art_19__para_6

6. Upon receipt of the initial notification and of each report referred to in paragraph 4, the competent authority shall, in a timely manner, provide details of the major ICT-related incident to the following recipients based, as applicable, on their respective competences: EBA, ESMA or EIOPA; the ECB, in the case of financial entities referred to in Article 2(1), points (a), (b) and (d); the competent authorities, single points of contact or CSIRTs designated or established in accordance with Directive (EU) 2022/2555; the resolution authorities, as referred to in Article 3 of Directive 2014/59/EU, and the Single Resolution Board (SRB) with respect to entities referred to in Article 7(2) of Regulation (EU) No 806/2014 of the European Parliament and of the Council (37), and with respect to entities and groups referred to in Article 7(4)(b) and (5) of Regulation (EU) No 806/2014 if such details concern incidents that pose a risk to ensuring critical functions within the meaning of Article 2(1), point (35), of Directive 2014/59/EU; and other relevant public authorities under national law.

← art_19__para_5 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-12 · Text as adopted (Official Journal); later amendments are not incorporated in this text.