The facts

Who files: Supervised entities that apply the full (SPR-PF-27) or the simplified (SPR-PF-30) ICT risk management framework (DORA obligations page). Source
How often: Annual (DORA obligations page). Source
Deadline: Not stated; the page says deadlines will be set in law or in UKNF supervisory instructions. Source
Format: Other. Through the DORA Reporting System (SSD), the CRP communication subsystem at crp.knf.gov.pl (DORA systems page); the file format is not stated on the pages checked. Source
How it is filed: Filing routes recorded for the KNF: ESPI (Elektroniczny System Przekazywania Informacji, Electronic Information Transmission System); Portal KNF (KNF Portal), with the Data Transmission Application (ATD); WebService KNF; CRP communication subsystem (Podsystem Komunikacji CRP), including the DORA Reporting System (SSD); e-RUP reporting forms; Aplikacja Sprawozdawcza SNU (Reporting Application); NBP SIS (reporting system of Narodowy Bank Polski). See how firms file with the KNF.
Status: In force
Legal basis: Regulation (EU) 2022/2554 (DORA), Article 50(1) and (2)(a), as cited by KNF
Group: All financial entities: ICT risk (national)

Templates (2)

The tables and forms inside the return. Plain name first, the KNF's code in brackets.

Annual KRI survey, full ICT risk management framework (SPR-PF-27)
Annual KRI survey, simplified ICT risk management framework (SPR-PF-30)

The two forms named on the DORA obligations page; their content is not published there. Source

Validation rules

No published validation rules were found for this return. No validation rules for this return were found on the pages checked. Source

Public data

No published data from this return was found. No data from this return published by KNF was found on the pages checked. Source

Official documents (3)

The KNF's own files, with the size and SHA-256 fingerprint of each as downloaded on 11 November 2026, so anyone can tell whether a copy is the same version.

Obowiązki sprawozdawcze w związku z Rozporządzeniem DORA
List of returns · HTML · 13 August 2026
Table of 20 DORA reporting forms (SPR-PF-00 to SPR-PF-30) with legal basis, who files, whether mandatory, on request or voluntary, and frequency.
Systemy DORA
Guidance · HTML · 12 November 2025
The DORA Reporting System (SSD) at crp.knf.gov.pl for all DORA reports except ICT incidents and cyber threats, and the DORA incident system at csirt.knf.gov.pl.
Regulamin Systemu Sprawozdawczości DORA
Filing rules · PDF · 125.4 KB
SHA-256 3d6a9ede4d80show in fullhide
3d6a9ede4d80f282b1262a64cde1ab2f29e47c8c344e253226e094b7c1d0c47b

Sources

Every page and document this return's facts were read from.

Knowing exactly what is collected, in what format and under which rules is the first step to real-time supervision. Line4 builds SupTech software for financial regulators that runs checks like these as each return arrives.

Line4's text and records here are free to reuse under CC BY 4.0. Please credit: “Source: Line4 regulatory submissions library (CC BY 4.0), https://www.line4.ai”. The regulators' documents, forms, taxonomies, rules and data belong to them: see KNF's reuse terms. This describes what regulators publish. It is not legal or regulatory advice: always rely on the regulator's own text.

Źródło: Komisja Nadzoru Finansowego, www.knf.gov.pl (https://www.knf.gov.pl) and https://sprawozdawczosc.knf.gov.pl. Source: Polish Financial Supervision Authority (KNF).

Last checked 11 November 2026.

Annual ICT key risk indicators survey (SPR-PF-27 / SPR-PF-30)