meta_id 3179235

On May 22, 2026, the Bank of Italy (Banca d'Italia) published a communication regarding the reporting of estimates of aggregate annual costs and losses caused by serious information and communication technology (ICT) incidents. The communication establishes requirements for financial institutions and other regulated entities operating in Italy to report data on the financial impact of significant ICT-related incidents. This reporting obligation forms part of Italy's broader regulatory framework for operational resilience and cybersecurity oversight, ensuring that the Bank of Italy maintains visibility over the systemic risks posed by ICT disruptions across the financial sector. The guidance applies to entities subject to the Bank of Italy's supervision, including credit institutions and other financial service providers. By requiring standardised reporting of aggregate costs and losses, the Bank of Italy aims to identify patterns, assess the severity of ICT incidents, and inform its supervisory approach to operational risk management. For reporting due in 2026, entities must submit their estimates by June 30, 2026. This deadline applies specifically to the 2026 reporting cycle. The Bank of Italy's communication includes detailed requirements for calculating and aggregating costs and losses resulting from serious ICT incidents connected to information technology systems. Entities should review the attached guidance document to ensure compliance with the specified reporting format and methodology. The submission should be made to the Bank of Italy through its designated channels, with further details available in the accompanying communication document published on May 22, 2026.