Circular CSSF 26/915 is a CSSF circular on the applicability of the Digital Operational Resililience Act (DORA) to third-country branches in Luxembourg, published 27 August 2026.
\nLegal basis: Law of 5 April 1993 on the financial sector, Law of 15 December 2000 on postal services and postal financial services, Law of 10 November 2009 on payment services and electronic money, Law of 17 December 2010 on undertakings for collective investment.
\nRelevant for: AIFMs, AISPs, Central Securities Depositories (CSDs), Credit institutions, Crowdfunding service providers, Crypto-Assets Service Providers (CASPs), Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Investment fund managers, Management companies - Chapter 15, Management companies - Chapter 16, Payment institutions, Payment institutions/electronic money institutions/AISPs, Pension funds, Specialised PFS, Support PFS.
\nMain topic: DORA. Keywords: Information security.
\nAmends Circular CSSF 20/750, Circular CSSF 22/806, Circular CSSF 25/881, Circular CSSF 25/882, Circular CSSF 25/883, Circular CSSF 25/892, Circular CSSF 25/893.
\nCircular CSSF 26/915 amending Circulars CSSF 20/750, 22/806, 25/881, 25/882, 25/883, 25/892 and 25/893
\non the applicability of the Digital Operational Resilience Act (DORA) to third-country branches in Luxembourg
\nCircular CSSF 26/915 amending Circulars CSSF 20/750, 22/806, 25/881, 25/882, 25/883, 25/892 and 25/893
\non the applicability of the Digital Operational Resilience Act (DORA) to third-country branches in Luxembourg
\nTo all financial entities defined in Article 2(1)(a) to (i), (k) to (m), (p), (r) and (s), and within the meaning of Article 2(2) of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector 1 (DORA). To all third-country branches of financial entities defined in Article 2(1)(a) to (i), (k) to (m), (p), (r) and (s), and within the meaning of Article 2(2) of DORA, if in the third country where their head office is established, they would qualify as entities listed under Article 2(1) (a) to (t) of DORA. To all support PFS and specialised PFS within the meaning of the Law of 5 April 1993 on the financial sector (LFS). To POST Luxembourg governed by the Law of 15 December 2000 on postal financial services and in its role as Payment Service Provider as referred to in Article 1(37) of the Law of 10 November 2009 on payment services (LPS). To all management companies authorised only under Article 125-1 of Chapter 16 of the Law of 17 December 2010 relating to undertakings for collective investment (UCITS Law).
\nLuxembourg, 27 August 2026
\nLadies and Gentlemen, As of 17 January 2025, the provisions of DORA are applicable to the financial entities as defined in DORA and supervised by the CSSF. To fully reflect DORA provisions across the regulatory governance landscape of all regulated entities various CSSF circulars were updated, respectively published. On 17 December 2025, the European Commission confirmed that DORA is also applicable to thirdcountry branches (TCBs) in an EU country, if in the third country where their head office is established, they would qualify as entities listed under Article 2(1)(a) to (t) of DORA 2. Consequently, an update of a series of circulars published or modified in 2025 is required to include TCBs in the DORA scope. Furthermore, the CSSF included in the frame of this update a precision regarding the reporting of major ICT-related incidents and cyber threats in case entities cannot use the prescribed communication channel.
\nRegulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 2
\nRefer to DORA Q&A 102: DORA102 - 3097 - European Insurance and Occupational Pensions Authority
\nCIRCULAR CSSF 26/915 amending Circulars CSSF 20/750, 22/806, 25/881, 25/882, 25/883, 25/892 and 25/893
\nTABLE OF CONTENTS Chapter 1: Scope ................................................................................................................ 4 Chapter 2: Applicability to Third-Country Branches (TCBs) under DORA ..................................... 5 Chapter 3: Date of application ..............................................................................................
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}