CSSF Circular 26/915 — Applicability of DORA to third-country branches (amending Circulars CSSF 20/750, 22/806, 25/881, 25/882, 25/883, 25/892 and 25/893).

Who is concerned?

This circular is broken down into 3 sections analysed one by one, each with the official text and Luxgap practical guidance for compliance in Luxembourg.

Key obligations

Since 27 August 2026, with immediate effect, third-country branches in Luxembourg fall within the scope of DORA: full exclusion from Circular 20/750, removal from the ICT part of 22/806, inclusion in Circulars 25/882, 25/892 and 25/893.

Luxgap supports CSSF-supervised entities (banks, PFS, payment and e-money institutions, management companies, funds) in complying with this circular: gap analysis, policy and register updates, CSSF inspection readiness, articulation with the DORA Regulation and the NIS 2 framework where relevant.

Deadlines

See the official CSSF text for precise application dates. Most recent ICT circulars articulate with the DORA Regulation, applicable since 17 January 2025.

Sanctions for non-compliance

Non-compliance exposes entities to CSSF administrative sanctions: injunctions, pecuniary sanctions, restrictions or suspension of authorisation.

How Luxgap helps

Since 27 August 2026, with immediate effect, third-country branches in Luxembourg fall within the scope of DORA: full exclusion from Circular 20/750, removal from the ICT part of 22/806, inclusion in Circulars 25/882, 25/892 and 25/893.

Luxgap supports CSSF-supervised entities (banks, PFS, payment and e-money institutions, management companies, funds) in complying with this circular: gap analysis, policy and register updates, CSSF inspection readiness, articulation with the DORA Regulation and the NIS 2 framework where relevant.