DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 to banks, payment and e-money institutions, investment firms, authorised AIFMs and UCITS management companies, CASPs and insurers, with no general size threshold. In Luxembourg the CSSF and the CAA enforce it under the Law of 1 July 2024, with fines up to EUR 5 million or 10% of turnover. Major ICT incidents are reported within 4 hours of classification, the register of information is filed every year, and every ICT contract needs Article 30 terms. Support PSF are not in scope directly but feel DORA through their clients.
DORA turns IT risk into a regulated discipline
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It treats a failed server, a ransomware attack or an outage at a cloud provider as a regulatory matter, in the same way as capital or liquidity. Supervisors want to see that a firm can withstand, report and recover from ICT disruption, and that it controls the providers it relies on.
A regulation applies directly, so the core rules are the same in Luxembourg as in Frankfurt or Dublin. What Luxembourg adds is the enforcement layer: the Law of 1 July 2024 designates the CSSF and the CAA as competent authorities and sets the fines. The CSSF then adds practice through circulars on ICT risk, outsourcing, the register of information and incident reporting, all reworked in 2025 and amended again in August 2026.
DORA has five pillars: ICT risk management, incident classification and reporting, resilience testing, third-party risk, and voluntary information sharing on cyber threats. For most mid-sized Luxembourg firms, the painful parts are the register of information and the contracts. A payment institution with 20 staff can easily have 40 ICT contracts, and every one of them now has minimum content set by Article 30.
This note complements our notes on the MiCA licence and on Luxembourg investment funds.
DORA applies
Directly, to about 20 types of financial entity.
Initial report
From classifying an incident as major; 24 hours at most from awareness.
Register deadline
2026 collection on eDesk; annual under Circular 25/882.
Or 10% of turnover
Maximum fine for a legal person under the 2024 law.
Who is a financial entity under DORA
Article 2 lists the financial entities. The list is long and, unlike many EU rules, it has no general size threshold. A five-person e-money institution is as much in scope as a bank. Size only matters through the proportionality principle in Article 4, through the simplified framework in Article 16 and through the lighter rules for microenterprises.
| Entity | In scope? | Note |
|---|---|---|
| Credit institutions | Yes | Significant banks report through the ECB for some items |
| Payment and e-money institutions | Yes | Including those exempted under PSD2 and the E-Money Directive |
| Account information service providers | Yes | Registered AISPs included |
| Investment firms | Yes | Small and non-interconnected ones use Article 16 |
| CASPs and issuers of asset-referenced tokens | Yes | Authorised under MiCA |
| Authorised AIFMs and UCITS management companies | Yes | Delegation does not take them out |
| Registered (sub-threshold) AIFMs | No | Excluded by Article 2(3) |
| Insurers and reinsurers | Yes | Supervised by the CAA in Luxembourg |
| Insurance intermediaries | Partly | Microenterprises and SMEs excluded |
| IORPs | Yes | Excluded with 15 members or fewer |
| Crowdfunding providers, securitisation repositories, CSDs, CCPs, trading venues | Yes | Market infrastructure is in scope |
| Support PSF and other ICT providers | Not directly | Reached through their clients' contracts; critical ones overseen by the ESAs |
Funds and vehicles. An investment fund itself, such as a RAIF, SIF or SCSp, is not a financial entity under DORA. Its authorised AIFM or management company is. A securitisation vehicle is not in scope either, though a securitisation repository is. A SOPARFI holding company is outside the regulation entirely.
Proportionality. Article 4 asks every entity to implement the rules in line with its size, risk profile and the nature, scale and complexity of its services. That is not an exemption: a small firm needs the same documents, only shorter.
Simplified framework. Article 16 replaces Chapter II with a lighter regime for small and non-interconnected investment firms, payment and e-money institutions exempted under the respective directives, certain exempted credit institutions and small IORPs. They still need a sound, documented ICT risk management framework, business continuity and testing, but without the full set of functions and reviews. Commission Delegated Regulation (EU) 2024/1774 sets out the content of both the full and the simplified framework.
Microenterprises. An entity with fewer than 10 persons and turnover or balance sheet of EUR 2 million or less is a microenterprise under Article 3(60). It keeps the full regime with some relaxations, such as no cost estimate of incidents under Circular CSSF 25/892.
Law and practice: Regulation (EU) 2022/2554, Articles 2, 3(60), 4 and 16; Commission Delegated Regulation (EU) 2024/1774 on the ICT risk management framework and the simplified framework; Directive (EU) 2022/2556 amending sector directives.
The 2024 law, the CSSF circulars and support PSF
The law. The Law of 1 July 2024, adopted as bill 8291 and published on 2 July 2024, implements DORA in Luxembourg from 17 January 2025. It amends the Law of 16 July 2019 on the operationalisation of EU financial services regulations to name the CSSF and the CAA as competent authorities, and transposes Directive (EU) 2022/2556 into the Law of 5 April 1993 on the financial sector, the AIFM law of 12 July 2013, the insurance law of 7 December 2015 and other sector laws.
Powers and fines. For breaches of DORA they can fine a legal person up to EUR 5 million or 10% of total annual turnover, based on the latest consolidated accounts, and an individual up to EUR 5 million. They can also order a breach to stop and publish the name of the person responsible.
The circulars. On 9 April 2025 the CSSF reshaped its ICT rulebook around DORA, so that its older circulars now apply mainly to entities outside DORA and to non-ICT outsourcing. The table shows who follows what.
| Circular | Subject | Who |
|---|---|---|
| 20/750 (amended by 25/881) | ICT and security risk management | Non-DORA entities, including support PSF |
| 22/806 (with 25/883) | Outsourcing | DORA entities for non-ICT outsourcing; non-DORA entities in full |
| 25/880 | Payment service user relations and PSP ICT assessment | All payment service providers |
| 25/882 | ICT third-party services, register of information | DORA entities |
| 25/892 | Estimating annual costs and losses of major incidents | DORA entities except microenterprises |
| 25/893 | Major ICT incidents and significant cyber threats | DORA entities and non-DORA PSPs |
| 24/847 | ICT incident reporting | Other supervised entities, such as support PSF |
| 26/915 | Application of DORA to third-country branches | Amends the circulars above, 27 August 2026 |
Support PSF. Luxembourg's support PSF, under Articles 29-1 to 29-6 of the 1993 law, include client communication agents, administrative agents, IT systems and network operators, and dematerialisation and conservation service providers. They are supervised by the CSSF but are not financial entities under DORA. For their clients they are ICT third-party providers, and the CSSF treats their services as ICT services under DORA in every case. So a support PSF faces DORA twice over: through the clauses, audits and exit plans its clients impose, and through the CSSF's own circulars, which mirror much of DORA. A support PSF that serves many banks can also fall under the Luxembourg NIS2 law, in force since 10 May 2026.
Law and practice: Law of 1 July 2024 (bill 8291), Mémorial A; Law of 16 July 2019 as amended; CSSF communication of 11 July 2024; Circulars CSSF 20/750, 22/806, 25/880 to 25/883 of 9 April 2025, 25/892 and 25/893 of 28 May 2025, and 26/915 of 27 August 2026; Law of 5 April 1993, Articles 29-1 to 29-6.
The framework, the board and resilience testing
Management body. Article 5 puts the board in charge. It approves the digital operational resilience strategy, the ICT risk management framework, the business continuity policy and the budget, and it bears final responsibility. Board members must keep their ICT knowledge up to date through regular training. A single line in the minutes approving an IT policy is not oversight.
The framework. Articles 6 to 14 require a documented ICT risk management framework, reviewed at least once a year and built from the policies below. An independent control function for ICT risk is required, and internal audit reviews the framework regularly.
- Strategy and framework. Digital operational resilience strategy, ICT risk management policy, risk tolerance for ICT disruption.
- Identification. Inventory of ICT assets and information assets, mapping of critical or important functions and the systems behind them.
- Protection and detection. Access, encryption, network security, vulnerability and patch management, logging and anomaly detection.
- Response and recovery. Business continuity and ICT response and recovery plans, backup policy, tested restoration, recovery time objectives.
- Learning and communication. Post-incident reviews, staff awareness training, crisis communication plan.
Testing. Article 24 requires a resilience testing programme proportionate to the entity: vulnerability scans, network and open-source analysis, scenario tests and penetration tests. Systems supporting critical or important functions are tested at least once a year. Entities identified by the authorities as significant must also carry out threat-led penetration testing (TLPT) at least every three years under Article 26. In Luxembourg, TLPT is run through the TIBER-LU framework operated jointly by the CSSF and the Banque centrale du Luxembourg, whose implementation document was updated on 20 June 2025 to fit DORA.
An exempted e-money institution with eight staff falls under Article 16. It still needs a documented framework, an asset inventory, business continuity arrangements and testing. It does not need an independent ICT risk control function separate from operations, the yearly framework review can be lighter, and the documents can be combined into one ICT risk policy.
Law and practice: Regulation (EU) 2022/2554, Articles 5 to 14, 16, 24 to 27; Commission Delegated Regulation (EU) 2024/1774; Commission Delegated Regulation (EU) 2025/1190 on TLPT; TIBER-LU implementation document, CSSF and BCL, June 2025.
Classifying and reporting ICT incidents
Every ICT incident must be logged. Only major incidents are reported to the supervisor. Commission Delegated Regulation (EU) 2024/1772 sets the criteria: clients affected, duration and downtime, geographical spread, data losses, critical services affected and economic impact. An incident is major if it affects critical services and either involves malicious unauthorised access that may lead to data losses, or meets two other thresholds.
- Detection and classificationLog the incident and classify it promptly against the criteria. The clock starts when you classify it as major, but you also have an outer limit of 24 hours from becoming aware of it.
- Initial notification: 4 hoursWithin 4 hours of classification and no later than 24 hours after awareness, notify the CSSF with the basic facts.
- Intermediate report: 72 hoursWithin 72 hours of the initial notification, with updates whenever the status changes significantly or regular activities are restored.
- Final report: one monthWithin one month of the latest intermediate report, with root cause, measures taken, costs and lessons learned.
In Luxembourg, Circular CSSF 25/893 governs the reports for DORA entities and also brings payment service providers outside DORA into the same system. Reports are filed through the CSSF's eDesk portal or its API. Circular 25/892 requires DORA entities other than microenterprises to estimate the aggregated annual costs and losses of major incidents when the CSSF asks. Clients whose financial interests are affected must be told without undue delay.
GDPR and NIS2. DORA is the specific act for financial entities, so it displaces NIS2 on ICT risk management and incident reporting for them. GDPR is not displaced. If an incident exposes personal data, the entity reports the personal data breach to the CNPD within 72 hours of becoming aware, under Article 33 GDPR, and informs affected individuals where the risk is high. Run both from one incident playbook.
Law and practice: Regulation (EU) 2022/2554, Articles 17 to 23; Commission Delegated Regulation (EU) 2024/1772 (classification); Commission Delegated Regulation (EU) 2025/301 (content and time limits) and Implementing Regulation (EU) 2025/302 (templates); Circulars CSSF 25/892 and 25/893; GDPR, Articles 33 and 34; Law of 5 May 2026 transposing NIS2.
Contracts, the register and critical providers
The register of information. Article 28(3) requires every financial entity to keep a register of all contractual arrangements for ICT services, at entity, sub-consolidated and consolidated level. Implementing Regulation (EU) 2024/2956 fixes the format: linked tables on contracts, providers with their legal entity identifiers, functions and subcontractors. In Luxembourg it is filed every year under Circular CSSF 25/882. The first collection closed on 15 April 2025. The 2026 collection ran on eDesk from 11 February to 31 March 2026, with a reference date of 31 December 2025, and third-country branches were added to the population.
Most rejections come from data quality: missing LEIs, functions not linked to contracts, inconsistent identifiers. Build the register from the contract database, not a spreadsheet kept by one person.
Contractual provisions. Article 30(2) sets minimum terms for every ICT contract, and Article 30(3) adds terms for contracts supporting critical or important functions, including participation in TLPT and a mandatory transition period on exit.
| Requirement | All ICT contracts | Critical or important functions |
|---|---|---|
| Service description, locations, data protection | Yes | Yes |
| Termination rights, cooperation with the CSSF | Yes | Yes |
| Full service levels with performance targets | No | Yes |
| Business continuity and testing by the provider | No | Yes |
| Audit, access and inspection rights | Limited | Unrestricted |
| Exit strategy and transition period | No | Yes |
| Prior notice to the CSSF of the planned contract | No | Yes, under Circular 25/882 |
Subcontracting adds another layer. Commission Delegated Regulation (EU) 2025/532 governs subcontracting of ICT services that support critical or important functions: the entity must assess the chain, and the contract must give it rights over material subcontracting changes.
Concentration and exit. Before signing, the entity must assess concentration risk, including whether one provider is hard to replace or whether several contracts sit with the same group. For critical or important functions, it needs a documented exit strategy that it can actually execute, tested where feasible.
Critical providers. On 18 November 2025 the European Supervisory Authorities published the first list of 19 critical ICT third-party providers, including the large cloud, data centre and network providers. Each has a lead overseer among the ESAs. Designation does not reduce the client's duties: the financial entity stays fully responsible for its own compliance.
Law and practice: Regulation (EU) 2022/2554, Articles 28 to 44; Implementing Regulation (EU) 2024/2956 (register templates); Commission Delegated Regulation (EU) 2024/1773 (policy on ICT services for critical functions) and (EU) 2025/532 (subcontracting); Circular CSSF 25/882; CSSF communications of April 2025 and 11 February 2026; ESA press release of 18 November 2025.
A payment institution, a fund manager and a CASP
A Luxembourg payment institution authorised under the 2009 payment services law runs card acquiring for online merchants. It has 20 staff, turnover of EUR 6 million and its core platform runs on a SaaS provider hosted on a hyperscaler. It is not exempted and not a microenterprise, so the full framework applies, scaled down. Its register lists 34 ICT contracts, five of them supporting critical or important functions: the core platform, the card processor, the fraud engine, the hosting of its client portal and its managed security operations centre. The 2022 SaaS contract lacks audit rights and an exit transition period. The firm signs a DORA addendum and maps the hyperscaler as a subcontractor. In March 2026 an outage at the processor stops payments for 5 hours and affects 40% of its merchants. The incident is classified as major at 11:00; the initial notification goes to the CSSF by 15:00, the intermediate report three days later and the final report within a month. No personal data is exposed, so there is no CNPD notification.
An authorised AIFM with 25 staff manages six RAIFs. It delegates fund administration to a Luxembourg bank and uses an external IT provider for its workstations, email and document management. The fund administrator's accounting and NAV calculation are financial services, not ICT services, and remain under the outsourcing rules of Circular 22/806 as amended. The IT provider, the portfolio management system and the investor portal are ICT services and go into the DORA register. The AIFM identifies three critical or important ICT services, renegotiates the IT provider's contract to add Article 30(3) terms and gives the CSSF prior notice of a planned move to a new portfolio management platform. Its board is trained and approves the strategy.
A crypto-asset service provider authorised by the CSSF offers custody and exchange. It has 14 staff and EUR 3 million of revenue, so it is not a microenterprise. Its wallet infrastructure, blockchain node provider, KYC tool and cloud hosting are critical ICT services; a key-management failure is an existential risk. DORA applies in full alongside MiCA's own rules on custody and complaints. The firm documents its key generation, storage and recovery procedures, tests restoration of wallets from backup every quarter and adds the node provider, based outside the EU, to the register with its LEI. Reporting for DAC8 is a separate tax obligation and does not count as DORA compliance.
Law and practice: Entity figures are assumptions for illustration. Whether a function is critical or important and whether an incident is major depend on the facts and the classification criteria.
Check your DORA position
Simplified: DORA and CSSF circulars as of October 2026. The result is an orientation for planning, not a legal opinion on your scope.
DORA scope and gap checker
Answer six questions about your entity. You see whether DORA applies directly or through your clients, which framework level fits, the obligations, the incident reporting clock, an illustrative estimate of contract remediation work, the red flags and the next steps.
Every authorised PI, EMI, ManCo and CASP is in scope.
2026 window closed on 31 March; plan for early 2027.
Article 30 terms for every ICT contract, more for critical ones.
Initial report from classification, 24 hours at most from awareness.
DORA in Luxembourg: frequent questions
Does DORA apply to a Luxembourg payment institution with 20 staff?
Yes. Every authorised payment institution and electronic money institution is a financial entity under Article 2 of DORA, whatever its size. Size changes the depth of the work, not the scope. A payment institution exempted under PSD2 may use the simplified ICT risk framework of Article 16; an authorised one with 20 staff uses the full framework, applied proportionately.
Are support PSF subject to DORA?
Not as financial entities. Support PSF under Articles 29-1 to 29-6 of the Law of 5 April 1993 are not on the Article 2 list. They meet DORA as ICT third-party service providers: their clients must put Article 30 clauses into the contracts, list them in the register of information and audit them. The CSSF still supervises them directly, and Circular CSSF 20/750 on ICT and security risk management applies to them.
How quickly must a major ICT incident be reported to the CSSF?
The initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it. The intermediate report follows within 72 hours of the initial notification, and the final report within one month of the latest intermediate report. Reports go to the CSSF under Circular CSSF 25/893.
When is the register of information due in Luxembourg?
Every year, under Circular CSSF 25/882. The 2026 collection ran on eDesk from 11 February to 31 March 2026, with a reference date of 31 December 2025. The first collection, in 2025, closed on 15 April. Expect a similar window in early 2027.
Is a registered AIFM below the thresholds in scope?
No. DORA excludes AIFMs that qualify for the exemption in Article 3(2) of the AIFM Directive, which in Luxembourg means managers registered with the CSSF rather than authorised. An authorised AIFM is in scope even if it delegates portfolio management and IT to third parties.
Does DORA replace NIS2 and GDPR?
DORA replaces NIS2 for financial entities on ICT risk and incident reporting: it is the specific act. GDPR still applies in parallel. A cyber incident that exposes personal data can mean a DORA report to the CSSF and a separate breach notification to the CNPD within 72 hours.