Circular No. 33/2025: Notifications of Serious Incidents under the Act on Digital Operational Resilience for the Financial Market (DORA)

22 December 2025
Ref.: 2512136

Circular no.: 33/2025
To: Commercial banks, savings banks, lending companies, payment institutions, electronic money institutions, securities firms, management companies of securities funds, pension funds, licensed operators of specialized funds, insurance companies, virtual asset service providers, securities depositories, trading venues, the Association of Companies in Financial Services and the National Association of Pension Funds

Subject: Notifications of serious incidents on the basis of the Act on Digital Operational Resilience for the Financial Market (DORA)

The Financial Supervisory Authority of the Central Bank of Iceland draws attention to changes that will occur in notifications of serious incidents related to information and communication technology upon the entry into force of Act no. 78/2025 on Digital Operational Resilience for Financial Markets, which enter into force on 1 January 2026. With the Act, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) is implemented.1

Upon the entry into force of the Act, the Financial Supervisory Authority will adopt a new template for notifications of serious incidents that takes into account the requirements under DORA.2 The reporting has been simplified and the number of fields that must be filled in in the template has decreased from 84 to 59. Furthermore, there are only seven mandatory fields in the initial notification, as it is important that entities place emphasis on responding to an incident in its first stages. Entities are still required to submit three reports for each incident, i.e. an initial notification, an intermediate report and a final report, but a change is made to the deadline for submitting the final report. The final report shall be submitted no later than one month after the submission of the intermediate report, whereas previously there was a requirement that the final report be submitted no later than 20 days after the intermediate report was submitted. The initial notification shall still be submitted within four hours after an incident is classified as serious, though no later than 24 hours after the incident occurred. The intermediate report shall be submitted 72 hours after the initial notification was sent.

With the entry into force of the Act, the criteria for classifying serious incidents change. Until now, the criteria have been set out in guidelines no. 4.1.13. on notification of deviations according to guiding recommendations 1/2019, cf. circular 39/2023.3 From 1 January 2026, the guiding recommendations and the guidelines will not apply to those entities that fall under the requirements of DORA, where criteria for serious incidents are defined. The Financial Supervisory Authority directs parties subject to notification obligations to familiarize themselves well with the changed criteria.4

Two new submission cases have been established in the Central Bank's data submission system. On the one hand, a submission case for a report on serious incidents pursuant to the first paragraph of Article 19 of DORA, (“Notification of serious incident (DORA))”, identifier: F612) and on the other hand a submission case for an optional report on a significant

[1] Act on Digital Operational Resilience for the Financial Market. | Official Gazette

[2] Regulation (EU) 2025/302 on standard forms, templates and procedures for notifications of serious incidents and significant cyber threats

[3] Circular no. 39/2023, dated 22 November 2023

[4] Regulation (EU) 2024/1772 on criteria for the classification of incidents and cyber threats and their severity and the content of notifications

cyber threat pursuant to the second paragraph of the same Article (“Notification of significant cyber threat (DORA))”, identifier: F613).

On the Central Bank's website, templates can be found for a report on serious incidents and for a report on a significant cyber threat, see here: Central Bank of Iceland | Digital Operational Resilience in the Financial Market (DORA), in addition to which the templates are accessible in the data submission system. The new submission cases replace older submission cases for deviation notifications and have been placed in the same access groups with submitting parties that were required to submit them. Other submitting parties need to assign the cases to the appropriate access group so that they become accessible to users in the data submission system.

Yours faithfully,
CENTRAL BANK OF ICELAND

Gísli Óttarsson
Managing Director
Prudential Supervision

Sveinbjörn Blöndal
Risk Specialist
Prudential Supervision