Circular CSSF 25/892 is a CSSF circular, published 27 May 2025 and updated 28 May 2025. Subject: Application of the Joint ESA Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554 (JC 2024 34).
\nRelevant for: AIFMs, AISPs, Central Securities Depositories (CSDs), Credit institutions, Crowdfunding service providers, Crypto-Assets Service Providers (CASPs), Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Investment fund managers, Issuers of ARTs, Issuers of E-Money Tokens (EMTs), Issuers of Tokens, Management companies - Chapter 15, Management companies - Chapter 16, Payment institutions, Payment institutions/electronic money institutions/AISPs, Pension funds.
\nKeywords: Cybersecurity, Information and communications technology (ICT), Information security.
\nAmended by Circular CSSF 26/915.
\nApplication of the Joint ESA Guidelines on the estimation of aggregated annual costs and losses caused by major ICTrelated incidents under Regulation (EU) 2022/2554 (JC 2024 34)
\nApplication of the Joint ESA Guidelines on the estimation of aggregated annual costs and losses caused by major ICT-related incidents under Regulation (EU) 2022/2554 (JC 2024 34) To all financial entities defined in Article 2(1)(a) to (i), (k) to (m), (p), (r) and (s), and within the meaning of Article 2(2) of Regulation (EU) 2022/2554 1 on digital operational resilience for the financial sector (hereafter “DORA”).To all third-country branches of financial entities defined in Article 2(1)(a) to (i), (k) to (m), (p), (r) and (s), and within the meaning of Article 2(2) of DORA, if in the third country where their head office is established, they would qualify as entities listed under Article 2(1) (a) to (t) of DORA.
\nLuxembourg, 27 May 2025
\nLadies and Gentlemen, The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, applies the Joint Guidelines of the European Supervisory Authorities (ESAs) on the estimation of aggregated annual costs and losses caused by major ICT-related incidents referred to in Article 11(11) of DORA (i.e. JC/GL/2024/34; hereafter the “Guidelines”). This circular is divided into three chapters: •
\nChapter 1 defines the scope of application;
\nChapter 2 clarifies the reporting obligation to the CSSF;
\nChapter 3 provides for the entry into force of this circular.
\nThe guidelines are attached as an annex to this circular.
\nRegulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011
\nChapter 1:
\nScope of application
\ncrypto-asset service providers and issuers of asset-referenced tokens within the meaning of Regulation (EU) 2023/1114;
\nd) central securities depositories within the meaning of the Law of 6 June 2018 on central securities depositories; e) central counterparties within the meaning of the Law of 15 March 2016 on OTC derivatives, central counterparties and trade repositories; f)
\nmanagement companies incorporated under Luxembourg law and subject to Chapter 15 or Article 125-2 of Chapter 16, and Luxembourg branches of investment fund managers subject to Chapter 17, and investment companies which did not designate a management company within the meaning of Article 27 of the Law of 17 December 2010 relating to undertakings for collective investment;
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}