Source: OJ L, 2025/302, 20.2.2025

Current language: EN

Article 2 Joint submission of initial notification, intermediate and final reports


Summary What does Article 2 of the ITS on templates for incident reporting say?

This brief article provides a practical flexibility for financial entities when submitting their incident reports.

Rather than always submitting the initial notification, intermediate report, and final report as three separate submissions, entities may consolidate two or all three into a single submission under certain conditions.

This article acts as a complement to Article 1, which sets out the general reporting obligations and templates, by carving out a limited exception to the default sequential reporting process.

Important points:

  • Combine two or all three reporting submissions into one where regular activities have recovered or root cause analysis has been completed.
  • The time limits set out in Article 5 of Delegated Regulation (EU) 2025/301 must still be met, even when combining submissions.
  • This flexibility is available to financial entities, but only when the specified conditions are satisfied.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

Financial entities may combine the submission of the initial notification, the intermediate report, and the final report to provide two or all of those at the same time, where regular activities have recovered or the root cause analysis has been completed and provided that the time limits set out in Article 5 of Delegated Regulation (EU) 2025/301 are met.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod