Artikel 23 Betalningsrelaterade operativa incidenter eller säkerhetsincidenter som gäller kreditinstitut, betalningsinstitut, leverantörer av kontoinformationstjänster och institut för elektroniska pengar

This brief but important article extends the scope of the Chapter's requirements — which primarily concern ICT-related incidents — to also cover operational or security payment-related incidents.

It acts as a bridging provision, ensuring that the incident management and reporting rules established in this Chapter are not limited to purely technology-driven events, but also capture broader payment-related disruptions, whether or not they are ICT-related in origin.

Crucially, this extension does not apply to all financial entities, but only to a defined subset of payment-focused entities.

Important points:

• The incident management and reporting requirements of this Chapter apply to both operational or security payment-related incidents and major operational or security payment-related incidents — not just ICT-related ones.
• This extension applies only to credit institutions, payment institutions, account information service providers, and electronic money institutions.
• Note that the scope here covers incidents whether or not they are ICT-related in origin, broadening the reach of the Chapter's obligations for these specific entity types.