DORA major incident reports: what the ESAs' staff instructions expect

A five-page document of operational instructions on DORA incident reporting, dated 16 September 2026, has been published on ESMA's website. Its aim is to help competent authorities when they engage with financial entities about major ICT-related incident reports under the Digital Operational Resilience Act, Regulation (EU) 2022/2554, so that the data reported are of better quality and reporting is more consistent from one jurisdiction to another.

Financial entities report a major incident to their competent authority through the channels, templates and format set at national level; competent authorities then notify the ESAs using pre-defined templates in English. The instructions refer to the reporting templates in Implementing Regulation (EU) 2025/302, the content and time limits in Delegated Regulation (EU) 2025/301 and the classification criteria in Delegated Regulation (EU) 2024/1772. They are provided by ESAs staff on a best-efforts basis, are not a legal interpretation or an official stance of the ESAs, were agreed with the relevant competent authorities and will be updated regularly.

Monetary fields 3.11, 4.13 and 4.14 are reported in thousands of units, in the currency given in field 1.15: an amount of EUR 2,500 is reported as 3 (or 2.5 with further precision). Free-text fields should contain only information relevant to the field, and a field that is neither mandatory nor applicable is best left blank rather than filled with words such as 'not applicable'. The national language can still be used in free-text fields.

The final report is due no later than one month after the intermediate report or the latest updated intermediate report, so at least one intermediate report a month is expected until the final report. A correction is submitted as a new version of the latest report (for example, a corrected intermediate report) and should contain all the information from the latest update. The values in fields 1.3a, 1.3b and 2.1, which identify the incident, should remain unchanged from the initial notification to the final report, to avoid double counting.

Every report should list 'critical services affected' explicitly among the classification criteria in field 2.5, for consistency. Under Delegated Regulation (EU) 2024/1772 an incident is major only where critical services are affected and at least one other condition is met, so this criterion is always fulfilled. The country of the affected financial entity should not be included in the geographical spread in field 2.6.

Where an incident originates from a third-party provider or another financial entity, field 2.8 should give, separated by semicolons and in this order, the full legal name, the LEI or EUID, the type of code and any other relevant information. Field 3.17 (whether duration and downtime are actual or estimated) is expected in both intermediate and final reports, the fields for resolution authorities are completed only where they apply (field 4.10 where the incident poses a risk to critical functions, field 4.11 where it has affected resolvability), and field 4.12 on the economic-impact threshold is always reported in final reports where economic impact is a classification criterion. For field 3.25, the wording 'data exfiltration and manipulation, excluding identity theft' is taken as the reference.