Circular CSSF 25/881 (as amended by Circular CSSF 26/915) (Updated) amending Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management
CSSF updates ICT and security risk management requirements: CSSF Circular 25/881 amends the Luxembourg framework for ICT and security risk management to reflect the application of DORA and reduce regulatory overlap. It narrows the relevant EBA Guidelines and maintains specific requirements for PSPs and non-DORA entities. The circular was further amended in August 2026 to reflect DORA's application to certain third-country branches.
Related updates
CSSF Publishes Annual Report 2025 on Luxembourg Financial Supervision
The CSSF has released its Annual Report 2025, providing a comprehensive overview of its supervisory activities, regulatory initiatives, and market developments in the Luxembourg financial sector. The report serves as a key reference for regulated entities seeking insight into the regulator’s priorities and enforcement approach.
04 Sep 2026
Global situation of undertakings for collective investment at the end of July 2026
The CSSF reported that total net assets of Luxembourg UCIs reached €6.687 trillion at the end of July 2026, down 0.66% month-on-month but up 13.21% year-on-year. The decrease was driven by negative market performance, despite positive net capital inflows. The number of active fund units stood at 13,256.
03 Sep 2026
CSSF Publishes Basic Statistical Data on UCIs for July 2026
On 1 September 2026, the CSSF published its monthly basic statistical data on Luxembourg undertakings for collective investment (UCIs) for July 2026. The data is available as an XLSX file and is only available in French. The publication offers industry stakeholders a snapshot of the Luxembourg UCI market.
01 Sep 2026