DORA vs PSD2 incident reporting

Financial entities under DORA, including payment institutions, electronic money institutions, account information service providers, credit institutions, and other listed financial entities when an ICT-related incident affects their services, operations, clients, counterparts, data, or critical functions.

Payment-service operational or security incidents for payment service providers. For payment service providers that are within DORA, the supported rule is that PSD2 incident reporting gives way to DORA reporting for those incidents.

For a DORA-scoped payment service provider, classify the incident under DORA first and preserve a payment-related incident label where the facts show payment-service operational or security impact.

DORA uses the financial-entity scope in Article 2 and Article 23. The payment-service fallback matters only for credit institutions, payment institutions, account information service providers, and electronic money institutions that are inside DORA.

PSD2 is the fallback reporting route for payment service providers that are not in DORA scope. DORA Article 23 says the PSD2 reporting requirement stops only for in-scope firms.

First check DORA scope. If the firm is covered by DORA, use DORA reporting for major payment-related incidents; if not, keep using the PSD2 regime.

DORA has specified clocks: initial report as early as possible, within four hours after major classification and no later than 24 hours after awareness; intermediate report within 72 hours after the initial notification; final report within one month after the intermediate report or latest updated intermediate report.

For firms outside DORA, the PSD2 payment-incident trigger remains the relevant route because Article 23 only displaces PSD2 reporting for DORA-scoped payment service providers.

Use the DORA clock for in-scope payment service providers and keep the awareness time, classification time, submission time, and any delay explanation in the incident file.

DORA uses standard templates for initial, intermediate, and final reports, with data fields completed according to the reporting stage and submitted through the secure electronic channels made available by the competent authority.

PSD2 reporting can still apply for payment-service firms that are outside DORA. This page should not be read as saying PSD2 disappears for all payment incidents.

Build one report workspace around the DORA template, but switch to PSD2 forms only when the firm is outside DORA scope.

Keep DORA classification evidence, incident logs, affected clients and transactions, downtime, Member State impact, data-loss assessment, critical-service impact, cost and loss estimates, business-continuity activation, report templates, and final root-cause and remediation evidence.

Keep PSD2 evidence for out-of-scope payment incidents, including the payment-service impact, the applicable PSD2 trigger, and any separate national reporting steps.

Use shared facts, but label each item. One incident file can support both views only if it shows the DORA classification basis and the payment-service impact separately.

DORA reports go to the relevant competent authority. Where an entity is supervised by more than one national competent authority, Member States designate a single competent authority for Article 19 reporting. Significant credit institutions report to the national competent authority, which transmits the report to the ECB.

PSD2 timing still matters for payment-service providers that are not in DORA scope, because Article 23 only removes the PSD2 route for payment service providers that fall within DORA.

Do not send duplicate reports just because an entity has multiple authorisations. Confirm the DORA relevant competent authority, and if the firm is outside DORA, use the PSD2 route instead.

DORA empowers competent authorities to supervise and sanction breaches of the DORA reporting regime for in-scope financial entities.

PSD2 remains relevant for payment-service firms outside DORA scope, so enforcement follows the regime that still applies to the firm.

Use the enforcement route that matches scope: DORA for in-scope firms, PSD2 for out-of-scope payment-service providers.

One incident can sit in both ICT and payment files, but DORA and PSD2 should not be treated as interchangeable. DORA Article 23 is a scope rule, not a blanket replacement for all payment incidents.

If the firm is outside DORA, PSD2 still does the reporting work. If the firm is inside DORA, use the DORA reporting chapter for payment-related incidents.

Do not duplicate the legal analysis. First decide scope, then decide which reporting regime applies.

If the firm is inside DORA, classify the incident under DORA and use the DORA report stages, templates, and competent authority route.

If the firm is outside DORA, continue with PSD2 payment-incident reporting and any related national reporting steps.

Start with scope. DORA displaces PSD2 only for payment service providers that fall within DORA.