I need to bring my Luxembourg organisation into compliance with recital 50 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 50 DORA — Recital 50 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 50

Digital Operational Resilience Act · UE 2022/2554

(50)

While this Regulation allows financial entities to determine their recovery time and recovery point objectives in a flexible manner and hence to set such objectives by fully taking into account the nature and the criticality of the relevant functions and any specific business needs, it should nevertheless require them to carry out an assessment of the potential overall impact on market efficiency when determining such objectives.

Luxembourg specificity

circulaires CSSF 24/847 et 22/806

In Luxembourg, the CSSF expects an explicit articulation of RTO/RPO with national financial system functions: participation in LuxCSD, Clearstream Banking Luxembourg, UCITS/AIF depositary status, and access to TARGET2-LU via the BCL. CSSF Circular 24/847 on ICT incident management and CSSF Circular 22/806 on outsourcing specify that the justification of recovery objectives must be documented and take into account the effect on the Luxembourg financial centre as a whole.

Luxgap practice: we calibrate your RTO/RPO by cross-referencing your real activity (UCITS subscription/redemption volumes, asset custody, payment services) with the mapping of Luxembourg market infrastructures to produce a CSSF-ready reasoning file.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 50 informs the interpretation of Article 12 of DORA on backup and recovery policies. The trap that the CSSF sanctions is the financial entity that sets RTO and RPO solely on the basis of internal tolerance or storage cost, without assessing the systemic impact on the market. A depositary bank that allows itself 48 hours to restore its settlement service exposes the entire Luxembourg post-trade chain. Recital 50 therefore imposes an externalised reading of RTO/RPO: it is no longer an IT parameter, it is a financial stability parameter.

The 'market efficiency' test: how to argue it before the CSSF

For an RTO/RPO to be defensible under Recital 50, it must rely on a documented analysis crossing four dimensions:

The business criticality of the function (critical or important function within the meaning of Article 8(1) DORA).
The market interdependencies: participation in TARGET2, CSDR, central counterparty, UCITS depositary, account-keeping custodian.
The settlement cycles (T+1, T+2) and cut-off times that make a late recovery useless.
The contagion effect on other financial entities that are clients, counterparties or users of the function.

An RTO set without this analysis will be reclassified by the CSSF as non-compliant with the spirit of Recital 50, even if the absolute figure seems reasonable. The traceability of the reasoning matters as much as the figure itself.

How Luxgap automates this risk

Our Luxgap Market Impact Calibrator turns the setting of RTO/RPO into a reasoned exercise that is enforceable before the CSSF, instead of an arbitrary figure dropped by the IT department. The tool automatically maps your critical functions by cross-referencing your DORA register, your TARGET2/T2S flows, your participation in Luxembourg market infrastructures (LuxCSD, Clearstream, BCL) and your client contracts to compute an RTO/RPO calibrated on actual systemic impact.

Detects each critical or important function by relying on your DORA function register and your business process mapping.
Models market interdependencies by connecting to SWIFT, TARGET2, T2S flows and service level agreements with your counterparties.
Computes a defensible RTO/RPO per function, with quantified contagion scenarios (how many counterparties impacted, what notional volume blocked, which cut-off rate).
Automatically generates the reasoning memorandum ready to be submitted to the CSSF during a control or a request under Article 6(8) DORA.
Reassesses your objectives quarterly based on changes in volumes, new counterparties and regulatory developments (CSDR refit, T+1).
Produces a time-stamped, cryptographically sealed PDF report, enforceable during a CSSF control or an EBA review.

Available as part of a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual critical functions, with a free blank audit within 48h to measure the defensibility of your current RTO/RPO before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 50

They trust us

Before we chat