Article 23Operational or security payment-related incidents concerning credit institutions, payment institutions, account information service providers, and electronic money institutions
The requirements laid down in this Chapter shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions, payment institutions, account information service providers, and electronic money institutions.
DORA, the European Union regulation on digital operational resilience, Article 23
One sentence extending Chapter III sideways. Its requirements also apply to operational or security payment-related incidents, and to major ones, where they concern credit institutions, payment institutions, account information service providers and electronic money institutions.
The effect is that these entities handle payment-related incidents inside the same incident process, so Articles 17 to 20 and their technical standards apply to them. This article does not itself mention the older payment-services rules. The companion Directive (EU) 2022/2556 added a paragraph to Article 96 of the Payment Services Directive (Directive (EU) 2015/2366), so that paragraphs 1 to 5 of that Article, which cover incident reporting, do not apply to these entities. Check the current texts and the entity’s own authority, because the national reporting route can differ.
Note the wording: the Article covers payment-related incidents that are operational or security in nature, which is wider than events described as ICT-related incidents.
What is in the packs for this
From DORA ICT Risk & Resilience Readiness. Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
Requirement Library rows RQ-31: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
Readiness items IM-02 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
DORA Documentation & Evidence ChecklistExcel
Evidence records EV-20: the records a supervisor can ask for under the provision, with who keeps them and for how long.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.