Commission Delegated Regulation (EU) 2025/301 on regulatory technical standards for major ICT-related incident notifications

The European Commission adopts regulatory technical standards specifying the content and time limits for financial entities to notify major ICT-related incidents and significant cyber threats. Financial entities must submit initial notifications within four hours of classifying an incident as major or within 24 hours of awareness, followed by intermediate reports within 72 hours and final reports within one month. The regulation mandates specific data points for initial, intermediate, and final reports, while defining limited content for voluntary notifications of significant cyber threats. These requirements apply to all financial entities under Regulation (EU) 2022/2554, with specific exclusions from weekend extensions for essential and important entities.

Get EC alerts — same-day email on every new publication.

EUR-Lex

Access to European Union law

This document is an excerpt from the EUR-Lex website

You are here

EUROPA

EUR-Lex home

Delegated regulation - EU - 2025/301 - EN - EUR-Lex

Help

Quick search

Use quotation marks to search for an "exact phrase". Append an asterisk ( * ) to a search term to find variations of it (transp * , 32019R * ). Use a question mark ( ? ) instead of a single character in your search term to find variations of it (ca ? e finds case, cane, care).

Read the rest free, and get an email when EC publishes again

Email me when EC publishes something newOne email per publication, same day. Sign in below to keep reading.

Lineage: In force

amendssupersedesissued underrefers toproposed or not in RegAlertarrows run from the older text to the one that changes it

Source: European Commission — original document · Summary generated with machine assistance and reviewed before publication; the authoritative text is the regulator's original document. How RegAlert works