Duplicate ICT Incident Reporting

Recital 51 of Regulation (EU) 2022/2554 clarifies that ICT-related incident reporting should be harmonised through the introduction of a requirement for all financial entities to report directly to their relevant competent authorities. Where a financial entity is subject to supervision by more than one national competent authority, Member States should designate a single competent authority as the addressee of such reporting. Credit institutions classified as significant in accordance with Article 6(4) of Council Regulation (EU) No 1024/2013 (19) should submit such reporting to the national competent authorities, which should subsequently transmit the report to the European Central Bank (ECB). Accordingly, ICT-related major incidents, including cyberincidents, affecting significant institutions in accordance with Article 6(4) of Council Regulation (EU) No 1024/2013 (19) should be classified and reported only under regulation (EU)2022/2554 and the related Technical Standards.