Circular CSSF 25/882 (as amended by Circular CSSF 26/915) (Updated) on requirements on the use of ICT third-party services for Financial Entities subject to the Digital Operational Resilience Act (DORA)
CSSF strengthens requirements for ICT third-party services under DORA CSSF Circular 25/882 sets out practical requirements for DORA-covered financial entities using ICT third-party services, including notifications for arrangements supporting critical or important functions and the maintenance of a register of information. The circular was updated on 27 August 2026 to include relevant third-country branches within its scope.
Related updates
CSSF extends LMT activation module to notifications of suspension of redemptions
On 18 September 2026, the CSSF announced that, from 21 September 2026, the activation and deactivation of a suspension of redemptions only must be notified through the CSSF eDesk “LMT activation” module. The requirement applies to Luxembourg UCIs, SIFs and SICARs within the scope of the communication. While a redemption-only suspension is not itself an LMT under the Luxembourg Law of 3 March 2026, the CSSF has integrated it into the LMT notification module. Existing administrative and documentation requirements remain unchanged. Compliance action: ensure relevant procedures and responsible teams are ready to use the eDesk module as of 21 September 2026.
18 Sep 2026
CSSF warns of active exploitation of CVE-2026-76461 in Cisco Secure Email Gateway
The CSSF has issued a communiqué alerting supervised entities to the active exploitation of CVE-2026-76461, a vulnerability in the email parsing component of Cisco AsyncOS Software for Cisco Secure Email Gateway that permits unauthenticated remote code execution with root privileges. The regulator reminds entities that such unauthorised malicious access qualifies as a major ICT-related incident requiring notification under Circular CSSF 25/893 (DORA) or CSSF 24/847, depending on entity type.
15 Sep 2026
CSSF publishes H1 2026 profit and loss account of Luxembourg credit institutions
On 14 September 2026 the CSSF published the profit and loss account of Luxembourg credit institutions as at 30 June 2026 (available in French only). Sector profit before provisions and taxes rose 5.4% year-on-year to EUR 5,330.2 million, while net profit remained broadly in line with H1 2025 as higher allocations to provisions for risks offset the increase. The cost-to-income ratio improved marginally to 44.8% from 45.3%.
14 Sep 2026