3. Joint Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents

This document contains Joint Guidelines issued pursuant to Article 16 of Regulation (EU) No 1093/2010² ; Article 16 of Regulation (EU) No 1094/2010³ ; and Article 16 of Regulation (EU) No 1095/2010⁴ - ‘the ESAs’ Regulations’. In accordance with Article 16(3) of the respective ESAs’ Regulations, competent authorities and financial institutions must make every effort to comply with the Guidelines.

Joint Guidelines set out the ESAs’ view of appropriate supervisory practices within the European System of Financial Supervision or of how Union law should be applied in a particular area. Competent authorities to whom the Joint Guidelines apply should comply by incorporating them into their supervisory practices as appropriate (e.g. by amending their legal framework or their supervisory processes), including where the Joint Guidelines are directed primarily at institutions.

² Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC, (OJ L 331, 15.12.2010, p.12)

³ Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC, ( OJ L 331, 15.12.2010, p. 48–83)

⁴ Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC, (OJ L 331, 15.12.2010, p. 84–119)

In accordance with Article 16(3) of the ESAs’ Regulations, competent authorities must notify the respective ESA whether they comply or intend to comply with these Joint Guidelines/Recommendations, or otherwise with reasons for non-compliance, by 19.05.2025. In the absence of any notification by this deadline, competent authorities will be considered by the respective ESA to be non-compliant. Notifications should be sent to compliance@eba.europa.eu, compliance@eiopa.europa.eu and DORA@esma.europa.eu with the reference ‘JC/GL/2024/34’. A template for notifications is available on the ESAs’ websites. Notifications should be submitted by persons with appropriate authority to report compliance on behalf of their competent authorities.

Notifications will be published on the ESAs’ websites, in line with Article 16(3).

Subject matter and Scope of application

Date of application

Title III- Provisions on the estimation of aggregated annual costs and losses of major ICT-related incidents

Name of the financial entity

Legal Entity Identifier

Start and end date of the reference year of the financial entity

Currency

Number of Date of the Incident Gross costs and losses Recoveries of the incident submission of the reference of the incident in the incident in the final incident report number reference year (1000s of reference year units) (1000s of units)

1

2

…

Total for ----------- -----------reference year