I need to bring my Luxembourg organisation into compliance with recital 37 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 37 DORA — Recital 37 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 37

Digital Operational Resilience Act · UE 2022/2554

(37)

Account information service providers, referred to in Article 33(1) of Directive (EU) 2015/2366, are explicitly included in the scope of this Regulation, taking into account the specific nature of their activities and the risks arising therefrom. In addition, electronic money institutions and payment institutions exempted pursuant to Article 9(1) of Directive 2009/110/EC of the European Parliament and of the Council (14) and Article 32(1) of Directive (EU) 2015/2366 are included in the scope of this Regulation even if they have not been granted authorisation in accordance Directive 2009/110/EC to issue electronic money, or if they have not been granted authorisation in accordance with Directive (EU) 2015/2366 to provide and execute payment services. However, post office giro institutions, referred to in Article 2(5), point (3), of Directive 2013/36/EU of the European Parliament and of the Council (15), are excluded from the scope of this Regulation. The competent authority for payment institutions exempted pursuant to Directive (EU) 2015/2366, electronic money institutions exempted pursuant to Directive 2009/110/EC and account information service providers as referred to in Article 33(1) of Directive (EU) 2015/2366, should be the competent authority designated in accordance with Article 22 of Directive (EU) 2015/2366.

Luxembourg specificity

loi modifiee du 10 novembre 2009 relative aux services de paiement

In Luxembourg, the CSSF is the competent authority designated under Article 22 PSD2, transposed by the amended law of 10 November 2009 on payment services. Small PIs exempted under its Article 48 and EMIs exempted under its Article 24-9 therefore fall directly under the CSSF for DORA, with no transfer to another authority. The CSSF confirmed in its January 2025 DORA communication that registered AISPs are fully subject to DORA requirements.

Luxgap practice: if you are an AISP or an exempted PI/EMI authorised by the CSSF, trigger a DORA scoping immediately, as the incident notification deadlines (4h initial to the CSSF) tolerate no unpreparedness.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Many small Luxembourg fintechs assume they fall outside DORA because they benefit from an exemption under PSD2 or the e-money directive (thresholds of Article 32 PSD2 or Article 9 EMD2). Recital 37 shuts that door: exempted payment institutions, exempted e-money institutions, and account information service providers (AISPs, open banking) are explicitly within DORA's scope. The CSSF applies DORA to these actors just as it does to fully authorised entities, and that is where the wake-up call is harshest: an 8-person AISP must maintain a TIC provider register, a resilience strategy, a testing programme, and notify major incidents like a bank.

The mapping to do today

To know whether you are caught, ask these concrete questions:

Are you an AISP registered with the CSSF under Article 33 PSD2 (even without full authorisation)? You are in DORA.
Are you a small PI below the 3 M EUR threshold of Article 48 of the law of 10 November 2009 (transposing Article 32 PSD2)? You are in DORA.
Are you an EMI exempted under Article 24-9 of the law of 10 November 2009? You are in DORA.
Are you a post office giro institution (historic POST Finance postal service)? You are excluded from DORA.
The competent authority remains the one designated under PSD2, i.e. the CSSF in Luxembourg, which drives both PSD2 authorisation and DORA supervision.

Concretely, an AISP fintech that until now aggregated accounts without considering itself a digital bank must now produce the same DORA deliverables as a credit institution: TIC register, risk management policy, continuity plan, TLPT penetration tests if designated by the CSSF, and major incident notification within 24h/72h/1 month.

How Luxgap automates this risk

Our Luxgap DORA Scope Sentinel answers the question that paralyses small Luxembourg fintechs: am I in DORA, and at what level of requirement?. The tool ingests your CSSF status (full authorisation, PSD2 Article 32 exemption, EMD Article 9 exemption, AISP Article 33 registration), cross-references your activity data against DORA proportionality thresholds (Article 16 simplified framework), and produces a scoping file opposable to the CSSF demonstrating your regulatory positioning and target maturity.

Automatically determines whether your entity falls under full DORA, the Article 16 simplified framework, or out of scope, based on your declared CSSF status and the actual activity observed in your systems (Stripe, Mangopay, LemonWay, Treezor, Modulr).
Detects AISPs, exempted EMIs and exempted PIs wrongly considered out of scope, and alerts management on the compliance obligation with deadline.
Generates the CSSF-preformatted TIC provider register by pulling contracts from Odoo, DocuSign, M365 and banking transactions, without manual entry.
Computes a DORA maturity score aligned with the ESAs' finalised RTS (governance, TIC risk management, incidents, testing, third parties) with prioritised remediation plan.
Produces a timestamped, cryptographically signed legal scoping note, ready to present to the CSSF during an inspection or annual questionnaire.

Available as part of a Luxgap CISO or DPO mandate or as a standalone SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your actual CSSF status, with a free 48h white audit to confirm your DORA positioning before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 37

They trust us

Before we chat