ESAs publish study on feasibility of further centralisation of major ICT-related incident reporting by financial entities

Purpose:
The European Supervisory Authorities (EBA, EIOPA, and ESMA) have published a joint report on the feasibility of further centralising the reporting of major ICT-related incidents by financial entities in line with Article 21 of the Digital Operational Resilience Act (DORA). The purpose of this report is to assess the potential benefits and challenges of three different models for centralising major ICT-related incident reporting, including a baseline model, an enhanced data sharing arrangement model, and a fully centralised model.

Effects on Industry:
The proposed centralisation of major ICT-related incident reporting by financial entities may have significant effects on the industry, including reduced burden and costs, as well as improved efficiency and effectiveness gains for cross-sector supervisory practices. The report highlights that the three models assessed may bring varying levels of benefits, with the fully centralised model offering the most substantial reductions in costs and burdens. However, it also notes that the enhanced data sharing arrangement model could provide significant efficiencies without sacrificing data quality.

Relevant Stakeholders:
The stakeholders affected by this update include financial entities, competent authorities, and industry associations. Financial entities would be required to comply with new reporting requirements, while competent authorities would need to adapt their supervisory practices to take advantage of the centralised reporting models. Industry associations may also be impacted as they navigate the changing regulatory landscape.

Next Steps:
The joint report has been submitted to the European Parliament, the European Council, and the European Commission for consideration. The next steps involve reviewing the findings and potential future developments in relation to further centralising major ICT-related incident reporting in the financial sector. This may involve further consultations with stakeholders, assessment of feasibility studies, or implementation of new regulations.

Any Other Relevant Information:
The report was prepared jointly by the ESAs in accordance with Article 21 of DORA, drawing on input from competent authorities and stakeholders groups. The ESAs consulted with a renowned IT strategy firm and engaged with the European Central Bank (ECB) and ENISA while drafting the report. This level of consultation ensures that the findings are based on thorough analysis and consideration of various perspectives.