EBA E-mail alert December 11, 2024

Article 6 of the Delegated Act on the Classification of Major Incidents states that:

"For the purpose of determining the criticality of the services affected as referred to in Article 18(1), point (e), of Regulation (EU) 2022/2554, financial entities shall assess whether the incident:
(a) affects or has affected ICT services or network and information systems that support critical or important functions of the financial entity;
(b) affects or has affected financial services provided by the financial entity that require authorisation, registration or that are supervised by competent authorities;
(c) constitutes or has constituted a successful, malicious and unauthorised access to the network and information systems of the financial entity."

Can you confirm please that ALL three of the components are cumulatively required to trigger the criteria on Critical Services Affected?

Is it accurate to interpret that an ICT intra-group service provider established outside the EU (non-EU country), providing critical services to an EU-based financial institution (parent undertaking), falls within the exemption outlined in Article 31(8) of DORA, thereby exempting the need for establishing a subsidiary within the EU?

Is duplicate incident reporting via the ECB SSM Cyber Incident Reporting Framework required, alongside DORA incident reporting under Article 19?