Circular CSSF 25/882 (as amended by Circular CSSF 26/915) (Updated) on requirements on the use of ICT third-party services for Financial Entities subject to the Digital Operational Resilience Act (DORA)
CSSF strengthens requirements for ICT third-party services under DORA CSSF Circular 25/882 sets out practical requirements for DORA-covered financial entities using ICT third-party services, including notifications for arrangements supporting critical or important functions and the maintenance of a register of information. The circular was updated on 27 August 2026 to include relevant third-country branches within its scope.
Related updates
ESMA sets European common enforcement priorities for 2026 corporate reporting
The CSSF has published ESMA's Public Statement (ESMA32-2064178921-9738) setting the European common enforcement priorities for 2026 corporate reporting. The priorities guide national enforcers, including the CSSF for Luxembourg, in their examination of listed issuers' annual financial reports. Issuers and their compliance functions should reflect these priorities when preparing 2026 annual reports.
13 Oct 2026
Prudential procedure for the appointment of members of the management body and key function holders in credit institutions
The CSSF’s procedure on appointing members of management bodies and key function holders at Luxembourg credit institutions is being updated following the transposition of CRD VI through the Luxembourg Law of 5 May 2026. The law tightens fit-and-proper criteria, while the CSSF plans to adapt its procedure following the revision of relevant EBA guidelines. Credit institutions should review their suitability assessments, documentation and appointment processes and monitor further CSSF updates.
15 Oct 2026
Luxembourg Updates Its National Risk Assessment of Terrorist Financing
The CSSF has announced that Luxembourg has updated its national risk assessment of terrorist financing (NRA TF). The assessment was issued via a communiqué from the Ministry of Justice, which coordinates the national risk assessment process, and the full document is published on the Ministry's website. The update is relevant to a broad range of financial sector professionals, from credit institutions and investment firms to crypto-asset service providers and payment institutions.
12 Oct 2026