title: LU — Operational Resilience & Critical Infrastructure (W3) | World Payments Monitor canonical: https://payments.gi/jurisdictions/luxembourg/w3/ ### W3 Operational Resilience & Critical Infrastructure Probable re-verified 2026-10-18 · changed 2026-09-28 Operational resilience is governed by DORA (Regulation (EU) 2022/2554), directly applicable since 17 January 2025, with the Luxembourg implementing law published 2 July 2024 designating the CSSF and CAA as competent authorities. The CSSF issued Circulars 25/880–25/883 (April 2025) and 25/892–25/893 (2025) operationalising ICT risk management and a DORA-aligned major-incident classification and reporting framework that also captures non-DORA PSPs via Article 105-2 PSL. Incident reporting runs through the CSSF eDesk portal in three phases under strict RTS time limits. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/luxembourg/) Horizon · 2027-01-11 Speculative CRD VI third-country-branch authorisation requirement phases in_Proposed_ Standing sub-brief · as of 27 June 2026 227 words · last cycle 2026-10-04 #### Operational Resilience & Critical Infrastructure DORA (Regulation (EU) 2022/2554) entered into force 17 January 2025 and is directly applicable in Luxembourg; the implementing law published 2 July 2024 designates the CSSF and the Commissariat aux Assurances as competent authorities across five resilience pillars. DORA is now live and imposes ICT resilience and third-party oversight obligations across all Luxembourg PSPs, applying to both bank-PSPs and non-bank PIs/EMIs as a substantial operational and vendor-management cost driver. The operational detail sits in the incident-reporting layer. Circular CSSF 25/893 sets the practical modalities for DORA entities reporting major ICT incidents and significant cyber threats and extends the DORA classification/reporting framework to PSPs outside DORA scope via Article 105-2 of the Law of 10 November 2009, with three-phase reporting (initial, intermediate, final) via the CSSF eDesk portal. The extension to non-DORA PSPs is the analytically important move: it widens the compliance perimeter to smaller Luxembourg payment operators that might otherwise have sat outside the DORA scope. #### Outlook W3 is established rather than escalating — DORA is in force and the incident-reporting circular operationalises it. The forward watch is supervisory practice: how the CSSF exercises its incident-classification and third-party oversight powers in the first full year, and whether smaller non-DORA PSPs absorb the extended reporting obligation without friction. Trajectory: established, with the escalation in this module already realised through the 25/893 perimeter extension. Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure Luxembourg's transposition of CRD VI, via the Law of 5 May 2026, introduces a new standalone prudential category requiring CSSF-supervised credit institutions to identify, assess, manage and mitigate crypto-asset risk. This is distinct from conduct-level crypto-asset licensing requirements applicable to crypto-asset service providers; it operates at the level of bank prudential risk management, requiring credit institutions with crypto-asset exposure, whether direct holdings, custody arrangements, or counterparty exposure, to build this into their formal risk-management frameworks. The same transposition act introduces a new third-country-branch authorisation requirement under Articles 32-2/32-3 of the Law on the Financial Sector, which begins phasing in from 11 January 2027. This requirement specifically affects non-EEA banks operating branches in Luxembourg, adding a formal authorisation layer to what may previously have been a lighter-touch branch-establishment regime, and reflects the broader post-Brexit and post-CRD-VI trend toward more explicit supervisory control over third-country banking presence within the EU. Both provisions are sourced from specialist law-firm commentary on a confirmed transposition act rather than the primary legislative text itself, but the underlying transposition act's existence and effective date are treated as confirmed. The 11 January 2027 phase-in date for the third-country-branch authorisation requirement is the key date to watch, alongside any CSSF supervisory guidance clarifying how credit institutions should structure crypto-asset risk assessment under the new standalone prudential category. **2 earlier distinct update(s)** Periodic update · new data 2026-09-08 #### Operational Resilience & Critical Infrastructure Circular CSSF 26/915 extends Digital Operational Resilience Act ICT and cyber-resilience expectations explicitly to third-country branches operating in Luxembourg, closing a supervisory gap that had left non-EEA payment and e-money groups' branch operations without an explicit DORA hook. This finding is the same underlying circular already addressed under conduct and governance; it is carried here because it bears directly on operational-resilience posture for cross-border branch structures. Whether CSSF issues further sector guidance operationalising the third-country-branch DORA scope, and whether any non-EEA groups restructure their Luxembourg presence in response, are the questions to track into the next cycle. Periodic update · new data 2026-09-05 #### Operational Resilience & Critical Infrastructure The CSSF issued a July 2026 supervisory communication directing management bodies to establish governance structures for AI-enabled cyber risk consistent with existing DORA ICT risk-management requirements, referencing recent ESRB (7 July 2026) and FSB (10 June 2026) publications on frontier AI (high confidence; primary CSSF source). Watch for whether this expectation-setting communication is followed by a formal DORA-linked supervisory review or rulemaking specific to payment and e-money firms. **Sources and findings (4 unique sources · R-3/R-4)** 1. [W3-E1] T3 Derived: Probable [in_force https://www.globalcompliancenews.com/2025/04/23/https-insightplus-bakermckenzie-com-bm-banking-finance_1-luxembourg-cssf-aligns-with-dora-key-updates-on-ict-and-outsourcing-regulations_04172025/](https://www.globalcompliancenews.com/2025/04/23/https-insightplus-bakermckenzie-com-bm-banking-finance_1-luxembourg-cssf-aligns-with-dora-key-updates-on-ict-and-outsourcing-regulations_04172025/) re-verified 2026-06-27 DORA entered into force on 17 January 2025 and is directly applicable in Luxembourg; the implementing law published 2 July 2024 designates the CSSF and the Commissariat aux Assurances as competent authorities across five resilience pillars. 2. [W3-E2] T1 Derived: Confirmed [in_force https://www.cssf.lu/en/2025/05/publication-of-two-new-circulars-ict-related-incident-classification-and-reporting-for-dora-entities-and-other-payment-service-providers-and-adoption-of-esa-guidelines-on-the-estimation-of-aggregated/](https://www.cssf.lu/en/2025/05/publication-of-two-new-circulars-ict-related-incident-classification-and-reporting-for-dora-entities-and-other-payment-service-providers-and-adoption-of-esa-guidelines-on-the-estimation-of-aggregated/) re-verified 2026-06-27 Circular CSSF 25/893 sets the practical modalities for DORA entities reporting major ICT incidents and significant cyber threats, and extends the DORA classification/reporting framework to PSPs outside DORA scope via Article 105-2 of the Law of 10 November 2009. 3. [W3-E3] T3 Derived: Probable [in_force https://www.grantthornton.lu/en/insights/important-regulatory-update-from-the-cssf-stay-informed-and-supported/](https://www.grantthornton.lu/en/insights/important-regulatory-update-from-the-cssf-stay-informed-and-supported/) re-verified 2026-06-27 Major ICT incidents and significant cyber threats must be reported in three phases (initial, intermediate, final) via the CSSF eDesk portal or API under RTS/ITS time limits, with Circular 25/893 superseding Circular 24/847 for DORA entities. 4. [W3-E4] T1 Derived: Confirmed [in_force https://www.cssf.lu/en/ict-and-cyber-risk-for-dora-entities/](https://www.cssf.lu/en/ict-and-cyber-risk-for-dora-entities/) re-verified 2026-06-27 Circular CSSF 25/882 sets requirements on the use of ICT third-party services for DORA entities, complemented by the RTS on critical ICT third-party providers and subcontracting of services supporting critical functions.