<!-- headlesslaw {"release":{"id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","published":"2026-11-10T16:06:46Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["DORA L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"2d86bd12ba77a288053b34ea2517324b92d03c8039b7f5d156fa4002421384a1","release_published":"2026-11-10T16:06:46Z","checked_at":"2026-11-09","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/articles/23","url":"https://www.headlesslaw.com/dora/articles/23","title":"Article 23 — Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions","family":"l1_hand","work_id":"dora","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-11","applies_from":"2025-01-17","application":{"state":"applicable","next":null,"dates":[{"at":"2025-01-17","note":"Article 64"}]},"version_label":"Regulation (EU) 2022/2554, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-09"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng","valid_from":"2022-12-27","valid_until":null,"revision":1,"content_id":"8de2243d5f8e3512","change_date":null,"nearest_versions":["2022-12-27"],"first_text_date":"2022-12-14","correction_applies":false,"versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/dora/articles/23/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/dora/articles/23/versions/2022-12-27/rev/8de2243d5f8e3512","versions_url":"https://www.headlesslaw.com/dora/articles/23/versions","relations_url":"https://www.headlesslaw.com/dora/articles/23/relations","source_line":null,"attribution":null}} -->
---
title: "Article 23 — Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions"
type: regulation
legal_status: in_force
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554"
shortTitle: "Article 23 — Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions"
instrument_type: level1_regulation
authority: Commission
binding: true
binding_character: binding
mica_level2: false
legal_basis: "Regulation (EU) 2022/2554"
instrument: dora
celex: "32022R2554"
regulation: DORA
regulation-full: "Regulation (EU) 2022/2554"
article: 23
status: in_force
text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022"
source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng"
check_status: matched
verified: true
last_checked: 2026-11-09
---

*In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)*

The requirements laid down in this Chapter shall also apply to [operational or security payment-related incidents](https://www.headlesslaw.com/definitions/dora/operational-or-security-payment-related-incident) and to [major operational or security payment-related incidents](https://www.headlesslaw.com/definitions/dora/major-operational-or-security-payment-related-incident), where they concern [credit institutions](https://www.headlesslaw.com/definitions/dora/credit-institution), [payment institutions](https://www.headlesslaw.com/definitions/dora/payment-institution), [account information service providers](https://www.headlesslaw.com/definitions/dora/account-information-service-provider), and [electronic money institutions](https://www.headlesslaw.com/definitions/dora/electronic-money-institution).

***

[Chapter III — ICT-related incident management, classification and reporting](../chapters/iii.md) · [← Article 22](22.md) · [Article 24 →](24.md)