Circular CSSF 25/881 (as amended by Circular CSSF 26/915) (Updated) amending Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management
CSSF updates ICT and security risk management requirements: CSSF Circular 25/881 amends the Luxembourg framework for ICT and security risk management to reflect the application of DORA and reduce regulatory overlap. It narrows the relevant EBA Guidelines and maintains specific requirements for PSPs and non-DORA entities. The circular was further amended in August 2026 to reflect DORA's application to certain third-country branches.
Related updates
ESMA sets European common enforcement priorities for 2026 corporate reporting
The CSSF has published ESMA's Public Statement (ESMA32-2064178921-9738) setting the European common enforcement priorities for 2026 corporate reporting. The priorities guide national enforcers, including the CSSF for Luxembourg, in their examination of listed issuers' annual financial reports. Issuers and their compliance functions should reflect these priorities when preparing 2026 annual reports.
13 Oct 2026
Prudential procedure for the appointment of members of the management body and key function holders in credit institutions
The CSSF’s procedure on appointing members of management bodies and key function holders at Luxembourg credit institutions is being updated following the transposition of CRD VI through the Luxembourg Law of 5 May 2026. The law tightens fit-and-proper criteria, while the CSSF plans to adapt its procedure following the revision of relevant EBA guidelines. Credit institutions should review their suitability assessments, documentation and appointment processes and monitor further CSSF updates.
15 Oct 2026
Luxembourg Updates Its National Risk Assessment of Terrorist Financing
The CSSF has announced that Luxembourg has updated its national risk assessment of terrorist financing (NRA TF). The assessment was issued via a communiqué from the Ministry of Justice, which coordinates the national risk assessment process, and the full document is published on the Ministry's website. The update is relevant to a broad range of financial sector professionals, from credit institutions and investment firms to crypto-asset service providers and payment institutions.
12 Oct 2026