Regulation (EU) 2022/2554 · CSSF
DORA in Luxembourg: financial sector compliance.
The DORA regulation has applied since 17 January 2025 to all Luxembourg financial entities: banks, PSF, funds, insurers, asset managers, crypto-asset platforms. The CSSF is actively supervising. Luxgap supports your compliance with a team of cyber engineers and lawyers.
Who is subject to DORA in Luxembourg?
All financial entities: banks (CSSF, ECB), support PSF and specialised PSF, fund management companies (UCITS, AIFM), insurance and reinsurance companies (CAA), institutions for occupational retirement provision, crypto-asset service providers (CASPs, MiCA), crowdfunding platforms, central counterparties. But also the critical ICT providers that serve these entities (cloud, software, data centres). On the provider side, our sister company LuxOps sets out its answer to the DORA requirements for ICT providers.
In Luxembourg, more than 600 PSF are in scope, in addition to banks, funds and insurers.
In Luxembourg, more than 600 PSF are in scope, in addition to banks, funds and insurers.
What are the 5 pillars of DORA?
1. ICT governance and risk management: resilience strategy, ICT committee, management accountability.
2. ICT incidents: classification, reporting to the CSSF (initial notification 4h, intermediate report 72h, final report 1 month).
3. Resilience testing: regular (annual) testing, advanced TLPT (red team) testing for large entities every 3 years.
4. ICT third-party risk management: register of information on ICT providers, DORA-compliant contracts, exit plan, audit of critical providers.
5. Information sharing: exchange of threat intelligence between financial entities.
2. ICT incidents: classification, reporting to the CSSF (initial notification 4h, intermediate report 72h, final report 1 month).
3. Resilience testing: regular (annual) testing, advanced TLPT (red team) testing for large entities every 3 years.
4. ICT third-party risk management: register of information on ICT providers, DORA-compliant contracts, exit plan, audit of critical providers.
5. Information sharing: exchange of threat intelligence between financial entities.
How does Luxgap support DORA compliance?
DORA gap analysis: current state vs the 5 pillars, prioritised action plan, delivered within 4 weeks.
Register of information: mapping of ICT providers, critical/non-critical classification, contract remediation (mandatory DORA clauses).
Incident management policy: detection procedure, classification, CSSF reporting, post-mortem.
Testing plan: annual tests (vulnerability assessment, application pentest, incident scenario) + TLPT for the entities concerned.
Outsourced CISO mandate for operational steering.
Request a DORA quote →
Register of information: mapping of ICT providers, critical/non-critical classification, contract remediation (mandatory DORA clauses).
Incident management policy: detection procedure, classification, CSSF reporting, post-mortem.
Testing plan: annual tests (vulnerability assessment, application pentest, incident scenario) + TLPT for the entities concerned.
Outsourced CISO mandate for operational steering.
Request a DORA quote →
What sanctions and CSSF inspections apply under DORA?
The CSSF has built DORA into its 2025 supervisory programme. Breaches can lead to: administrative fines (up to 1% of annual worldwide turnover), orders to comply within a tight deadline, withdrawal of authorisation for serious, repeated breaches, personal liability of management (individual sanctions possible). Beyond the sanctions, a CSSF inspection with documented DORA gaps sends a strong signal, with consequences for your reputation and for your counterparties' trust.
Let's talk about your situation.
Quote within 24 business hours. No commitment, no sales pressure.