Corrigendum to EU Sanctions Regulation 2026/695 on Ukraine
The CSSF published a corrigendum to Council Implementing Regulation (EU) 2026/695 of 14 March 2026, which implements restrictive measures under Regulation (EU) No 269/2014 concerning actions undermining Ukraine's territorial integrity. This correction ensures the accurate application of EU sanctions by financial institutions.
Related updates
Application of the Digital Operational Resilience Act (DORA) to third-country branches in Luxembourg
The CSSF has confirmed that relevant third-country branches established in Luxembourg may fall within the scope of DORA. Circular CSSF 26/915 updates several ICT, outsourcing and incident reporting circulars to reflect this expanded scope, requiring affected branches to review their DORA compliance frameworks.
27 Aug 2026
Circular CSSF 25/883 (as amended by Circular CSSF 26/915) (Updated) amending Circular CSSF 22/806 on outsourcing arrangements
CSSF aligns outsourcing requirements with DORA: CSSF Circular 25/883 amends the Luxembourg outsourcing framework to avoid overlap with DORA. For DORA entities, ICT outsourcing requirements under Circular 22/806 are largely replaced by DORA, while BPO remains covered. Non-DORA entities continue to apply the relevant ICT outsourcing and BPO requirements under Circular 22/806. The circular was updated on 27 August 2026.
27 Aug 2026
Circular CSSF 25/882 (as amended by Circular CSSF 26/915) (Updated) on requirements on the use of ICT third-party services for Financial Entities subject to the Digital Operational Resilience Act (DORA)
CSSF strengthens requirements for ICT third-party services under DORA CSSF Circular 25/882 sets out practical requirements for DORA-covered financial entities using ICT third-party services, including notifications for arrangements supporting critical or important functions and the maintenance of a register of information. The circular was updated on 27 August 2026 to include relevant third-country branches within its scope.
27 Aug 2026