YTYK You think you know

Card 9 of 15 Incidents — classify, then report three times ●●● Sharp edge

Clients, and threats you were not asked about

Two obligations sit beside the supervisory report. Where a major incident has or may have an impact on clients' financial interests, the entity must inform those clients without undue delay and tell them what it is doing. Separately, entities may voluntarily notify significant cyber threats where they judge them relevant to the financial system.

Why it is like this

The first keeps the supervisory channel from becoming a way to keep customers in the dark. The second exists because the most useful intelligence usually arrives before anyone has an incident to report.

Not to be confused with

One report that covers everyone. The supervisor and the client get different communications on different triggers — and the voluntary threat notification is not an incident report, so it carries no admission that anything went wrong.

In practice

A failed payment run that delays salaries is a client impact, whatever the supervisory classification says.

Source: Regulation (EU) 2022/2554 (DORA) — Art. 19(2) and 19(3). Read on .

Odd one out Check yourself

Three of these are DORA incident communications. Which one does not exist?

  1. An initial notification to the competent authority
  2. Information to clients where their financial interests are affected
  3. A voluntary notification of a significant cyber threat
  4. A mandatory public disclosure of every major incident
Show the answer

A mandatory public disclosure of every major incident

There is no general publication duty. Authorities may inform the public in certain cases, but that is their decision, not an obligation on the entity.