<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2024-04-15","gaps":[],"covered":["ESMA Q&A 2158 — Q&A — Understandig of timelimits of intermediate repots [Answer Published] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESMA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/esma/esma-qa-2158-understandig-of-timelimits-of-intermediate-repots-for-major","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2158-understandig-of-timelimits-of-intermediate-repots-for-major","title":"ESMA Q&A 2158 — Q&A — Understandig of timelimits of intermediate repots [Answer Published]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/esma/esma-qa-2158-understandig-of-timelimits-of-intermediate-repots-for-major","status":"answer published","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"ESMA Q&A register, 15 April 2024","check":{"against":"the ESMA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2158","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"b97f573058dd4d90","change_date":null,"nearest_versions":["2024-04-15"],"first_text_date":null,"correction_applies":false,"versions":["2024-04-15"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2158-understandig-of-timelimits-of-intermediate-repots-for-major/versions/2024-04-15","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2158-understandig-of-timelimits-of-intermediate-repots-for-major/versions/2024-04-15/rev/b97f573058dd4d90","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2158-understandig-of-timelimits-of-intermediate-repots-for-major/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2158-understandig-of-timelimits-of-intermediate-repots-for-major/relations","source_line":"Answer by ESMA, published in its Q&A tool · not legislation · published 15 Apr 2024 [Answer Published]","attribution":{"prepared_by":"ESMA","published_by":"ESMA","published_in":"ESMA Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2024-04-15","question_submitted_on":"2024-04-15","locators":{"published_on":"ESMA Q&A Excel export ESMA_QA_2158, column 'Esma responses', date line","question_submitted_on":"ESMA Q&A Excel export ESMA_QA_2158, column 'Date of submission'"}},"adoption":null}}} -->
---
title: "ESMA Q&A 2158 — Q&A — Understandig of timelimits of intermediate repots [Answer Published]"
shortTitle: "ESMA Q&A 2158 — Q&A — Understandig of timelimits of intermediate repots [Answer Published]"
answer_id: ESMA_QA_2158
topic: "ICT-related incident"
status: "Answer Published"
type: qa
instrument_type: qa
authority: ESMA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "DORA"
dora_level3: true
mica_level2: false
legal_basis: "Draft RTS Article 6 section 1 lit. b)JC 2023 70"
date: 15 April 2024
source_link: https://www.esma.europa.eu/publications-data/questions-answers/2158
lifecycle: "Answer Published"
text_version: "ESMA Q&A register, 15 April 2024"
source_url: "https://www.esma.europa.eu/publications-data/questions-answers/2158"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the ESMA publication"
source:
  prepared_by: "ESMA"
  published_by: "ESMA"
  published_in: "ESMA Q&A tool"
  evidence:
    prepared_by: "ESMA Answer"
    locator: "ESMA Q&A entry ESMA_QA_2158: field 'ESMA Answer', no 'Answer provided by' line"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2024-04-15"
  question_submitted_on: "2024-04-15"
  locators:
    published_on: "ESMA Q&A Excel export ESMA_QA_2158, column 'Esma responses', date line"
    question_submitted_on: "ESMA Q&A Excel export ESMA_QA_2158, column 'Date of submission'"
lifecycle_label: "Answer Published"
---

**Answer by ESMA, published in its Q&A tool · not legislation · published 15 Apr 2024 [Answer Published]**

*Answer Published · ESMA Q&A register, 15 April 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2158)*

| | |
|---|---|
| **Full title** | ESMA Q&A 2158 — Q&A — Understandig of timelimits of intermediate repots \[Answer Published\] |
| **Prepared by** | ESMA |
| **Published by** | ESMA, in the ESMA Q&A tool |
| **Reference** | ESMA_QA_2158 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 15 April 2024; question submitted 15 April 2024 |
| **Legal basis** | Draft RTS Article 6 section 1 lit. b)JC 2023 70 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the ESMA publication |

**Understandig of timelimits of intermediate repots for major related ICT-incidents**

### Question

Is our standing of Article 6 of the RTS correct, that an institution should submit more than one intermediate report for a major ICT-incident, if that incident continues over the 72 hours threshold for the initial intermediate report?

Art. 6 states that an institution has to submit a report in case that after 72 hours the incident is not resolved or when the incident is resolved. Our understanding is that the "or" means that an institute has to submit more than one report in case that the incident is resolved after more than 72 hours.

***

### Answer

[Article 19(4)](../../../articles/19.md) of Regulation (EU) 2022/2554 (DORA) provides that financial entities shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii), submit an intermediate report after the initial notification, as soon as the status of the original incident has changed significantly or the handling of the incident has changed based on new information available, followed, as appropriate by updated notifications every time a relevant status update is available, as well as upon a specific request of the competent authority.

Article 5(1)(b) of the Commission Delegated Regulation XX (RTS on content and timelines on incident reporting) specifies that financial entities shall submit an intermediate report ‘at the latest within 72 hours from the submission of the initial notification, even where the status or the handling of the incident have not changed as referred to in [Article 19(4)](../../../articles/19.md), point (b), of Regulation (EU) 2022/2554. Financial entities shall submit an updated intermediate report without undue delay, and in any case when the regular activities have been recovered’.

It follows from the above that financial entities shall submit an intermediate report under the conditions set out in [Article 19(4)](../../../articles/19.md) of DORA and at the very latest within 72 hours from the submission of the initial notification as set out in the Delegated Regulation.

Where financial entities have not recovered regular activities within 72 hours from the submission of the initial notification, they shall submit an intermediate within the 72-hour timeframe and at least another intermediate when the regular activities have been recovered.

Where financial entities have recovered regular activities, they can submit a single intermediate report, provided that the requirements of [Article 19(4)](../../../articles/19.md) of DORA are met.

***

**Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2158)