Published on 27 August 2026
Communiqué

Application of the Digital Operational Resilience Act (DORA) to third-country branches in Luxembourg

As of 17 January 2025, the provisions of the Digital Operational Resilience Act1 (“DORA”) are applicable to the financial entities as defined in DORA and supervised by the CSSF. On 17 December 2025, the European Commission confirmed, via an official DORA Q&A2, that DORA is also applicable to third-country branches (“TCBs”) in an EU country, if in the third country where their head office is established, they would qualify as entities listed under Article 2(1)(a) to (t) of DORA.

Consequently, an update of a series of circulars published or modified in 2025 is required to include TCBs in the DORA scope.

Furthermore, the CSSF included in the frame of this update a precision regarding the reporting of major ICT-related incidents and cyber threats in case entities cannot use the prescribed communication channel.

The modifications are visualised in purple in the below graphic:

The following modifications have been made to the enumerated circulars:

  1. Removal of TCBs from the scope of the following circulars (or part thereof):

 

  1. Inclusion of TCBs in the scope of the following circulars applicable to DORA entities:

 

  1. To avoid inconsistencies and align with the above changes, modification of the two “amending circulars” which were used to modify the “pre-DORA CSSF circulars” when DORA entered into application:

For any further questions please contact ictrisksupervision@cssf.lu or, in case of third-country branches of credit intuitions banking_ict_risk@cssf.lu.

1 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011

2 Refer to DORA Q&A 102: DORA102 – 3097 – European Insurance and Occupational Pensions Authority

New Circular CSSF 26/915