I need to bring my Luxembourg organisation into compliance with recital 33 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 33 DORA — Recital 33 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 33

Digital Operational Resilience Act · UE 2022/2554

(33)

In addition, doubts about the type of information that can be shared with other market participants, or with non-supervisory authorities (such as ENISA, for analytical input, or Europol, for law enforcement purposes) lead to useful information being withheld. Therefore, the extent and quality of information sharing currently remains limited and fragmented, with relevant exchanges mostly being local (by way of national initiatives) and with no consistent Union-wide information-sharing arrangements tailored to the needs of an integrated financial system. It is therefore important to strengthen those communication channels.

Luxembourg specificity

loi du 1er aout 2024 portant mise en oeuvre du reglement (UE) 2022/2554 (DORA) et circulaire CSSF 22/806

In Luxembourg, the CSSF frames cyber information sharing via CSSF Circular 22/806 on ICT outsourcing and the TIBER-LU framework for intelligence-based penetration testing. The law of 1 August 2024 implementing the DORA Regulation clarifies that sharing with peers does not breach the professional secrecy of Article 41 of the law of 5 April 1993 on the financial sector, provided it is carried out within the formalised framework of DORA Article 45.

Luxgap practice: we map your sharing matrix with the CSSF, BCL, CERT.LU, HCPN and sectoral communities (ABBL, ALFI, FS-ISAC), and we document the articulation with Article 41 LSF to secure each flow in case of inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 33 sheds light on DORA Article 45 regarding information-sharing arrangements between financial entities. In practice, the CSSF observes that Luxembourg banks and fintechs withhold indicators of compromise (IoCs) out of legal fear: GDPR, banking secrecy under Article 41 of the LSF, competition law. As a result, the same threat actor hits several Place financiere players in succession without any sharing. The European legislator wants to break this silo by securing exchanges with ENISA, Europol, and sectoral peers.

What this recital changes in practice

It legitimises sharing IoCs, TTPs and weak signals with other financial entities, even competitors, without fearing a banking secrecy or GDPR breach (Article 6(1)(f) base reinforced by DORA's public interest).
It distinguishes recipients: supervisory authorities (CSSF, ECB), non-supervisory authorities for analytical input (ENISA), law enforcement (Europol, Luxembourg Police cybercrime section).
It requires structuring communication channels, meaning a written procedure that qualifies each outbound flow: what, to whom, on what basis, with what anonymisation.
It foreshadows the sectoral Threat Intelligence Sharing Communities the CSSF promotes via Circular 22/806 and the TIBER-LU framework.

How Luxgap automates this risk

Our Luxgap Threat Intel Exchange turns your SOC into a qualified sharing node that knows what to send, to whom, and under what legal basis, without ever accidentally exposing sensitive data. The tool interfaces with Microsoft Sentinel, CrowdStrike Falcon, Wazuh and MISP to pull your IoCs in real time, anonymise them according to the recipient profile (ENISA, Europol, CSSF sectoral peers, FS-ISAC) and generate the opposable legal trace.

Automatically classifies each IoC by TLP (White, Green, Amber, Red) and determines authorised recipients based on your DORA Article 45 matrix.
Anonymises personal data and banking secrecy before emission, applying ENISA-recommended techniques (hashing, generalisation, k-anonymity).
Generates the written legal basis for each share (DORA Article 45 legitimate interest, legal obligation, ENISA analytical purpose), timestamped and cryptographically signed.
Alerts the DPO and CISO in real time whenever a share leaves the defined scope, with automatic blocking if the TLP is incompatible.
Produces an exchange register opposable to the CSSF during a DORA inspection, demonstrating the maturity of your Article 45 framework.
Natively connects to the TIBER-LU, FS-ISAC Europe and MISP-LU communities for sectoral dissemination.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real SOC flows, with a free 48-hour white audit to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 33

They trust us

Before we chat