CSSF Circular 25/893 — Reporting of major ICT-related incidents and significant cyber threats (DORA) (as amended by Circular CSSF 26/915).

Who is concerned?

This circular is broken down into 4 sections analysed one by one, each with the official text and Luxgap practical guidance for compliance in Luxembourg.

Key obligations

Published on 27 May 2025: who reports what to the CSSF, within which deadlines and through which channel, for a major ICT incident or significant cyber threat. Since Circular 26/915, third-country branches fall within its scope.

Luxgap supports CSSF-supervised entities (banks, PFS, payment and e-money institutions, management companies, funds) in complying with this circular: gap analysis, policy and register updates, CSSF inspection readiness, articulation with the DORA Regulation and the NIS 2 framework where relevant.

Deadlines

See the official CSSF text for precise application dates. Most recent ICT circulars articulate with the DORA Regulation, applicable since 17 January 2025.

Sanctions for non-compliance

Non-compliance exposes entities to CSSF administrative sanctions: injunctions, pecuniary sanctions, restrictions or suspension of authorisation.

How Luxgap helps

Published on 27 May 2025: who reports what to the CSSF, within which deadlines and through which channel, for a major ICT incident or significant cyber threat. Since Circular 26/915, third-country branches fall within its scope.

Luxgap supports CSSF-supervised entities (banks, PFS, payment and e-money institutions, management companies, funds) in complying with this circular: gap analysis, policy and register updates, CSSF inspection readiness, articulation with the DORA Regulation and the NIS 2 framework where relevant.