Recital 15
Digital Operational Resilience Act · UE 2022/2554
| (15) | Directive (EU) 2016/1148 of the European Parliament and of the Council (7) was the first horizontal cybersecurity framework enacted at Union level, applying also to three types of financial entities, namely credit institutions, trading venues and central counterparties. However, since Directive (EU) 2016/1148 set out a mechanism of identification at national level of operators of essential services, only certain credit institutions, trading venues and central counterparties that were identified by the Member States, have been brought into its scope in practice, and hence required to comply with the ICT security and incident notification requirements laid down in it. Directive (EU) 2022/2555 of the European Parliament and of the Council (8) sets a uniform criterion to determine the entities falling within its scope of application (size-cap rule) while also keeping the three types of financial entities in its scope. |
In Luxembourg, the law of 28 July 2023 transposing NIS 2 designates the ILR (Luxembourg Institute of Regulation) as competent authority for non-financial essential and important entities, while the CSSF remains the sole authority for all financial entities under DORA. A Luxembourg bank, a PFS or a regulated fintech therefore deals only with the CSSF, never with the ILR, even for ICT incidents.
Luxgap practice: systematically verify the CSSF licence number of each group entity before any incident notification, since misrouting a notification (ILR instead of CSSF) may be qualified as a failure to notify within the legal deadlines.
