I need to bring my Luxembourg organisation into compliance with recital 54 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 54 DORA — Recital 54 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 54

Digital Operational Resilience Act · UE 2022/2554

(54)

This Regulation should require credit institutions, payment institutions, account information service providers and electronic money institutions to report all operational or security payment-related incidents – previously reported under Directive (EU) 2015/2366 – irrespective of the ICT nature of the incident.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2024 portant mise en oeuvre du reglement (UE) 2022/2554 (DORA)

In Luxembourg, the CSSF is the competent authority for both PSD2 reporting (transposed by the amended law of 10 November 2009 on payment services) and DORA reporting. The law of 1 August 2024 implementing the DORA regulation confirms the CSSF as the single window and requires operational consistency between both channels.

Luxgap practice: use the CSSF eDesk portal as the single submission reference and keep the timestamped filing proof of both notifications in a defensible digital vault.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 54 closes a door many payment institutions still believed was open: assuming that a payment incident with no ICT component (wire fraud, manual validation breakdown, back-office human error) escapes DORA reporting. The CSSF already penalises the dual-standard reporting gap between PSD2 and DORA: an incident reported under Directive (EU) 2015/2366 must also flow through the DORA pipeline, even if it has no ICT nature. Credit institutions, PIs, AISPs and EMIs that maintain two separate, non-reconciled reporting chains expose themselves to inconsistencies the CSSF detects immediately during quarterly coherence checks.

The PSD2 / DORA duality trap

An instant-payment fraud incident with no ICT cause remains reportable under DORA through the recital 54 bridge.
PSD2 and DORA materiality thresholds are not aligned: an incident below the DORA ICT threshold may exceed the PSD2 payment threshold, and vice versa.
Deadlines differ: PSD2 initial notification within 4h, DORA notification depending on the major incident classification (RTS classification).
The CSSF expects a unified view: the same incident must never appear in one channel and be missing from the other.
Traceability of the 'PSD2 only / DORA only / both' decision must be documented and defensible.

How Luxgap automates this risk

Our Luxgap Incident Dual-Track Router eliminates the PSD2/DORA grey zone by automatically classifying every operational or payment-security incident and triggering both reporting chains in parallel from a single entry. The tool plugs into your monitoring stack (Splunk, Microsoft Sentinel, ServiceNow ITSM, your core banking Temenos or Sopra, your payment platforms Worldline or equensWorldline) and runs a rules engine based on the DORA classification RTS and the EBA/GL/2021/03 PSD2 reporting guidelines.

Detects every payment incident as soon as it is logged in the system and simultaneously applies the PSD2 and DORA qualification grids without manual intervention.
Auto-generates both pre-filled notifications (CSSF PSD2 form and DORA major template) with timestamped initial, intermediate and final stages.
Alerts the compliance team in real time via Teams or Slack when an incident crosses either materiality threshold, with a visible countdown on regulatory deadlines.
Reconciles both registers daily to detect any inconsistency (a PSD2 incident with no DORA counterpart or vice versa) and produces a defensible gap log.
Produces a cryptographically signed, timestamped PDF report defensible before the CSSF during an inspection, demonstrating consistency between both reporting chains over a rolling 24-month window.

Available as a complement to a Luxgap CISO mandate or as a standalone SaaS brick depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your real incidents from the last 12 months, with a free 48-hour white audit to measure the gaps between your PSD2 and DORA chains before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 54

They trust us

Before we chat