Regulation 2022
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)
Plain-English summary
Finanstilsynet states that DORA applies directly to covered financial entities from 17 January 2025. Chapter III covers reporting of major ICT-related incidents to Finanstilsynet, and the register of information on ICT third-party arrangements (Art. 28(3)) is submitted annually on a separate Finanstilsynet page. The related Directive (EU) 2022/2556 was implemented in Denmark on 1 July 2024.
Who it applies to
Banking · Insurance · Capital Markets · Asset & Wealth Management · Payments & Fintech · Crypto / VDA
Topics
Cybersecurity & IT Risk Operational Risk & Outsourcing
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Major ICT-related incident reporting under DORA | Deadline Initial: within 4 hours of classification and no later than 24 hours after awareness; intermediate: within 72 hours; final: within one month | — | official | |
Finanstilsynet states that major ICT-related incidents must be reported through Virk.dk: an initial notification as soon as possible and within 4 hours of classifying the incident as major, but no later than 24 hours after becoming aware of it; an intermediate report within 72 hours of the initial notification; and a final report within one month of the latest intermediate update. Cites DORA Articles 11(10), 19(1), 19(4) and 22(2) and Delegated Regulations (EU) 2024/1772 and 2025/301. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.