Stats › Intraday and market microstructure › Incident rules
A European financial firm must notify a major technology incident within four hours of classifying it, and two materiality thresholds are enough to make it major
| Materiality threshold | Figure |
|---|---|
| Clients affected, relative | more than 10 per cent of all clients using the affected service |
| Clients affected, absolute | more than 100,000 |
| Financial counterparts affected | more than 30 per cent |
| Transactions affected, number | more than 10 per cent of the daily average number |
| Transactions affected, value | more than 10 per cent of the daily average value |
| Duration | more than 24 hours |
| Service downtime on a critical or important function | more than 2 hours |
| Geographical spread | impact in two or more member states |
| Costs and losses | exceeded or likely to exceed 100,000 euro |
| Data losses and reputational impact | no numeric threshold |
Commission Delegated Regulation (EU) 2024/1772, all of these in Article 9. The classification rule in Article 8(1) requires that the incident affected critical services and that it either met the costs and losses limb or met two or more of the other thresholds.
The nine thresholds include a hundred thousand clients, two hours of downtime on a critical function and a hundred thousand euro of cost. Two of them together, plus an effect on critical services, triggers the whole reporting chain.
Members only
The rest of this page is for members
Below this point there are 6 sections, 1 table and 5 named sources, roughly 700 words of it. Every figure carries the source it came from and the date the data is from.
You can keep browsing every statistic in the library for free. The intro and the summary are always open.