DORA incident reporting: what you owe your central bank, and when

When a major ICT incident hits a financial entity, the technical response is only half of the problem. A reporting clock starts too, and the reports go to your supervisor. For banks, payment institutions and e-money institutions in Cyprus, that means the Central Bank of Cyprus.

The legal basis

The obligation comes from the Digital Operational Resilience Act, Regulation (EU) 2022/2554, which has applied since 17 January 2025. As a regulation, it applies directly in every Member State, with no national transposition needed. Three further acts fill in the detail:

• Delegated Regulation (EU) 2024/1772 sets the criteria for classifying an incident as major.
• Delegated Regulation (EU) 2025/301 sets the content of the reports and the time limits.
• Implementing Regulation (EU) 2025/302 sets the standard forms and templates.

Three reports, three clocks

• Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it. If classification happens after that point, the 4 hours run from classification.
• Intermediate report: within 72 hours of the initial notification, even if nothing has changed. It is updated when regular activities are recovered, and when the status changes significantly.
• Final report: within one month of the latest intermediate report, with the root cause and the actual impact.

If a deadline falls on a weekend or public holiday, entities can generally report by noon on the next working day. That concession does not cover initial and intermediate reports from credit institutions, central counterparties, trading venue operators, or entities identified as essential or important under NIS2.

Who receives the reports

Under Article 46 of DORA, it depends on what you are. In Cyprus, banks, payment institutions and e-money institutions report to the Central Bank of Cyprus. Significant banks report through the national authority, which immediately passes the report to the European Central Bank. Investment firms and crypto-asset service providers report to CySEC, and insurers to the Superintendent of Insurance. Check the current submission channel and templates with your own authority, since these are updated from time to time.

Four hours is not long. The decisions about who classifies, who signs off and who submits need to be made before the incident, not during it.

It is not only about incidents

DORA also requires regular reporting on your ICT suppliers. Article 28(3) requires reports at least yearly on your ICT third-party arrangements, using the Register of Information templates in Implementing Regulation (EU) 2024/2956, with the date set by your authority. Article 11(10) adds an estimate of annual costs and losses from major incidents on request. CySEC, for example, now expects this yearly by 30 June from the firms it supervises that had major incidents.

What to have ready

• Classification criteria your team can apply quickly, at any hour
• A named on-call owner and a deputy for each reporting stage
• Current templates, and tested access to your authority's submission channel
• A sign-off process that works outside office hours
• A plan for telling clients, since those whose financial interests are affected must be informed without undue delay
• A rehearsal: run the full sequence in a tabletop exercise at least once

Can someone else file for you?

Yes. Article 19(5) allows reporting to be outsourced to a third-party provider, but your organisation remains fully responsible for it. A vCISO or consultant can prepare and coordinate the reports under an agreed sign-off process.

See the full reporting requirements on our Cyber Security page.

This article is general information, not legal advice.