I need to bring my Luxembourg organisation into compliance with recital 89 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 89 sheds light on a point often misunderstood by Luxembourg financial entities: the designation of a critical ICT third-party service provider (CTPP) by the ESAs is not a unilateral act, but an adversarial procedure with rights of defence. In practice, many financial entities supervised by the CSSF discover too late that their hyperscaler or core banking provider is actively contesting the Lead Overseer's recommendations, and that this contestation opens a window of operational uncertainty of several months over existing contractual arrangements.How this recital concretely influences implementationIt frames DORA articles 31 to 44: the Lead Overseer (ESA in charge) must grant a right to be heard before designation, and a right of explanation before recommendation.It introduces an operational risk for the client financial entity: if the CTPP refuses a recommendation and publishes a reasoned statement, or if the Lead Overseer issues a public notice of non-compliance, the financial entity must immediately reassess its exit strategy (article 28(8)).It requires continuous monitoring of ESA publications (register of designated CTPPs, public notices of non-compliance, formalised disagreements).It mandates anticipating the impact on customers outside DORA scope (non-regulated subsidiaries, joint ventures, corporate clients) sharing the same critical ICT infrastructure.For the CSSF, the competent Luxembourg authority under article 46, this means it will expect from the financial entity documented proof of monitoring the status of each critical provider.How Luxgap automates this riskOur Luxgap Critical Provider Radar turns passive monitoring of CTPP designations into a real-time alert system opposable to the CSSF. The tool continuously ingests the public register of critical third-party providers published by the ESAs, Lead Overseer non-compliance notices, reasoned disagreement statements, and cross-references these feeds with your DORA article 28(3) register of information, Azure Resource Graph, AWS Organizations and your contract repository in Odoo or SAP Ariba, to instantly materialise your entity's real exposure.Detects within 24 hours any new CTPP designation affecting a provider present in your DORA register of information, with Teams or email notification to the CISO and DPO.Calculates an exposure score per legal entity within the group, weighted by criticality of the supported ICT function (CORE, IMPORTANT, ACCESSORY per your article 8 classification).Automatically generates an exit strategy reassessment file under article 28(8) as soon as a public notice of non-compliance is issued by the Lead Overseer.Tracks reasoned disagreement statements published by CTPPs and alerts on contractual recommendations not followed that impact your ongoing arrangements.Produces a timestamped, cryptographically sealed PDF report, opposable to the CSSF during a prudential review, demonstrating the continuous monitoring required by article 28...

Recital 89 DORA — Recital 89 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 89

Digital Operational Resilience Act · UE 2022/2554

(89)

Due to the significant impact of being designated as critical, this Regulation should ensure that the rights of critical ICT third-party service providers are observed throughout the implementation of the Oversight Framework. Prior to being designated as critical, such providers should, for example, have the right to submit to the Lead Overseer a reasoned statement containing any relevant information for the purposes of the assessment related to their designation. Since the Lead Overseer should be empowered to submit recommendations on ICT risk matters and suitable remedies thereto, which include the power to oppose certain contractual arrangements ultimately affecting the stability of the financial entity or the financial system, critical ICT third-party service providers should also be given the opportunity to provide, prior to the finalisation of those recommendations, explanations regarding the expected impact of the solutions, envisaged in the recommendations, on customers that are entities falling outside the scope of this Regulation and to formulate solutions to mitigate risks. Critical ICT third-party service providers disagreeing with the recommendations should submit a reasoned explanation of their intention not to endorse the recommendation. Where such reasoned explanation is not submitted or where it is considered to be insufficient, the Lead Overseer should issue a public notice summarily describing the matter of non-compliance.

Luxembourg specificity

circulaire CSSF 22/806 du 22 avril 2022 relative aux arrangements d'externalisation

In Luxembourg, the CSSF is the DORA competent authority under article 46 for almost the entire financial sector (banks, PFS, EMIs, UCITS, AIFMs, regulated fintechs), while the CAA remains competent for insurance and reinsurance undertakings. CSSF circular 22/806 on outsourcing, read together with DORA, requires prior notification to the CSSF for any critical or important outsourcing, which now includes the obligation to immediately report any CTPP designation or public notice of non-compliance affecting an already notified provider.

Luxgap practice: we configure the Critical Provider Radar to automatically generate the CSSF notification under article 35 of circular 22/806 as soon as one of your outsourced providers is designated as CTPP by the ESAs, in order to meet the prudential communication timeline expected by the CSSF.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 89 sheds light on a point often misunderstood by Luxembourg financial entities: the designation of a critical ICT third-party service provider (CTPP) by the ESAs is not a unilateral act, but an adversarial procedure with rights of defence. In practice, many financial entities supervised by the CSSF discover too late that their hyperscaler or core banking provider is actively contesting the Lead Overseer's recommendations, and that this contestation opens a window of operational uncertainty of several months over existing contractual arrangements.

How this recital concretely influences implementation

It frames DORA articles 31 to 44: the Lead Overseer (ESA in charge) must grant a right to be heard before designation, and a right of explanation before recommendation.
It introduces an operational risk for the client financial entity: if the CTPP refuses a recommendation and publishes a reasoned statement, or if the Lead Overseer issues a public notice of non-compliance, the financial entity must immediately reassess its exit strategy (article 28(8)).
It requires continuous monitoring of ESA publications (register of designated CTPPs, public notices of non-compliance, formalised disagreements).
It mandates anticipating the impact on customers outside DORA scope (non-regulated subsidiaries, joint ventures, corporate clients) sharing the same critical ICT infrastructure.
For the CSSF, the competent Luxembourg authority under article 46, this means it will expect from the financial entity documented proof of monitoring the status of each critical provider.

How Luxgap automates this risk

Our Luxgap Critical Provider Radar turns passive monitoring of CTPP designations into a real-time alert system opposable to the CSSF. The tool continuously ingests the public register of critical third-party providers published by the ESAs, Lead Overseer non-compliance notices, reasoned disagreement statements, and cross-references these feeds with your DORA article 28(3) register of information, Azure Resource Graph, AWS Organizations and your contract repository in Odoo or SAP Ariba, to instantly materialise your entity's real exposure.

Detects within 24 hours any new CTPP designation affecting a provider present in your DORA register of information, with Teams or email notification to the CISO and DPO.
Calculates an exposure score per legal entity within the group, weighted by criticality of the supported ICT function (CORE, IMPORTANT, ACCESSORY per your article 8 classification).
Automatically generates an exit strategy reassessment file under article 28(8) as soon as a public notice of non-compliance is issued by the Lead Overseer.
Tracks reasoned disagreement statements published by CTPPs and alerts on contractual recommendations not followed that impact your ongoing arrangements.
Produces a timestamped, cryptographically sealed PDF report, opposable to the CSSF during a prudential review, demonstrating the continuous monitoring required by article 28(2).
Pre-drafts the internal communication to the executive committee and the information note to the board provided for by CSSF circular 22/806.

Available in addition to a Luxgap CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real DORA register of information, with a free blind audit within 48 hours to measure your exposure to critical third-party providers before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 89

They trust us

Before we chat