The latest changes to ICT and DORA rules: CSSF circulars, Luxembourg laws and EU acts. Tap an item for details. Summaries marked “AI-generated” were written automatically by an AI language model. Data as of Today 13:20.
Latest ICT / DORA changes · 10
-
Aug 202627Amendment CSSF 26/915 LU
On the applicability of the Digital Operational Resilience Act (DORA) to third-country branches in Luxembourg
Changes CSSF 22/806, CSSF 25/881, CSSF 25/882, CSSF 25/892, CSSF 25/893
What it changes
- CSSF 22/806 Circular CSSF 22/806 on outsourcing arrangements
- CSSF 25/881 Circular CSSF 25/881 amending Circular CSSF 20/750 on requirements regarding information and communication...
- CSSF 25/882 Circular CSSF 25/882 on requirements on the use of ICT third-party services for Financial Entities subject...
- CSSF 25/892 Circular CSSF 25/892 Application of the Joint ESA Guidelines on the estimation of aggregated annual costs...
- CSSF 25/893 Circular CSSF 25/893 on reporting of major ICT-related incidents and significant cyber threats under the...
Key dates
- Published
- 27 Aug 2026
In force CSSF ICT third-party risk -
Dec 202516Amendment CSSF 25/900 LU
Amending Circular CSSF 22/811.
Changes CSSF 22/811
What it changes
- CSSF 22/811 Circular CSSF 22/811 Authorisation and organisation of entities acting as UCI administrators
Key dates
- Published
- 16 Dec 2025
In force CSSF ICT risk management -
Apr 20258New circular CSSF 25/879 LU
Adoption of the EBA Guidelines on information requirements in relation to transfers of funds and certain crypto-assets transfers under Regulation (EU) 2023/1113 (“Travel Rule Guidelines”)
Key dates
- Published
- 8 Apr 2025
In force CSSF Information sharing -
Mar 202524New RTS Regulation (EU) 2025/532 EU
Commission Delegated Regulation (EU) 2025/532 of 24 March 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the elements that a financial entity has to determine and assess when subcontracting ICT services supporting critical or important functions
-
Feb 202513New RTS Regulation (EU) 2025/1190 EU
Commission Delegated Regulation (EU) 2025/1190 of 13 February 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria used for identifying financial entities required to perform threat-led penetration testing, the requirements and standards governing the use of internal testers, the requirements in relation to the scope, testing methodology and approach for each phase of the testing, results, closure and remediation stages and the type of supervisory and other relevant cooperation needed for the implementation of TLPT and for the facilitation of mutual recognition
-
Dec 202416New RTS Regulation (EU) 2025/420 EU
Commission Delegated Regulation (EU) 2025/420 of 16 December 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards to specify the criteria for determining the composition of the joint examination team ensuring a balanced participation of staff members from the ESAs and from the relevant competent authorities, their designation, tasks and working arrangements
-
Nov 202429New ITS Regulation (EU) 2024/2956 EU
Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to standard templates for the register of information
-
Oct 202424New RTS Regulation (EU) 2025/295 EU
Commission Delegated Regulation (EU) 2025/295 of 24 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards on harmonisation of conditions enabling the conduct of the oversight activities
-
Oct 202423New ITS Regulation (EU) 2025/302 EU
Commission Implementing Regulation (EU) 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat
-
Oct 202423New RTS Regulation (EU) 2025/301 EU
Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats