Article 4 Use of secure electronic channels

This short, procedural article sets out the channel requirements for submitting major ICT-related incident notifications and reports.

The default rule is straightforward: financial entities must use the secure electronic channels provided by their competent authority.

It also provides a contingency arrangement for situations where those channels are unavailable, ensuring reporting obligations can still be met without disruption.

Important points:

• Submit all initial notifications and intermediate and final reports through the secure electronic channels provided by your competent authority.
• If those channels are unavailable, notify the competent authority of the major ICT-related incident through other secure means agreed with that authority.
• Competent authorities may require financial entities to resubmit reports through the official secure electronic channel once access is restored.