Classifying major ICT-related incidents under DORA and reporting them on time

DORA incident reporting under Chapter III of the regulation (Articles 17 to 23) applies equally to financial entities under the full framework and under the simplified framework of Article 16. For the KWG group, meaning factoring and finance leasing firms, guarantee banks and the other institutions under Section 1a(2a) KWG, it has applied under Section 65a(3) sentence 2 KWG since 17 January 2025, although the rest of the DORA framework only applies to them from 1 January 2027. This page covers classification, deadlines, the reporting channel and an exercise.

What is a major ICT-related incident?

An incident is major if it affects services that are critical under Article 6 of Commission Delegated Regulation (EU) 2024/1772 and also reaches certain materiality thresholds. The test has two stages (Article 8(1)):

1. Criticality of services affected (Article 6): the incident affects (a) ICT services or systems that support critical or important functions, (b) financial services that require authorisation or registration or are supervised, or (c) it is a successful, malicious and unauthorised access to the network and information systems. The wording sets no minimum number. In its FAQ, BaFin assumes criticality when two of these three criteria are met. That is BaFin's reading, the RTS does not say so.
2. Thresholds (Article 9): either the threshold of Article 9(5)(b) is reached (successful, malicious and unauthorised access that may result in data losses), or two or more of the other thresholds are reached.

Where figures cannot be determined with certainty, the regulation requires estimates. For the first stage you need an up-to-date list of your critical or important functions, otherwise Article 6(a) cannot be checked.

Recurring incidents: under Article 8(2), incidents that are not major individually count together as major if they occur at least twice within six months with the same apparent root cause and together meet the criteria. This has to be checked monthly. The rule does not apply to microenterprises and to the financial entities referred to in Article 16(1) DORA. Whether the KWG group is among them is not settled in the sources. We recommend evaluating recurring incidents monthly anyway.

Which deadlines apply to DORA incident reporting?

The deadlines are set out in Article 5 of Commission Delegated Regulation (EU) 2025/301:

Four further rules are often missing in practice:

• Deadline cannot be met: anyone who cannot meet a deadline informs BaFin without undue delay, and no later than within the deadline, giving reasons (Article 5(3)).
• Combining reports: several reporting stages may be submitted together if the deadlines are met and regular activities have been restored or the root cause analysis has been completed (Commission Implementing Regulation (EU) 2025/302, Article 2).
• Reclassification: if a reported incident turns out not to be major, you inform BaFin of the reclassification (Article 5 of the Implementing Regulation).
• Clients: if a major incident affects the financial interests of clients, they must be informed without undue delay (Article 19(3) DORA).

Does the weekend rule also apply to factoring and leasing?

If a deadline falls on a weekend or a public holiday, the report may in principle be submitted by 12 noon on the next working day (Article 5(4)). For initial notifications and intermediate reports this does not apply to credit institutions, central counterparties, operators of trading venues and financial entities that are essential or important entities under NIS2 (paragraph 5). The authority can also exclude the relief for significant or systemic financial entities (paragraph 6). For the final report, the weekend rule remains available in these cases too.

For the KWG group the question is open. Section 1a(2a) KWG has these institutions apply the Level 2 acts “as if these institutions were CRR credit institutions”, and the relief is excluded for initial notifications and intermediate reports of credit institutions. We have not found a statement by BaFin on this. We therefore do not promise the weekend relief to factoring, leasing and other institutions in the KWG group, and we recommend being able to submit initial notifications and intermediate reports on time at weekends and on public holidays as well.

How and where do you report?

In Germany you report through BaFin's reporting and publishing platform (MVP). It is the secure electronic channel within the meaning of Article 4 of Commission Implementing Regulation (EU) 2025/302. The form has four sections: general information (fields 1.1 to 1.15), initial notification (2.1 to 2.10), intermediate report (3.1 to 3.35) and final report (4.1 to 4.16). BaFin explains every field in its completion guidance (as of 15 May 2026). To be settled in advance: times in the form are given in UTC, and every report contains the LEI code and the contact details of the persons who communicate with BaFin about the incident.

Providers: ICT third-party service providers have no reporting obligation of their own under DORA (they may have their own obligations, for example under NIS2 or the German Telecommunications Act (TKG), see NIS2-Readiness). If an incident at your provider causes a major incident at your firm, you report it. You may outsource the reporting itself to a provider, but the responsibility stays with you (Article 19(5) DORA). BaFin must be informed of the third party's name, contact details and identifier no later than before the first report. So that you learn about incidents at the provider in time, assistance with ICT incidents belongs in the contract (Article 30(2) DORA, for the KWG group from 1 January 2027).

What about significant cyber threats?

You may report significant cyber threats to BaFin on a voluntary basis (Article 19(2) DORA), there is no obligation. Under Article 10 of Commission Delegated Regulation (EU) 2024/1772, a threat is significant if it could affect critical or important functions, other financial entities, providers or clients, has a high probability of materialising and, if it materialised, could meet the criticality of services or the threshold for clients and transactions or for geographical spread. The content of the notification is governed by Article 6 of Commission Delegated Regulation (EU) 2025/301.

Example: classification sheet for an incident at the software provider

Fictitious example, not a client. Muster-Leasing GmbH is a finance leasing firm with 2,400 lessees, 1,900 of whom use the customer portal. Contract management and the customer portal run as software as a service at a provider in Germany and support critical or important functions. On Friday, 13 November 2026, both services fail at 18:30, and the IT on-call team learns of it at 18:40. At 20:15 the provider reports an attack with encryption, and at 22:30 it confirms unauthorised access, data exfiltration cannot be ruled out. The incident manager's sheet:

The deadlines in this example are our own calculation based on the wording. Classification was possible at 20:30, when the second threshold was reached. Waiting with it until further criteria are met does not move the deadline: the initial notification is to be submitted as early as possible (Article 5(1)(a) of Commission Delegated Regulation (EU) 2025/301). The provider has no reporting obligation of its own under DORA, the institution submits the report.

Data protection: where personal data is involved, as here, the institution checks in parallel the notification to the data protection authority under Article 33 GDPR (without undue delay, where feasible within 72 hours) and, where there is likely to be a high risk to the data subjects, their notification under Article 34 GDPR. The DORA report does not replace these obligations.

Exercise script: a reporting exercise in two hours

DORA does not expressly require a reporting exercise. DORA requires the incident process anyway (Article 17, under the Article 16 framework also Article 16(1)(d)), and Article 16(1)(g) requires testing of the business continuity plans and of the controls. The reporting exercise is our recommendation for testing both together. The script is a recommendation by Blackfort Technology for a tabletop exercise, using the incident from the example on a simulated Friday evening.

Roles: exercise lead (plays the provider, press and clients), incident manager, deputy, management board, IT on-call team, provider management, communications, data protection. Preparation: function list, the sheet as a template, LEI code and contact details, the MVP form fields as an offline copy. Nothing is sent to BaFin.

The record with actions, owners and dates is the evidence of the exercise. We recommend repeating it after major changes and at least once a year.

Three typical gaps

How we can help

For institutions in the KWG group, a review of the reporting process and a reporting exercise are part of the service for the transition from BAIT (BaFin's supervisory requirements for IT in banks) to Article 16. Anyone who first wants to have it checked whether the existing reporting process meets the requirements starts with the DORA gap analysis. What the simplified framework requires apart from incident reporting is set out on the page on DORA Article 16.