Source: OJ L 333, 27.12.2022, pp. 164–198

Current language: EN

Article 22 Penalties


Summary What does Article 22 of the CER directive say?

This article addresses the enforcement side of the Directive by requiring Member States to establish their own penalty regimes for non-compliance with national measures adopted under this Directive.

Rather than setting specific penalties at EU level, the Directive leaves the design of those penalties to each Member State, while mandating that they meet three core qualities: they must be effective, proportionate and dissuasive.

Member States are also required to keep the Commission informed of their penalty frameworks and any changes to them.

Important points:

  • Member States are required to establish and implement penalty rules for infringements of national measures adopted under this Directive.
  • Penalties must be effective, proportionate and dissuasive.
  • Member States must notify the Commission of their penalty rules and measures by 17 October 2024, and notify any subsequent amendments without delay.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

Member States shall lay down the rules on penalties applicable to infringements of the national measures adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, by 17 October 2024, notify the Commission of those rules and of those measures and shall notify it, without delay, of any subsequent amendment affecting them.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod