Joint EBA, ESMA and EIOPA Guidelines on the Estimation of Aggregated Annual Costs and Losses Caused by Major ICT-Related Incidents under DORA (JC 2024 34)

4 March 2026
Ref.: 2602031

Circular no.: 8/2026
To: Commercial banks, savings banks, lending companies, payment institutions, electronic money institutions, securities firms, management companies of securities funds, pension funds, licensed operators of specialised funds, insurance companies, virtual asset service providers, central securities depositories, trading venues, the Icelandic Financial Services Association and the Icelandic Pension Funds Association

Subject: Joint guidelines of the EBA, ESMA and EIOPA on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under DORA (JC 2024 34)

The European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA) have issued joint guidelines regarding the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), cf. Act no. 78/2025 on digital operational resilience for the financial market.1

According to the 10th paragraph of Article 11 of DORA, financial entities other than microenterprises shall provide competent authorities, upon their request, with a report on the estimation of aggregated annual costs and losses caused by major ICT-related incidents. The guidelines are issued on the basis of the 11th paragraph of the same Article, which entrusts the European supervisory authorities with issuing guidelines that further specify the estimation.

The guidelines are addressed to competent authorities and financial entities under DORA, other than microenterprises. The guidelines are also addressed to pension funds in Iceland pursuant to Article 36 g of Act no. 129/1997 on mandatory pension insurance and the activities of pension funds. The guidelines entered into force within the EU on 19 May 2025, while the DORA Regulation entered into force in Iceland on 1 January 2026, cf. the Act on digital operational resilience for the financial market.

The guidelines are intended to ensure a consistent methodology for estimating the aggregated annual costs and losses due to major ICT-related incidents that entities must report to competent authorities pursuant to Article 19 of DORA. The guidelines further specify how entities are to estimate the costs and losses falling within a specified reference period, which may be a calendar year or a financial year. The guidelines also contain a template that entities are to use when providing information to competent authorities, should they request it.

According to the 3rd paragraph of Article 16 of Regulations of the European Parliament and of the Council (EU) no. 1093-1095/2010 on European supervisory authorities for the financial market, which were transposed into Icelandic law by

[1] Joint Guidelines (JC 2024 34) on the on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554

Act no. 24/2017 on the European supervisory system for the financial market, competent authorities and the relevant supervised entities shall make every effort to comply with the guidelines of the supervisory authorities and general recommendations. The purpose of the guidelines is to establish consistent, efficient and effective supervisory practices within the European financial system, as well as to ensure the common, uniform and consistent application of legislation within the European Economic Area.

The Financial Supervisory Authority therefore directs the recipient of this circular to familiarise itself with the aforementioned EBA guidelines and take them into account in its activities, as applicable. The Financial Supervisory Authority will later request information on entities' estimation of estimated costs and losses due to major incidents in accordance with Article 11 of DORA with a request for data thereon.

This circular will be published on the Central Bank's website together with a link to the English version of the guidelines. The Financial Supervisory Authority will also rely on the guidelines in its supervisory practices.

Yours faithfully,
CENTRAL BANK OF ICELAND

Kristín Logadóttir
Director
Prudential Supervision

Ása Magnúsdóttir
Specialist
Prudential Supervision