Art. 2 Reputational impact | RTS on incident classification | DORA

This article defines how financial entities should determine whether an ICT incident has caused a reputational impact, which is one of the criteria used under Article 18(1) of DORA to classify and assess incidents.

It sets out a list of qualifying conditions — any one of which is sufficient to confirm that reputational harm has occurred — and adds a layer of nuance by requiring entities to factor in the level of visibility the incident has gained or is likely to gain.

Important points:

Assess whether at least one reputational impact criterion has been met — media coverage, repetitive client complaints, inability to meet regulatory requirements, or likely loss of clients or financial counterparts with material business impact.
Consider the visibility of the incident, both actual and potential, when making your reputational impact assessment.
This article feeds directly into the broader incident classification framework under Article 9, where reputational impact is one of the materiality thresholds that can trigger major incident status.

1. For the purposes of determining the reputational impact of the incident as referred to in Article 18(1), point (a), of Regulation (EU) 2022/2554, financial entities shall consider that a reputational impact has occurred where at least one of the following criteria is met:
  1. the incident has been reflected in the media;
  2. the incident has resulted in repetitive complaints from different clients or financial counterparts on client-facing services or critical business relationships;
  3. the financial entity will not be able to or is likely not to be able to meet regulatory requirements as a result of the incident;
  4. the financial entity will or is likely to lose clients or financial counterparts with a material impact on its business as a result of the incident.
1. When assessing the reputational impact of the incident, financial entities shall take into account the level of visibility that the incident has gained or is likely to gain in relation to each criterion listed in paragraph 1.