Recital 28
Digital Operational Resilience Act · UE 2022/2554
| (28) | The extensive use of ICT services is evidenced by complex contractual arrangements, whereby financial entities often encounter difficulties in negotiating contractual terms that are tailored to the prudential standards or other regulatory requirements to which they are subject, or otherwise in enforcing specific rights, such as access or audit rights, even when the latter are enshrined in their contractual arrangements. Moreover, many of those contractual arrangements do not provide for sufficient safeguards allowing for the fully-fledged monitoring of subcontracting processes, thus depriving the financial entity of its ability to assess the associated risks. In addition, as ICT third-party service providers often provide standardised services to different types of clients, such contractual arrangements do not always cater adequately for the individual or specific needs of financial industry actors. |
In Luxembourg, the CSSF anticipated DORA via CSSF circular 22/806 on outsourcing arrangements, which remains applicable and cumulates with DORA since 17 January 2025. The CSSF notably requires prior notification for any critical ICT outsourcing and maintains the register of designated providers. The law of 1 August 2024 implementing DORA designates the CSSF and the CAA as competent authorities depending on the sector (banks, PFS, insurance).
Luxgap practice: if you are a Luxembourg fintech or PFS, your DORA article 28(3) information register must be maintained in parallel with the CSSF 22/806 outsourcing dashboard and reconciled quarterly, otherwise you face dual sanctions.
