Circular CSSF 25/893 is a CSSF circular on reporting of major ICT-related incidents and significant cyber threats under the Digital Operational Resilience Act (DORA), published 27 May 2025 and updated 28 May 2025.
\nLegal basis: Law of 10 November 2009 on payment services and electronic money.
\nRelevant for: AIFMs, AISPs, Central Securities Depositories (CSDs), Credit institutions, Crowdfunding service providers, Crypto-Assets Service Providers (CASPs), Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Investment fund managers, Issuers of ARTs, Issuers of E-Money Tokens (EMTs), Issuers of Tokens, Management companies - Chapter 15, Management companies - Chapter 16, Payment institutions, Payment institutions/electronic money institutions/AISPs, Pension funds.
\nKeywords: Cybersecurity, Information and communications technology (ICT), Information security.
\nAmended by Circular CSSF 26/915. Repeals Circular CSSF 21/787.
\non reporting of major ICTrelated incidents and significant cyber threats under the Digital Operational Resilience Act (DORA)
\non reporting of major ICT-related incidents and significant cyber threats under the Digital Operational Resilience Act (DORA) To all financial entities defined in Article 2(1)(a) to (i), (k) to (m), (p), (r) and (s), and within the meaning of Article 2(2) of Regulation (EU) 2022/2554 1 on digital operational resilience for the financial sector (hereafter “DORA”) and to all Payment Service Providers as referred to in Article 1(37) of the Law of 10 November 2009 on payment services (LPS). To all third-country branches of financial entities defined in Article 2(1)(a) to (i), (k) to (m), (p), (r) and (s), and within the meaning of Article 2(2) of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (hereafter “DORA”), if in the third country where their head office is established, they would qualify as entities listed under Article 2(1) of Regulation (EU) 2022/2554 (DORA).
\nLuxembourg, 27 May 2025 Ladies and Gentlemen, As defined in Articles 18(1), 18(2), 19(1) and 19(2) of DORA, financial entities subject to DORA are required to comply with the obligations for classifying and reporting major ICT-related incidents and, if applicable, significant cyber threats. The specifics regarding classification and reporting are detailed in the following Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS): •
\nRTS on classification of ICT-related incidents and cyber threats 2 (hereafter “RTS on classification”), and
\nRTS and ITS on incident and voluntary cyber threats reporting (hereafter “RTS on incident reporting” 3 and “ITS on incident reporting” 4)
\nFurthermore, with this circular the CSSF requires Payment Service Providers (PSPs) that are not in the scope of DORA to follow the ICT-related incident and cyber threat classification and reporting procedures under DORA in order to fulfil the reporting requirements stipulated under Article 105-2
\n1 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011
\n2 Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents
\n3 Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats 4 Commission Implementing Regulation (EU) 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat
\nof the LPS. As a simplification, these PSPs shall follow the DORA requirements for all ICT-related incidents (i.e. including ICT-related incident not related to payment services), so as to avoid a dual reporting scheme.
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}