#
Operational resilience is governed by DORA (Regulation (EU) 2022/2554), directly applicable since 17 January 2025, with the Luxembourg implementing law published 2 July 2024 designating the CSSF and CAA as competent authorities. The CSSF issued Circulars 25/880–25/883 (April 2025) and 25/892–25/893 (2025) operationalising ICT risk management and a DORA-aligned major-incident classification and reporting framework that also captures non-DORA PSPs via Article 105-2 PSL. Incident reporting runs through the CSSF eDesk portal in three phases under strict RTS time limits.
Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →
The operational detail sits in the incident-reporting layer. Circular CSSF 25/893 sets the practical modalities for DORA entities reporting major ICT incidents and significant cyber threats and extends the DORA classification/reporting framework to PSPs outside DORA scope via Article 105-2 of the Law of 10 November 2009, with three-phase reporting (initial, intermediate, final) via the CSSF eDesk portal. The extension to non-DORA PSPs is the analytically important move: it widens the compliance perimeter to smaller Luxembourg payment operators that might otherwise have sat outside the DORA scope.
Outlook
W3 is established rather than escalating — DORA is in force and the incident-reporting circular operationalises it. The forward watch is supervisory practice: how the CSSF exercises its incident-classification and third-party oversight powers in the first full year, and whether smaller non-DORA PSPs absorb the extended reporting obligation without friction. Trajectory: established, with the escalation in this module already realised through the 25/893 perimeter extension.
Operational Resilience & Critical Infrastructure
Luxembourg's transposition of CRD VI, via the Law of 5 May 2026, introduces a new standalone prudential category requiring CSSF-supervised credit institutions to identify, assess, manage and mitigate crypto-asset risk. This is distinct from conduct-level crypto-asset licensing requirements applicable to crypto-asset service providers; it operates at the level of bank prudential risk management, requiring credit institutions with crypto-asset exposure, whether direct holdings, custody arrangements, or counterparty exposure, to build this into their formal risk-management frameworks.
The same transposition act introduces a new third-country-branch authorisation requirement under Articles 32-2/32-3 of the Law on the Financial Sector, which begins phasing in from 11 January 2027. This requirement specifically affects non-EEA banks operating branches in Luxembourg, adding a formal authorisation layer to what may previously have been a lighter-touch branch-establishment regime, and reflects the broader post-Brexit and post-CRD-VI trend toward more explicit supervisory control over third-country banking presence within the EU.
Both provisions are sourced from specialist law-firm commentary on a confirmed transposition act rather than the primary legislative text itself, but the underlying transposition act's existence and effective date are treated as confirmed.
The 11 January 2027 phase-in date for the third-country-branch authorisation requirement is the key date to watch, alongside any CSSF supervisory guidance clarifying how credit institutions should structure crypto-asset risk assessment under the new standalone prudential category.
2 earlier distinct update(s)
Operational Resilience & Critical Infrastructure
Circular CSSF 26/915 extends Digital Operational Resilience Act ICT and cyber-resilience expectations explicitly to third-country branches operating in Luxembourg, closing a supervisory gap that had left non-EEA payment and e-money groups' branch operations without an explicit DORA hook. This finding is the same underlying circular already addressed under conduct and governance; it is carried here because it bears directly on operational-resilience posture for cross-border branch structures.
Whether CSSF issues further sector guidance operationalising the third-country-branch DORA scope, and whether any non-EEA groups restructure their Luxembourg presence in response, are the questions to track into the next cycle.
Operational Resilience & Critical Infrastructure
The CSSF issued a July 2026 supervisory communication directing management bodies to establish governance structures for AI-enabled cyber risk consistent with existing DORA ICT risk-management requirements, referencing recent ESRB (7 July 2026) and FSB (10 June 2026) publications on frontier AI (high confidence; primary CSSF source).
Watch for whether this expectation-setting communication is followed by a formal DORA-linked supervisory review or rulemaking specific to payment and e-money firms.
Sources and findings (4 unique sources · R-3/R-4)
- [W3-E1] T3 Derived: Probable in_forcehttps://www.globalcompliancenews.com/2025/04/23/https-insightplus-bakermckenzie-com-bm-banking-finance_1-luxembourg-cssf-aligns-with-dora-key-updates-on-ict-and-outsourcing-regulations_04172025/ re-verified
DORA entered into force on 17 January 2025 and is directly applicable in Luxembourg; the implementing law published 2 July 2024 designates the CSSF and the Commissariat aux Assurances as competent authorities across five resilience pillars.
- [W3-E2] T1 Derived: Confirmed in_forcehttps://www.cssf.lu/en/2025/05/publication-of-two-new-circulars-ict-related-incident-classification-and-reporting-for-dora-entities-and-other-payment-service-providers-and-adoption-of-esa-guidelines-on-the-estimation-of-aggregated/ re-verified
Circular CSSF 25/893 sets the practical modalities for DORA entities reporting major ICT incidents and significant cyber threats, and extends the DORA classification/reporting framework to PSPs outside DORA scope via Article 105-2 of the Law of 10 November 2009.
- [W3-E3] T3 Derived: Probable in_forcehttps://www.grantthornton.lu/en/insights/important-regulatory-update-from-the-cssf-stay-informed-and-supported/ re-verified
Major ICT incidents and significant cyber threats must be reported in three phases (initial, intermediate, final) via the CSSF eDesk portal or API under RTS/ITS time limits, with Circular 25/893 superseding Circular 24/847 for DORA entities.
- [W3-E4] T1 Derived: Confirmed in_forcehttps://www.cssf.lu/en/ict-and-cyber-risk-for-dora-entities/ re-verified
Circular CSSF 25/882 sets requirements on the use of ICT third-party services for DORA entities, complemented by the RTS on critical ICT third-party providers and subcontracting of services supporting critical functions.