Article 19 – Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
Changes since18 June 2026ST 10677/26, Art 19
Changes Article 19(1), first subparagraph and (2), first subparagraph. Every text of this provision
Text as printed
Changes since 18 June · Changes since the Commission proposal
Article 19(1), first subparagraph In every text (Article 19(1), first subparagraph)
1. in paragraph 1, the first subparagraph is replaced by the following:
Financial entities shall report major ICT-related incidents to the relevant competent authority as referred to in Article 46 with the support of the national entry point established pursuant to Article 23b of Directive (EU) 2022/2555 in accordance with paragraph 4 of this Article.
Article 19(2), first subparagraph In every text (Article 19(2), first subparagraph)
2. in paragraph 2, the first subparagraph is replaced by the following:
Financial entities may, on a voluntary basis, notify with the support of the national entry point established pursuant to Article 23b of Directive (EU) 2022/2555 significant cyber threats to the relevant competent authority when they deem the threat to be of relevance to the financial system, service users or clients. The relevant competent authority may provide such information to other relevant authorities referred to in paragraph 6.