons for the delay.

  4. Where the time limit for submission of an initial notification, intermediate report or a final report falls on a weekend day or a bank holiday in the Member State of the reporting financial entity, the financial entity may submit the initial notification, intermediate or final reports by noon of the next working day.

  5. Paragraph 4 shall not apply for the submission of an initial notification and an intermediate report by credit institutionsmeans a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council (32);, central counterpartiesmeans a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012;, operators of trading venuesmeans a trading venue as defined in Article 4(1), point (24), of Directive 2014/65/EU;, and other financial entitiesas defined in Article 2, points (a) to (t) identified as essential or important entitiesas defined in Article 3 of Directive (EU) 2022/2555 pursuant to national rules transposing Article 3 of Directive (EU) 2022/2555, or financial entitiesas defined in Article 2, points (a) to (t) declared as significant or systemic by the competent authorityas defined in Article 46. In this case, the financial entitiesas defined in Article 2, points (a) to (t) shall apply the time limits set out in paragraph 1.

Table of contents