CSSF Updates Annex to Circular 22/822 on FATF High-Risk Jurisdictions
The CSSF has published an updated annex to Circular 22/822, reflecting the latest FATF statements on high-risk jurisdictions subject to enhanced due diligence and counter-measures, and jurisdictions under increased monitoring. The annex, dated 19 June 2026, replaces previous versions and must be applied by all Luxembourg financial sector professionals.
Related updates
Application of the Digital Operational Resilience Act (DORA) to third-country branches in Luxembourg
The CSSF has confirmed that relevant third-country branches established in Luxembourg may fall within the scope of DORA. Circular CSSF 26/915 updates several ICT, outsourcing and incident reporting circulars to reflect this expanded scope, requiring affected branches to review their DORA compliance frameworks.
27 Aug 2026
Circular CSSF 25/883 (as amended by Circular CSSF 26/915) (Updated) amending Circular CSSF 22/806 on outsourcing arrangements
CSSF aligns outsourcing requirements with DORA: CSSF Circular 25/883 amends the Luxembourg outsourcing framework to avoid overlap with DORA. For DORA entities, ICT outsourcing requirements under Circular 22/806 are largely replaced by DORA, while BPO remains covered. Non-DORA entities continue to apply the relevant ICT outsourcing and BPO requirements under Circular 22/806. The circular was updated on 27 August 2026.
27 Aug 2026
Circular CSSF 25/882 (as amended by Circular CSSF 26/915) (Updated) on requirements on the use of ICT third-party services for Financial Entities subject to the Digital Operational Resilience Act (DORA)
CSSF strengthens requirements for ICT third-party services under DORA CSSF Circular 25/882 sets out practical requirements for DORA-covered financial entities using ICT third-party services, including notifications for arrangements supporting critical or important functions and the maintenance of a register of information. The circular was updated on 27 August 2026 to include relevant third-country branches within its scope.
27 Aug 2026