Article 19

‘Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 via the single-entryreporting pointchannel designated by the relevant competent authority or, where applicable, through the interoperable European framework established pursuant to Article 23a of Directive (EU) 2022/2555, to the extent that such use does not affect the powers of the relevant competent authority, in accordance with paragraph 4 of this Article.’

‘Financial entities may, on a voluntary basis, notify via the single-entryreporting pointchannel designated by the relevant competent authority or, where applicable, through the interoperable European framework established pursuant to Article 23a of Directive (EU) 2022/2555 significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.