EBA · EU-wide

Major ICT incident reporting: DORA rules for PIs and EMIs

Fintech Passport

July 24, 2026 · 12-min read

Major ICT incident reporting: DORA rules for PIs and EMIs

Major ICT incident reporting for payment and e-money institutions has run under DORA — Regulation (EU) 2022/2554, Articles 17 to 23 — since 17 January 2025, not under PSD2 Article 96. The short answer: classify the incident against the thresholds in Delegated Regulation (EU) 2024/1772; if it is major, send the initial notification within 4 hours of that classification and in any case within 24 hours of becoming aware of the incident, an intermediate report within 72 hours of the initial notification, and a final report within one month of the last intermediate report (Delegated Regulation (EU) 2025/301, Article 5), on the templates of Implementing Regulation (EU) 2025/302, to your home competent authority. PSD2 still matters for one thing: the fraud statistics of Article 96(6).

Last reviewed: 4 November 2026

1. What changed on 17 January 2025

Under PSD2 (Directive (EU) 2015/2366), Article 96(1) to (5) required payment service providers to notify major operational or security incidents to their home competent authority, following the EBA Guidelines on major incident reporting (EBA/GL/2021/03). Two things happened on the day DORA started to apply:

PSD2 was switched off, not repealed. Article 7 of Directive (EU) 2022/2556 added a new Article 96(7) to PSD2: Member States must ensure that paragraphs 1 to 5 do not apply to credit institutions, e-money institutions, payment institutions, account information service providers, exempted payment institutions and e-money institutions benefiting from a waiver. Member States had to apply the transposing measures from 17 January 2025.
The EBA Guidelines were repealed on 17 January 2025. The EBA explained that the few PSPs left outside DORA (it cites post office giro institutions and credit unions) remain under PSD2 incident reporting, and that national authorities may keep a similar approach for them under national law.

Article 96(6) was not touched. Payment service providers still send at least annual statistical data on fraud relating to different means of payment to their competent authority — see PSD2 fraud reporting under Article 96(6) and how the fraud return is built. Incident reporting moved; fraud reporting stayed.

2. The legal chain, article by article

Instrument	What it does for incident reporting
DORA Article 17	Incident management process; record all ICT-related incidents and significant cyber threats; early-warning indicators; inform senior management and the management body of at least major incidents
DORA Article 18	Classification criteria: clients and counterparts, transactions, reputation, duration and downtime, geographical spread, data losses, criticality of services, economic impact
DORA Article 19	Mandatory reporting of major incidents (19(1)); voluntary notification of significant cyber threats (19(2)); client information (19(3)); three reports (19(4)); outsourcing of reporting (19(5)); onward sharing by the authority (19(6))
DORA Articles 20-22	Mandate for the RTS and ITS; feasibility of a single EU reporting hub; supervisory feedback (the firm stays fully responsible)
DORA Article 23	Extends the whole chapter to operational or security payment-related incidents at credit institutions, PIs, AISPs and EMIs
Delegated Reg. (EU) 2024/1772	Classification criteria, materiality thresholds, recurring incidents, significant cyber threats
Delegated Reg. (EU) 2025/301 (23 October 2024)	Content of the three reports, time limits, voluntary cyber-threat notification content
Implementing Reg. (EU) 2025/302 (23 October 2024)	Single template (Annex I) and data glossary (Annex II); joint submission; secure channels; reclassification; notice of outsourced reporting

Scope follows entity type, not service: DORA Article 2(1) lists payment institutions (including those exempted under PSD2), account information service providers and e-money institutions (including those exempted under the EMD) alongside credit institutions, investment firms and crypto-asset service providers.

3. Is the incident “major”? The thresholds

Under Article 8 of Delegated Regulation 2024/1772, an incident is major when it has affected critical services and either (a) the data-loss threshold for a successful, malicious and unauthorised access is met, or (b) two or more of the other materiality thresholds are met. “Critical services” (Article 6) is met where the incident touches ICT supporting critical or important functions, touches authorised or supervised financial services, or is itself a successful malicious unauthorised access.

Criterion	Threshold met when (Art. 9)
Clients, counterparts, transactions	More than 10% of clients using the affected service, or more than 100,000 such clients; more than 30% of financial counterparts; more than 10% of the daily average number or value of transactions for the service; or clients/counterparts identified as relevant are affected
Reputational impact	Media coverage; repetitive complaints from different clients; likely failure to meet regulatory requirements; likely material loss of clients or counterparts
Duration and downtime	Incident lasts more than 24 hours, or downtime exceeds 2 hours for ICT services supporting critical or important functions
Geographical spread	Impact in two or more Member States
Data losses	Adverse impact on availability, authenticity, integrity or confidentiality of data, or any successful malicious unauthorised access that may result in data losses
Economic impact	Costs and losses exceed, or are likely to exceed, EUR 100,000 (gross of recoveries)

Duration runs from occurrence (or, if unknown, detection) to resolution; downtime runs until service is back to its pre-incident level. Where real numbers are missing, estimate from comparable reference periods.

Recurring incidents. Incidents that are individually not major count as one major incident if they occurred at least twice within six months, share the same apparent root cause and together meet the Article 8 test. The check is monthly. It does not apply to microenterprises or to entities under DORA’s simplified framework in Article 16(1), a group that includes exempted PIs and EMIs. Recurring incidents are reported in aggregated form (ITS Article 3).

4. The reporting clocks

The time limits sit in Article 5 of Delegated Regulation 2025/301:

Report	Deadline	Main content
Initial notification	As early as possible; within 4 hours of classification as major and no later than 24 hours from becoming aware of the incident	Detection time, description, criteria triggering “major”, Member States affected
Intermediate report	Within 72 hours of the initial notification, even if nothing has changed; updates without undue delay, and once regular activities are recovered	Incident type, affected processes, client impact, recovery, indicators of compromise
Final report	No later than one month after the intermediate report or, where applicable, the latest updated intermediate report	Root causes, resolution, costs, losses and recoveries

Further rules worth encoding:

Weekends and bank holidays: where a deadline falls on one in the firm’s Member State, the report may be filed by noon of the next working day (Article 5(4)). This does not apply to initial or intermediate reports of credit institutions, central counterparties, trading venue operators and entities identified as essential or important under NIS2, and an authority may also switch it off for entities it considers significant or systemic.
Running late: tell the authority before the deadline expires and explain why (Article 5(3)).
Joint submission: two or all three reports may be filed together if recovery or root-cause analysis is complete, as long as each time limit is met (ITS Article 2).
Reclassification: if a reported incident never met the criteria, notify the downgrade to non-major through the template (ITS Article 5).
Outsourced filing: allowed under DORA Article 19(5); the firm stays fully responsible and must tell the authority who files for it before the first report (ITS Article 6). See outsourcing regulatory reporting.
Clients: where a major incident hits clients’ financial interests, inform them without undue delay of the incident and the mitigating measures (DORA Article 19(3)).

5. Significant cyber threats: voluntary notification

Notifying a significant cyber threat is voluntary under DORA Article 19(2): a firm may notify when it considers the threat relevant to the financial system, service users or clients. Under Article 10 of Delegated Regulation 2024/1772 a threat is significant only if it could affect critical or important functions (or other financial entities, providers or clients), has a high probability of materialising, and could, if it materialised, meet the critical-services criterion or the clients/transactions or geographical-spread threshold. Article 6 of Delegated Regulation 2025/301 sets the notification content. Whether notified or not, every significant cyber threat must be recorded (DORA Article 17(2)).

6. Where to file: national channels

Reports go to the home competent authority through the secure electronic channel it provides (ITS Article 4). The authority passes the details to the EBA, to the ECB for credit institutions, PIs and EMIs, to NIS2 authorities or CSIRTs and to others listed in Article 19(6). A Member State may also require a copy to its NIS2 CSIRT. Channels we verified on official pages:

Country	Authority and channel
Spain	Banco de España: an electronic service on its Sede Electrónica for notifying (and delegating notification of) major incidents and significant threats under DORA; the entity must first adhere to the service and hold an LEI
France	ACPR: Instruction 2025-I-10 (in force 1 July 2025) — teletransmission to the ACPR General Secretariat in JSON format, for incidents and voluntary threat notifications
Italy	Banca d’Italia: the INFOSTAT platform; the bank also collects annual estimates of aggregated costs and losses from major incidents (due 31 May; 30 June for 2026)
Netherlands	DNB: Mijn DNB, “Aanvragen en meldingen”, form “Major ICT-incidents”; cyber threats under “Melding Cyberdreigingen”; NIS2 entities also report to the NCSC. DNB announced a process change in 2026 — check its DORA page before filing
Germany	BaFin: the MVP portal, procedure “DORA” (online form, XML upload or SOAP); significant cyber threats by e-mail form. DORA firms are relieved of the separate BSIG duty
Luxembourg	CSSF: eDesk procedure “DORA Major ICT-related incident and significant cyber threat notification”, or the S3 API; users need the “IT incident notifier” role. It replaced the PSD2 channel under Circular CSSF 21/787

Portals change more often than the law: register users, LEIs and roles before you need them. For Germany, see ZAIT repealed — ICT risk under DORA; for Spain, DORA in Spain — sanctions and payment processors.

7. Parallel obligations a DORA report does not discharge

GDPR: a personal-data breach goes to the data-protection authority without undue delay and, where feasible, within 72 hours of becoming aware (Regulation (EU) 2016/679, Article 33) — different authority, different test.
NIS2/CSIRT copies: where national law requires them (DORA Article 19(1), last subparagraph).
PSD2 fraud statistics: fraud losses from an incident still flow into the Article 96(6) return.

A single triage should fire all of these in parallel. Our incident reporting clocks comparison lays them side by side.

8. Worked scenarios

Facts: A payment institution detects at 08:10 on a Wednesday that card authorisations are failing. Its incident team classifies the incident as major at 11:30. Service is down for six hours, about 18% of card clients are affected, and clients in three Member States are hit.

What the rule says: Card authorisation supports a critical function, so the critical-services gate is passed. Downtime above 2 hours, more than 10% of clients and impact in two or more Member States are three thresholds; two are enough. The initial notification is due by 15:30 (4 hours after classification, well inside 24 hours of awareness). The intermediate report is due within 72 hours of the initial notification, with an update once service is restored. The final report is due one month after the last intermediate report.

What the practitioner does: Records both timestamps, files at 14:00, files the intermediate and an update on recovery, then closes with root cause and actual costs replacing estimates.

Facts: An e-money institution finds that phishing gave an attacker access to an internal system holding customer records. No service went down.

What the rule says: A successful, malicious and unauthorised access satisfies the critical-services criterion on its own, and where it may result in data losses it meets the Article 9(5)(b) threshold: that combination is major without any second threshold. It is also very likely a personal-data breach under the GDPR.

What the practitioner does: Runs the DORA initial notification and the GDPR Article 33 assessment in parallel, informs affected clients where their financial interests are at stake, and does not treat one filing as covering the other.

Facts: A payment institution not identified as essential or important under NIS2 classifies an incident as major at 21:00 on a Friday. The 4-hour limit falls inside Saturday.

What the rule says: Article 5(4) lets it file by noon on the next working day, unless its authority has notified it of a decision under Article 5(6).

What the practitioner does: Checks for any Article 5(6) decision before relying on the extension, and files earlier where it can.

9. FAQ

Is PSD2 Article 96 repealed?

No. Article 96(7), inserted by Directive (EU) 2022/2556, disapplies paragraphs 1 to 5 for credit institutions, PIs, EMIs and AISPs, including exempted PIs and waived EMIs. Article 96(6), the fraud-statistics duty, still applies. The EBA Guidelines EBA/GL/2021/03 were repealed on 17 January 2025.

When does the 4-hour clock start?

At classification as major. But the initial notification must also be sent no later than 24 hours after becoming aware of the incident, so slow classification does not buy time, except under Article 5(2) for incidents genuinely classified later.

Does a non-ICT payment incident have to be reported under DORA?

Yes, for credit institutions, PIs, AISPs and EMIs. DORA Article 23 applies the reporting chapter to operational or security payment-related incidents as well.

Must we report cyber threats?

Notification of significant cyber threats is voluntary (Article 19(2)), but every significant cyber threat must be recorded (Article 17(2)).

10. What to do, today

Replace PSD2 Article 96(1)-(5) and EBA/GL/2021/03 references in your incident procedure with DORA Articles 17-23 and the three acts above; keep Article 96(6) for fraud statistics.
Encode the Article 8 and Article 9 tests of Delegated Regulation 2024/1772 into the triage tool, with the critical-services gate first.
Capture two timestamps on every incident, awareness and classification, and alert on both the 4-hour and 24-hour limits.
Pre-register users, roles and the LEI on your authority’s portal; test the fallback route.
Run the monthly recurring-incident check and keep the register complete, including significant cyber threats.
Wire GDPR, NIS2 and fraud-statistics routing to the same triage.

11. Sources

Official texts and supervisory pages relied on for this review: