Initial notification

Due within 4 hours of classification as major and no later than 24 hours after detection.

Incident

The form is pre-filled from your settings and the incident. Your draft is saved automatically in this browser. Required fields are marked *; the server checks the report against the ESA JSON schema when you validate or download.

Report header

Schema reference

schemaRef

Reporting date *

YYYY-MM-DD. reportingDate

Financial entity ID *

The identifier of the reporting entity at the competent authority (for Finansinspektionen: the institution number). financialEntityId

Resubmission

Yes when correcting a report that has already been submitted. resubmission

Type of submission

1 fields

Type of submission *

Choose "major incident reclassified as non-major" to withdraw an incident that turned out not to be major. incidentSubmission · 010 - 010

Entity and contacts

15 fields

Name of the entity submitting the report *

submittingEntity-name · 010 - 010

Identification code of the entity submitting the report (LEI)

20 characters: 18 letters or digits followed by 2 check digits. Use either the LEI or the entity code, not both. submittingEntity-LEI · 010 - 020

Identification code of the entity submitting the report (EU ID)

Only when the submitting entity has no LEI. submittingEntity-code · 010 - 030

Type of the affected financial entity

Credit institution Payment institution Exempted payment institution Account information service provider Electronic money institution Exempted electronic money institution Investment firm Crypto-asset service provider Issuer of asset-referenced tokens Central securities depository Central counterparty Trading venue Trade repository Manager of alternative investment fund Management company Data reporting service provider Insurance and reinsurance undertaking Insurance intermediary reinsurance intermediary and ancillary insurance intermediary Institution for occupational retirement provision Credit rating agency Administrator of critical benchmarks Crowdfunding service provider Securitisation repository

affectedEntityType · 010 - 040

Name of the financial entity affected

affectedEntity-name · 010 - 050

LEI code of the financial entity affected

Only when the affected entity differs from the submitting entity. affectedEntity-LEI · 010 - 060

Primary contact person name *

primaryContact-name · 010 - 070

Primary contact person email *

primaryContact-email · 010 - 080

Primary contact person telephone *

International format, for example +46 8 123 456 78. primaryContact-phone · 010 - 090

Second contact person name *

secondaryContact-name · 010 - 100

Second contact person email *

secondaryContact-email · 010 - 110

Second contact person telephone *

International format, for example +46 8 123 456 78. secondaryContact-phone · 010 - 120

Name of the ultimate parent undertaking

ultimateParentUndertaking-name · 010 - 130

LEI code of the ultimate parent undertaking

Leave empty when the parent is the submitting entity itself. ultimateParentUndertaking-LEI · 010 - 140

Reporting currency *

reportCurrency · 010 - 150

Incident (initial notification)

10 fields

Incident reference code assigned by the financial entity *

Your own unique reference code for the incident. Use the same code in all three reports. financialEntityCode · 010 - 160

Date and time of detection of the ICT-related incident *

When the financial entity became aware of the incident. Swedish time; exported in UTC. detectionDateTime · 010 - 170

Date and time of classification of the incident as major *

When the incident was classified as major. Swedish time; exported in UTC. classificationDateTime · 010 - 180

Description of the ICT-related incident *

incidentDescription · 010 - 190

Classification criteria that triggered the incident report *

Clients financial counterparts and transactions affected Geographical spread Data losses Economic impact Reputational impact Duration and service downtime Critical services affected

classificationCriterion · 010 - 200

Materiality thresholds for the classification criterion ‘Geographical spread’

AT BE BG CY CZ DE DK EE ES FI FR GR HR HU IE IS IT LI LT LU LV MT NL NO PL PT RO SE SI SK

Only used when geographical spread is a selected criterion. The home Member State is removed automatically. countryCodeMaterialityThresholds · 010 - 210

Discovery of the major ICT-related incident *

incidentDiscovery · 010 - 220

Indication whether the incident originates from a third party provider or another financial entity

originatesFromThirdPartyProvider · 010 - 230

Activation of business continuity plan, if activated *

isBusinessContinuityActivated · 010 - 240

Other relevant information

otherInformation · 010 - 250

Generated report

Upload the file in Finansinspektionen's reporting portal. When it has been submitted, record the submission time so the next deadline can be calculated.

Show JSON