Recital 90
Digital Operational Resilience Act · UE 2022/2554
| (90) | Competent authorities should duly include the task of verifying substantive compliance with recommendations issued by the Lead Overseer in their functions with regard to prudential supervision of financial entities. Competent authorities should be able to require financial entities to take additional measures to address the risks identified in the Lead Overseer’s recommendations, and should, in due course, issue notifications to that effect. Where the Lead Overseer addresses recommendations to critical ICT third-party service providers that are supervised under Directive (EU) 2022/2555, the competent authorities should be able, on a voluntary basis and before adopting additional measures, to consult the competent authorities under that Directive in order to foster a coordinated approach to dealing with the critical ICT third-party service providers in question. |
In Luxembourg, the CSSF is the DORA competent authority for almost the entire financial sector (banks, PFS, fintechs, AIFMs, UCITS, investment firms), while the CAA covers insurance and reinsurance undertakings. For critical ICT providers also covered by NIS 2, the ILR is the Luxembourg NIS 2 competent authority, and the voluntary coordination foreseen in recital 90 materialises through a CSSF-ILR or CAA-ILR dialogue.
Luxgap practice: in your DORA register of information, tag for each critical provider whether it also qualifies as an essential or important entity under Luxembourg NIS 2, in order to anticipate joint CSSF-ILR action when a Lead Overseer recommendation lands.
