Circular CSSF 25/883 (as amended by Circular CSSF 26/915) (Updated) amending Circular CSSF 22/806 on outsourcing arrangements
CSSF aligns outsourcing requirements with DORA: CSSF Circular 25/883 amends the Luxembourg outsourcing framework to avoid overlap with DORA. For DORA entities, ICT outsourcing requirements under Circular 22/806 are largely replaced by DORA, while BPO remains covered. Non-DORA entities continue to apply the relevant ICT outsourcing and BPO requirements under Circular 22/806. The circular was updated on 27 August 2026.
Related updates
ESMA sets European common enforcement priorities for 2026 corporate reporting
The CSSF has published ESMA's Public Statement (ESMA32-2064178921-9738) setting the European common enforcement priorities for 2026 corporate reporting. The priorities guide national enforcers, including the CSSF for Luxembourg, in their examination of listed issuers' annual financial reports. Issuers and their compliance functions should reflect these priorities when preparing 2026 annual reports.
13 Oct 2026
Prudential procedure for the appointment of members of the management body and key function holders in credit institutions
The CSSF’s procedure on appointing members of management bodies and key function holders at Luxembourg credit institutions is being updated following the transposition of CRD VI through the Luxembourg Law of 5 May 2026. The law tightens fit-and-proper criteria, while the CSSF plans to adapt its procedure following the revision of relevant EBA guidelines. Credit institutions should review their suitability assessments, documentation and appointment processes and monitor further CSSF updates.
15 Oct 2026
Luxembourg Updates Its National Risk Assessment of Terrorist Financing
The CSSF has announced that Luxembourg has updated its national risk assessment of terrorist financing (NRA TF). The assessment was issued via a communiqué from the Ministry of Justice, which coordinates the national risk assessment process, and the full document is published on the Ministry's website. The update is relevant to a broad range of financial sector professionals, from credit institutions and investment firms to crypto-asset service providers and payment institutions.
12 Oct 2026