I need to bring my Luxembourg organisation into compliance with recital 23 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 23 DORA — Recital 23 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 23

Digital Operational Resilience Act · UE 2022/2554

(23)

To reduce the administrative burden and potentially duplicative reporting obligations for certain financial entities, the requirement for the incident reporting pursuant to Directive (EU) 2015/2366 of the European Parliament and of the Council (12) should cease to apply to payment service providers that fall within the scope of this Regulation. Consequently, credit institutions, e-money institutions, payment institutions and account information service providers, as referred to in Article 33(1) of that Directive, should, from the date of application of this Regulation, report pursuant to this Regulation, all operational or security payment-related incidents which have been previously reported pursuant to that Directive, irrespective of whether such incidents are ICT-related.

Luxembourg specificity

loi du 1er aout 2024 portant mise en oeuvre du reglement (UE) 2022/2554 (DORA) et circulaire CSSF 24/847

In Luxembourg, the CSSF is the single competent authority for receiving DORA notifications from PSPs established in the country. The law of 1 August 2024 implementing the DORA Regulation and CSSF Circular 24/847 (incident reporting framework) specify that the CSSF eDesk portal becomes the exclusive channel from 17 January 2025, replacing the former PSD2 setup (CSSF Circular 21/787 as amended). EMIs and PIs authorised under the amended law of 10 November 2009 on payment services switch in full.

Luxgap practice: we reconfigure your escalation matrix to point to CSSF eDesk with DORA thresholds and we archive a signed migration attestation, enforceable during the next CSSF on-site inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 23 formalises the end of double reporting: payment service providers (PSPs) that used to notify incidents under PSD2 (Article 96) move entirely under DORA from its date of application. In practice, the CSSF penalises two symmetric mistakes: PSPs that keep notifying through the PSD2 channel when they should use the DORA channel, and PSPs that only notify ICT-related incidents while forgetting that DORA also captures operational or security payment-related incidents that are not ICT-related (internal fraud, ATM failure, reconciliation error). The scope widens, it does not shrink.

Practical pitfalls of the PSD2 to DORA switch

Broader material scope: DORA captures all payment-related incidents, whether ICT or not. A human input error or a payment fraud remains notifiable.
Entities concerned: credit institutions, e-money institutions, payment institutions and account information service providers referred to in Article 33(1) PSD2.
Single CSSF channel: one entry point for major ICT incidents and operational or security payment-related incidents, using DORA thresholds and deadlines (initial, intermediate, final notification).
Gap risk during the switch: internal procedures still referring to EBA guidelines on PSD2 must be rewritten to point to DORA and its RTS.
Classification documentation: each incident must be classified under DORA criteria (clients affected, duration, data loss, criticality) and no longer under the PSD2 grid.

How Luxgap automates this risk

Our Luxgap Incident Bridge PSD2-DORA eliminates the risk of double reporting and notification gaps during the regulatory switch. The AI agent monitors your payment systems in real time (Worldline, Equensworldline, eBRC PaymentHub, Six BBS, SWIFT connectors, Odoo and Sage BOB 50 payment modules) and reclassifies every detected event under the DORA grid, while automatically shutting down the obsolete PSD2 channel to the CSSF.

Detects every operational or security payment-related incident through native integration with Luxembourg core banking systems and payment gateways (POST Luxembourg, LuxHub, eBRC).
Automatically classifies the incident against DORA criteria (clients impacted, duration, data loss, reputation) and computes in real time whether it crosses the major incident threshold.
Blocks any residual notification attempt through the PSD2 channel and redirects the workflow to the CSSF DORA portal, with timestamped decision logging.
Generates the three DORA reports (initial, intermediate, final) prefilled from system logs, with strict respect of the regulatory deadlines.
Produces a cryptographically sealed audit log, enforceable before the CSSF, demonstrating the complete migration of incident reporting from PSD2 to DORA across every group entity.
Alerts the CISO and the compliance officer via Teams or Slack as soon as an incident crosses the threshold, with an automatic notification template proposal.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request your demonstration and our teams will prepare a free 48h white audit of your current payment incident notification process to measure your double-reporting exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 23

They trust us

Before we chat