In brief
On 9 April 2025, the Commission de Surveillance du Secteur Financier (CSSF) issued several new circulars related to information and communication technologies (ICT) risk management and the use of ICT third parties, aiming to align existing circulars and practices with the Digital Operational Resilience Act (DORA).
Key changes include amendments to Circular CSSF 20/750 on ICT and security risk management and Circular CSSF 22/806 on outsourcing arrangements, along with the introduction of New Circular CSSF 25/882 and Circular CSSF 25/880.
These updates aim to reduce regulatory overlap, enhance clarity, and ensure compliance with DORA, impacting ICT risk management and outsourcing practice for both DORA and non-DORA entities supervised by the CSSF.
Background
DORA entered into force on 17 January 2025 and since then has been directly applicable under Luxembourg law.
DORA enhances the financial sector's digital operational resilience by imposing new obligations on financial entities and ICT service providers. It requires robust measures to manage and mitigate ICT risks, structured around five key pillars: ICT risk management and governance, ICT incident management and reporting, digital operational resilience testing, strategy for ICT third-party risk, and information and intelligence sharing.
On 2 July 2024, the Luxembourg law ("Law") implementing DORA was published in the Official Journal of the Grand Duchy of Luxembourg, designating the CSSF and the Commissariat aux Assurances (CAA) as the competent Luxembourgish authorities responsible for its application by the in-scope entities under their supervision.
CSSF update
ICT and security risk management
- New Circular CSSF 25/880: This circular is addressed to all payment service providers (PSPs), both DORA and non-DORA entities. It adopts the new EBA Guidelines on ICT and security risk management, which aim to harmonize and provide the requirements for PSPs' ICT assessment. It also implements the reporting requirement on operational and security risks outlined in the Law of 10 November 2009 on payment services.
- Circular CSSF 20/750: The Circular CSSF 20/750 on ICT and security risk management remains applicable to non-DORA entities, with only minor updates being made. The term "PSPs" has been refined to be limited to specialized PSPs, support PSPs, POST Luxembourg and third country branches. DORA entities are explicitly out of scope of this circular.
Outsourcing
- Circular CSSF 22/806: This circular provides a comprehensive framework for outsourcing arrangements, including ICT outsourcing. DORA has introduced harmonized requirements for the use of ICT third-party services, including ICT outsourcing, which overlap with Circular CSSF 22/806.
To remove overlaps with DORA, Circular CSSF 22/806 has been amended to apply to DORA entities only for business process outsourcing, while ICT outsourcing requirements are already governed by DORA. The amended circular remains fully applicable to non-DORA entities for both business process and ICT outsourcing, and to management companies relating to undertakings for collective investment. Additionally, specific contractual clauses for cloud computing service providers have been repealed to align requirements between DORA and non-DORA entities.
- New Circular CSSF 25/882: The CSSF has introduced Circular CSSF 25/882, detailing requirements for the use of ICT third-party services for DORA entities. This circular outlines requirements for the use of ICT third-party services, including reporting obligations and maintaining a register of information. It also retains some elements from Circular CSSF 22/806 that are not covered by DORA but remain necessary for compliance.
Practical implications
To fully comply with the CSSF updates, in-scope entities under its supervision must do the following:
- Review and update ICT Risk Management procedures to ensure alignment with the new EBA Guidelines and the requirements set out in Circular CSSF 25/880.
- Comply with the implemented reporting requirements outlined in Article 105-1(2) of the Law of 10 November 2009 on payment services.
- Review and amend outsourcing agreements to comply with the updated requirements in Circular CSSF 22/806 and the new Circular CSSF 25/882, particularly for ICT outsourcing.
