Skip to the text
In this act Article 3 of 7
Text as of 26 Oct 2026 · Commission Delegated Regulation (EU) 2025/301, OJ L, 2025/301, 20.2.2025 · Same wording as today’s text.Today’s text

Article 3 — Specific information to be provided in intermediate reports

Financial servicesLevel 2RTSDORAIn forceOfficial source

Intermediate reports as referred to in Article 19(4), point (b), of Regulation (EU) 2022/2554 shall contain at least all of the following specific information:

3(a)
a)where applicable, the incident reference code provided by the competent authority;
Copy link
3(b)
b)the date and time of occurrence of the ICT-related incident;
Copy link
3(c)
c)where applicable, the date and time when the financial entity has recovered its regular activities;
Copy link
3(d)
d)information about how the criteria laid down in Articles 1 to 8 of Delegated Regulation (EU) 2024/1772 have been fulfilled, on the basis of which the financial entity classified the ITC-related incident as major;
Copy link
3(e)
e)the type of ICT-related incident;
Copy link
3(f)
f)where applicable, the threats and techniques used by the threat actor;
Copy link
3(g)
g)affected functional areas and business processes;
Copy link
3(h)
h)affected infrastructure components supporting business processes;
Copy link
3(i)
i)impact on the financial interest of clients;
Copy link
3(j)
j)information about reporting about the ICT-related incident to other authorities;
Copy link
3(k)
k)temporary actions or measures taken or planned to be taken by the financial entity to recover from the ICT-related incident;
Copy link
3(l)
l)where applicable, information on indicators of compromise.\
Copy link