Voluntary notification of significant cyber threats (DORA)
The option under DORA Article 19(2) to report a significant cyber threat to the authority before any incident occurs, paired in paragraph 3 with a duty to tell exposed clients about useful protective measures.
Voluntary notification of a significant cyber threat is the report a financial entity may send its competent authority under DORA before any incident has occurred. Article 19(2) of Regulation (EU) 2022/2554 (DORA) opens a box nobody is obliged to tick: the entity notifies when it considers the threat relevant to the financial system, service users or its clients. Article 3 defines a significant cyber threat as one whose technical characteristics indicate it could result in a major incident. The authority may pass the information to the other authorities referred to in paragraph 6; a significant credit institution goes through its national authority, which forwards it immediately to the ECB (European Central Bank). Each Member State may also provide for a parallel filing with the NIS2 CSIRTs (computer security incident response teams). The content of the notification falls under Delegated Regulation (EU) 2025/301, the form under Implementing Regulation (EU) 2025/302. Paragraph 3 carries two duties toward clients. When a major incident affects their financial interests, the entity informs them without undue delay of the incident and of the measures taken to mitigate it. When facing a significant cyber threat, it informs potentially affected clients, where applicable, of protective measures they could take themselves. On the insurance side, a threat has not caused a loss. Most cyber policies trigger on an actual or suspected security event. The cost of investigating a phishing campaign that spoofs the brand, getting clone sites taken down or writing to forty thousand clients often falls outside the response costs section. The notification costs section, for its part, is frequently drafted around personal data. Wording that reaches any notice required by law or regulation catches the paragraph 3 message once an incident exists. At renewal, the voluntary notification is a dated document: the threat reported can become a known circumstance the new policy excludes. One caveat: notifying the authority does not count as a notice of circumstances to the carrier, which follows its own clause and its own deadline.
Textbook case: a fictional asset manager with 40,000 clients spots twelve clone sites imitating its client portal. It notifies the threat to its authority and writes to every client telling them never to enter credentials anywhere but the app. Costs: mailing EUR 2,000, three weeks of call center EUR 25,000, site takedowns EUR 8,000, so 2,000 + 25,000 + 8,000 = EUR 35,000. No system was compromised: if the policy requires a security event, the company bears that EUR 35,000 itself.
significant cyber threat, DORA voluntary notification, DORA Article 19(2), DORA client information duty, DORA Article 19(3), voluntary threat reporting
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.