I need to bring my Luxembourg organisation into compliance with recital 40 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 40 DORA — Recital 40 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 40

Digital Operational Resilience Act · UE 2022/2554

(40)	Since the entities referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU are excluded from the scope of that Directive, Member States should consequently be able to choose to exempt from the application of this Regulation such entities located within their respective territories.

Luxembourg specificity

loi luxembourgeoise du 8 avril 2024 portant mise en oeuvre du reglement (UE) 2022/2554 (DORA) et loi modifiee du 5 avril 1993 relative au secteur financier

In Luxembourg, the Recital 40 exemption option must be verified against the law of 8 April 2024 implementing the DORA Regulation and related CSSF circulars. The Banque centrale du Luxembourg and certain public institutions exhaustively listed in Article 2 of the amended law of 5 April 1993 on the financial sector (transposing 2013/36/EU) may benefit from the exemption, subject to express activation by the national legislator.

Luxgap practice: never self-declare outside DORA scope without a written legal opinion based on the Luxembourg implementing law. Verify with the CSSF that your licence code falls within the activated exclusion perimeter, and retain documented proof of this qualification for any subsequent audit.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 40 opens a national exemption option for entities already excluded from Directive 2013/36/EU (central banks, post office giro institutions, certain public development institutions, etc.). The trap: assuming automatic exemption because you fall within the Article 2(5) points 4 to 23 list. In practice, the exemption only exists if the Member State has explicitly activated it through legislation. The CSSF regularly audits declared scope, and an entity that believed itself out of scope can be reclassified as subject to DORA, with retroactive catch-up of all obligations (ICT register, TLPT testing, major incident management).

How to read this recital in practice

The recital creates no direct right: you must check the national transposition law to know whether Luxembourg activated the option.
The exemption, if activated, is territorial: a Luxembourg entity exempted here is not necessarily exempted for its German branch.
The 2013/36/EU Article 2(5) points 4 to 23 list targets very specific cases (Banque centrale du Luxembourg, certain public structures, mutual guarantee institutions, etc.): a precise legal mapping is required, not intuitive reading.
Even if exempted from DORA, the entity remains subject to the LPDP, GDPR, NIS 2 if classified as essential entity, and sectoral CSSF circulars on operational resilience.
A DORA exemption does not waive contractual requirements imposed by financial counterparties (ICT clauses, vendor audits).

How Luxgap automates this risk

Our Luxgap Scope Qualifier eliminates uncertainty about your DORA scope by cross-checking in real time your legal status (RCS registry, CSSF licence, NACE code) with the exclusion lists of Directive 2013/36/EU and the exemption options activated by the Luxembourg legislator. The tool queries public databases (Luxembourg RCS, CSSF supervised entities register, OJEU for delegated acts) and produces a reasoned qualification opinion in less than 5 minutes, defensible in case of audit.

Automatically detects your status under Article 2(5) points 4 to 23 of CRD IV based on your legal form and licence.
Continuously verifies whether Luxembourg has activated the Recital 40 exemption option through integrated legislative monitoring (Memorial A, Chambre des Deputes bills).
Maps residual obligations applicable despite the DORA exemption: NIS 2, GDPR, CSSF circulars 20/750, 22/806.
Generates a timestamped, electronically signed qualification memorandum, presentable to the CSSF or an external auditor.
Instantly alerts when a regulatory change or new licence modifies your scope of application.
Compares your situation to anonymised similar entities to validate the consistency of your qualification.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS brick depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual case, with a free 48h white audit to clarify your DORA exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 40

They trust us

Before we chat