Article 23Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions
What it says
The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions, payment institutions, account information service providers, and electronic money institutions.
DORA, the European Union regulation on digital operational resilience, Article 23
What it means in practice
One sentence extending Chapter III sideways. Its requirements also apply to operational or security payment-related incidents, and to major ones, where they concern credit institutions, payment institutions, account information service providers and electronic money institutions.
The effect is that these entities handle payment-related incidents inside the same incident process, so Articles 17 to 20 and their technical standards apply to them. This article does not itself mention the older payment-services rules. The companion Directive (EU) 2022/2556 added a paragraph to Article 96 of the Payment Services Directive (Directive (EU) 2015/2366), so that paragraphs 1 to 5 of that Article, which cover incident reporting, do not apply to these entities. Check the current texts and the entity’s own authority, because the national reporting route can differ.
Note the wording: the Article covers payment-related incidents that are operational or security in nature, which is wider than events described as ICT-related incidents.
What is in the packs for this
From DORA ICT Risk & Resilience Readiness. Each one helps with this requirement.
- Excel
DORA Article-to-Control Mapping Library
Requirement Library rows RQ-31: Payment-related incidents. Each gives the provision in plain words, what to show and the documents that help. - Excel
DORA Readiness Self-Assessment
Readiness items IM-02: Major incidents can be reported on time. Each rates how ready the entity is, with the evidence and the gap. - Excel
DORA Documentation & Evidence Checklist
Evidence records EV-20: The reporting log, with a copy of every report and its time (P18). Each lists the records a supervisor can ask for.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.