art_18__para_1

1. Financial entities shall classify ICT-related incidents and shall determine their impact based on the following criteria: the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, and whether the ICT-related incident has caused reputational impact; the duration of the ICT-related incident, including the service downtime; the geographical spread with regard to the areas affected by the ICT-related incident, particularly if it affects more than two Member States; the data losses that the ICT-related incident entails, in relation to availability, authenticity, integrity or confidentiality of data; the criticality of the services affected, including the financial entity’s transactions and operations; the economic impact, in particular direct and indirect costs and losses, of the ICT-related incident in both absolute and relative terms.

← Article 18 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.