Banque Nationale De Belgique Sa · EURONEXT:BNB
Banque Nationale De Belgique Sa — National Bank of Belgium — Technical Presentation (December 2024)
47 slides from Banque Nationale De Belgique Sa's technical presentation, Dec 10, 2024
Slide 1: DORA reporting webinar
DORA reporting webinar M. Creemers, T. Plomteux 10 December ’24
Slide 2: Objectives of today's webinar
Objectives of today’s webinar • Communicate on: • the NBB’s implementation choices regarding the DORA reporting (registers of information, major incident notifications) • day-one challenges, attention points, supervisory requests, ... • Register (answer?) questions and concerns on the practical repo
Slide 3: Intro
Intro DORA reporting webinar
Slide 4: DORA reminder
DORA reminder • EU regulation -> HARD LAW vs. current framework of guidelines, circulars, … • CROSS SECTORAL -> very broad range of financial entities in scope • VERY DETAILED/DEMANDING requirements (via level 1 and level 2 texts) on: • ICT governance/risk management • Incident reporting and informa
Slide 5: Status DORA L2 policy mandates
Status DORA L2 policy mandates ICT-related incident Digital operational resilience Third-party risk management ICT risk framework (chapter II) management, classification testing (chapter IV) (chapter V.1) and reporting (chapter III) • RTS on ICT risk management • RTS on criteria for the classificati
Slide 6: NBB preparatory actions
NBB preparatory actions Policy development ✓ DORA level 2 development, integration in Belgian legal order, update NBB circulars, … Sectoral awareness/readiness ✓ Organisation of seminars, questionnaires (self-assessment) Methodology & training ✓ Update on-site methodology and IT risk questionnaires
Slide 7: General attention points DORA reportings
General attention points DORA reportings • 2 draft circulars shared for consultation with sectoral associations, to clarify NBB’s implementation choices • The final versions of these circulars will be published once the relevant technical standards (RTS/ITS) are published in the EU Official Journal
Slide 8: OneGate access & basic use
OneGate access & basic use DORA reporting webinar
Slide 9: OneGate access ➔ domain "DOR"
OneGate access ➔ domain “DOR” • https://www.nbb.be/OneGate • Access management has become the full responsibility of the declarer ➔ “Administrator(s)”. • CSAM (website EN, FR, NL + guide EN, FR, NL + webinar EN, FR, NL) • Electronic certificates (EN, FR, NL + guide EN, FR, NL) from Globalsign, Isabe
Slide 10: OneGate reporting
OneGate reporting DORA reporting webinar 10
Slide 11: OneGate reporting
OneGate reporting DORA reporting webinar 11
Slide 12: OneGate reporting
OneGate reporting DORA reporting webinar 12
Slide 13: OneGate reporting
OneGate reporting DORA reporting webinar 13
Slide 14: OneGate reporting
OneGate reporting DORA reporting webinar 14
Slide 15: Registers of information
Registers of information DORA reporting webinar
Slide 16: Registers of information (ROI)
Registers of information (ROI) • Legal references: • DORA chapter V, article 28 (and article 31) • Implementing act on register of information: link • Scope: LSIs, stockbrokers, (re)insurance undertakings, PIs, EMIs and CSDs • Consolidation level: highest level of consolidation under NBB supervision
Slide 17: Attention points ROI
Attention points ROI • Registers will be (normally) requested at the highest level of consolidation on which the NBB exercises supervision. • In line with the ECB approach, the Bank aims to eventually request all dependencies on third parties (whether or not they are supported by ICT services) via a
Slide 18: European context
European context • EBA has the lead ➔ reporting in XBRL (cfr. supervisory reporting on FINREP, COREP,...). New = mandatory XBRL-CSV reporting from the NBB to the EBA (EUCLID system). • Dry-run at the end of August 2024 – limited sample of institutions: • Preparation for DORA application • Specific t
Slide 19: Belgian context
Belgian context XBRL solutions in the European Market – Eurofiling • Website (OneGate domain “DOR”: EN, NL, FR). • Approach in Belgium: 1. Data entry via the user interface; 2. Regular CSV per OneGate form; 3. XBRL-XML; 4. XBRL-CSV. DORA reporting webinar 19
Slide 20: Belgian context
Belgian context • HINT : all formats can always be exported from an empty or completed form DORA reporting webinar 20
Slide 21: XBRL-CSV: Content of the zip-file (according to Report Package 1.0)
xBRL-CSV tutorial and examples | XBRL report.json XBRL-CSV: Content of the zip-file (according to Report Package 1.0) parameters.csv reports FilingIndicators.csv FolderName {table}.csv META-INF reportPackage.json Don’t forget to "escape" the separator DORA reporting webinar 21 ➔ "National Bank, Belg
Slide 22: XBRL-CSV: Content of the zip-file (according to Report Package 1.0)
report.json XBRL-CSV: Content of the zip-file (according to Report Package 1.0) parameters.csv reports FilingIndicators.csv FolderName {table}.csv META-INF reportPackage.json DORA reporting webinar 22
Slide 23: XBRL-CSV
XBRL-CSV • OneGate naming convention "KBO_0123456789.IND_NBB_DOR_DORA_ROI_FreeText.is allowed.zip" • DeclarerType: parameter for the institution’s identification type = "KBO". • DeclarerID: Parameter for the institution’s identification. It must be followed by a dot (‘.’) qualifier and an extension
Slide 24: Reporting process - validations
Reporting process - validations • Validation rules are documented by the EBA and part of the XBRL-taxonomy. • OneGate is checking the syntax-structure (pattern) of LEI-codes and EU-IDs. • Text fields (keys) : “abcd ” ≠ “abcd“. ➔ A validation rule will be added to avoid preceding and trailing spaces
Slide 25: Reporting process - dissemination
Reporting process - dissemination • Automated dissemination to the EBA ➔ dissemination status (additional feedback report) in OneGate. • File exchange logging • Control panel A report can only be closed in OneGate in case no errors are left in both validation reports. DORA reporting webinar 25
Slide 26: Reporting process – additional considerations
Reporting process – additional considerations • EBA will check the existence of LEI-codes and EU-IDs • LEI-codes are checked via Global Legal Entity Identifier Foundation (GLEIF) • EU-IDs are checked via Business Register Interconnection System (BRIS) However : the EBA validation result (“disseminat
Slide 27: Major ICT-related incidents & significant cyber threats
Major ICT-related incidents & significant cyber threats DORA reporting webinar
Slide 28: Major ICT-related incidents (MIR) & significant cyber threats (SCT)
Major ICT-related incidents (MIR) & significant cyber threats (SCT) • Legal references: • DORA chapter III, articles 19-21 • Delegated act on incident classification: link • Delegated act specifying content and time limits: link • Draft ITS on templates and procedures: link (not yet adopted) • Scope
Slide 29: Attention points MIR/SCT
Attention points MIR/SCT • Major incidents to be reported via NBB OneGate platform (a posteriori if not possible immediately). Backup possibilities foreseen (for exceptional cases). • The NBB intends to collect major incident notifications per financial entity, not in an aggregated manner (to avoid
Slide 30: European context
European context • ESMA has the lead, reporting not in XBRL. • Usual reporting options in OneGate: data entry, CSV and XML. • Dissemination to ESA’s in JSON format [JSON format not published by ESA’s to avoid confusion]. ➔ Why not JSON for data collection in Belgium ? - reduce risk: ESA specificatio
Slide 31: Belgian context
Belgian context • Website (OneGate domain “DOR”: EN, NL, FR) • OneGate reports – based on KBO (without the “.IND” or “.CON” extension) • Available in English, Dutch and French: DORA reporting webinar 31
Slide 32: DORA_CONTACT
DORA_CONTACT • Quarterly frequency. Deadline T+10 days. • First reference date = 31/12/2024, deadline Friday 10/01/2025 (also to ensure appropriate OneGate access). DORA reporting webinar 32
Slide 33: DORA_CONTACT
DORA_CONTACT • Data from previous quarter are automatically copied. DORA reporting webinar 33
Slide 34: DORA_CONTACT
DORA_CONTACT • Data from previous quarter are automatically copied. “Closing” remains necessary! DORA reporting webinar 34
Slide 35: DORA_MIR
DORA_MIR • No fixed frequency – “on demand” of the reporting agent (cfr. PSD2 incident reporting in domains IPB/IPP). Important remark: “Initial”, “Open” & “Closed” refer to the LifeCycles within OneGate DORA reporting webinar 35
Slide 36: DORA_MIR
DORA_MIR • A unique reference code is required. • This corresponds to field 3.1 in the ITS. DORA reporting webinar 36
Slide 37: DORA_MIR
DORA_MIR • Multiple different incidents are possible on the same day DORA reporting webinar 37
Slide 38: DORA_MIR
DORA_MIR • The ”type of submission” (field 1.1 in the ITS) is very important for the validation process. • An initial notification requires less input than an intermediate and final report; • A final report is required for every incident. ITS fields 1.1 – 1.15 ITS fields 2.1 – 2.10 ITS fields 3.2 –
Slide 39: DORA_MIR
DORA_MIR • Errors and warnings guide you through the reporting and validation process. • Limited set of blocking errors in order to smoothen the incident submission (and dissemination to the ESA’s). • Depending on the data quality and interaction with ESA’s, additional checks might (have to) be adde
Slide 40: DORA_MIR
DORA_MIR • Some open / specific cases (nothing tested yet with ESA’s) • Incident reference code: structure (pattern) may slightly change depending on final decisions of ESA’s. • “Date-time” fields: ITS specifies “ISO 8601 standard UTC (YYYY-MM-DDThh:mm:ss)” but JSON slightly different. • “Duration“
Slide 41: DORA_MIR
DORA_MIR • Important considerations • When the submission of the incident is completed, a “(re)validation” is always necessary. This triggers the dissemination to the ESA’s. • The dissemination status (additional feedback report) will also be available in OneGate (cfr. DORA_ROI). DORA reporting webi
Slide 42: DORA_MIR
DORA_MIR • Important considerations • The report must be closed as soon as possible after the submission of the incident is complete (even with warnings). This triggers the internal NBB notification process. DORA reporting webinar 42
Slide 43: DORA_MIR
DORA_MIR • Important considerations • Once the report is closed, updates remain possible at the initiative of the reporting agent (i.e. “reopen”). • This is necessary to pass from “initial notification” to “intermediate report” or to “final report” (or to reclassify) • This is also possible to merel
Slide 44: DORA_SCT
DORA_SCT • Very similar to DORA_MIR. • No fixed frequency – “on demand” of the reporting agent. • Unique reference code also requested (not part of ITS) ➔ same structure (pattern). • Always revalidate (➔ dissemination) and close (➔ notification)! • Once the report is closed, updates remain possible
Slide 45: DORA_MIR_TEST
DORA_MIR_TEST • Copy of the official DORA_MIR report. Available in production environment. • Solely for testing purposes. • Will be deactivated after the testing period (i.e. 17/01/2025). • Can be reactivated upon your simple request. • Every institution is requested to report a “mock-up” incident.
Slide 46: Conclusion
Conclusion Name Purpose Deadline Scope all DORA FEs (highest Register of information (cf. first reporting cons. level under NBB DORA_ROI article 28(3) of DORA) 30/04/2025 supervision), SIs via ECB collection) Major ICT-related incident adhoc (from 17/01/2025 all DORA FEs + critical DORA_MIR report (
Slide 47: DORA Q&A
DORA Q&A Questions DORA: • it.supervision@nbb.be Questions OneGate: • credit institutions, stockbrokers, PIs, EMIs and CSDs: BankRep@nbb.be • (re)insurance undertakings: AssuRep@nbb.be DORA reporting webinar 47
National Bank of Belgium — Technical Presentation (December 2024) on 6ix