Search in:

Search for information (3 characters minimum)

All content Regulatory framework Publication and data

Direct links

Loading...

Entities

Access the database

Loading...

Search Entities
Managed File Transfer (MFT)
Whistleblowing
Customer complaint
Public register of the audit profession
eDesk – EN
EBA and ESMA Guidelines and Recommendations

Skip to content

Loading...

Contrasts

About the CSSF
Careers
Whistleblowing
Contact

fr
en

Loading...

Entity types
Topics
Regulatory framework
Publication and Data

CSSF Search & Toolbox

Open the search or access the CSSF tools and applications

Published on 27 August 2026

Email this
Share this on LinkedIn
Share this on Facebook

CSSF circular

Circular CSSF 26/915

on the applicability of the Digital Operational Resililence Act (DORA) to third-country branches in Luxembourg

PDF (831.22Kb)

PDF (659.09Kb)

Keywords

Information security

Main topic:

ICT and cyber risk – for DORA entities

Relevant for

Central Securities Depositories (CSDs)
Credit institutions
Crowdfunding service providers
Crypto-Assets Service Providers (CASPs)
Data Reporting Service Providers (DRSPs)
Investment firms
Investment fund managers
Payment institutions/electronic money institutions/AISPs
Pension fund
Specialised PFS
Support PFS

Related documents

28 May 2025 - Updated on 27 August 2026

Circular CSSF 25/893 (as amended by Circular CSSF 25/915)

on reporting of major ICT-related incidents and significant cyber threats under the Digital Operational Resilience Act (DORA)

PDF (193.87Kb)

PDF (152.7Kb)
28 May 2025 - Updated on 27 August 2026

Circular CSSF 25/892 (as amended by Circular CSSF 26/915)

Application of the Joint ESA Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554 (JC 2024 34)

PDF (370.01Kb)

PDF (593.82Kb)
9 April 2025 - Updated on 27 August 2026

Circular CSSF 25/883 (as amended by Circular CSSF 26/915)

amending Circular CSSF 22/806 on outsourcing arrangements

PDF (972.67Kb)

PDF (979.81Kb)
9 April 2025 - Updated on 27 August 2026

Circular CSSF 25/882 (as amended by Circular CSSF 26/915)

on requirements on the use of ICT third-party services for Financial Entities subject to the Digital Operational Resilience Act (DORA)

PDF (233.34Kb)

PDF (265.36Kb)
9 April 2025 - Updated on 27 August 2026

Circular CSSF 25/881 (as amended by Circular CSSF 26/915)

amending Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management

PDF (552.07Kb)

PDF (531.8Kb)
22 April 2022 - Updated on 27 August 2026

Circular CSSF 22/806 (as amended by Circulars CSSF 25/883 and CSSF 26/915)

on outsourcing arrangements

PDF (616.78Kb)

PDF (666.76Kb)
25 August 2020 - Updated on 27 August 2026

Circular CSSF 20/750 (as amended by Circulars CSSF 22/828, 25/881 and 26/915)

Requirements regarding information and communication technology (ICT) and security risk management

PDF (291.5Kb)

PDF (238.54Kb)

Follow us

Follow us on LinkedIn
Follow us on Vimeo

Contact
Help
Useful links
Subscribe
RSS feed
Press Room
Terms of Service and Privacy Policy
Manage Cookies
Accessibility

All rights reserved.
Copyright © Commission de Surveillance du Secteur Financier, Luxembourg

We use cookies to ensure that we give you the best experience on our website. By clicking “Accept all”, you consent to the use of all of the cookies.

Cookie settings

Cookie settings

We use cookies to improve your experience while you navigate our website. Strictly necessary cookies are stored in your browser as they are essential for the website to function. Other cookies further improve your experience and help us analyse how users interact with our website by collecting anonymous data. These cookies will only be stored in your browser with your consent.

Necessary cookies: Allow

These technical cookies only store anonymous data and are necessary for the website to function. These cannot be disabled.

Name	Description	Duration
cssf_cookies	Saves information regarding the user's consent to the use of cookies for each optional category.	1 year
ROUTEID	Technical cookie allowing load distribution.	Deleted when the browsing session ends
TBMCookie*	Security: This cookies protects the website against automated attacks.	Deleted when the browsing session ends
__utmvc	These first party cookies are set by a third party service to filter out malicious requests.	Deleted when the browsing session ends
__utmvm*	These first party cookies are set by a third party service to filter out malicious requests.	15 minutes

Functional cookies: Allow

Functional cookies provide enhanced functionality and improve your experience when you navigate our website. They may be set by us or by third party providers whose services are included in some of our pages. Disabling these cookies may affect your experience and some services may not function properly.

Name	Description	Duration
cssf_profile	This cookie adapts the website pages to the profile chosen by the visitor (professionals, markets, consumers).	1 year
pll_language	This cookie saves the user’s language choice.	1 year

Performance cookies: Allow

Performance cookies help us collect anonymous statistical data such as the number of visits, the average time spent on the website or the pages consulted during a browsing session. The information is aggregated and anonymous, and allows us to monitor and improve the performance of our website.

Name	Description	Duration
_pk_id.#	Collects anonymous statistical data on the website consultations, such as the number of visits or the average time spent on the website. The data is processed in-house and is not shared with a third party.	1 year
_pk_ses.#	Collects anonymous statistical data for the tracking of the pages consulted during the browsing session. The data is processed in-house and is not shared with a third party.	30 minutes

SoundCloud: Allow

This content from a third party provider has been blocked. By allowing this content to load, you agree with the terms of SoundCloud's cookie usage and privacy policy