I need to bring my Luxembourg organisation into compliance with recital 93 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 93 DORA — Recital 93 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 93

Digital Operational Resilience Act · UE 2022/2554

(93)

To avoid duplications and overlaps, competent authorities should refrain from taking individually any measures aiming to monitor the critical ICT third-party service provider’s risks and should, in that respect, rely on the relevant Lead Overseer’s assessment. Any measures should in any case be coordinated and agreed in advance with the Lead Overseer in the context of the exercise of tasks in the Oversight Framework.

Luxembourg specificity

loi luxembourgeoise du 1er juin 2023 portant mise en œuvre du reglement (UE) 2022/2554 (DORA)

In Luxembourg, the CSSF is the DORA competent authority for almost the entire financial sector, and the CAA for insurance. The law of 1 June 2023 implementing the DORA Regulation expressly designates the CSSF as the single point of contact with European Lead Overseers for entities supervised in Luxembourg, reinforcing the prior coordination requirement of recital 93.

Luxgap practice: centralise every CTPP communication through your declared CSSF compliance officer and archive each exchange in a single timestamped file to evidence alignment with the Lead Overseer in case of an eSurfi review or on-site inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 93 of DORA establishes the principle of non-duplication: the CSSF, as the Luxembourg competent authority, must refrain from running its own parallel investigations on a critical ICT third-party provider already supervised by a Lead Overseer (ESMA, EBA or EIOPA, depending on the case). In practice, the trap works the other way around: a Luxembourg financial entity receives a CSSF information request and a Lead Overseer assessment on the same provider at the same time, and answers them inconsistently. The CSSF then sanctions the lack of traceability between both flows, not the provider.

What recital 93 changes concretely for you

You must identify which Lead Overseer supervises each of your critical ICT third-party providers (Microsoft Azure, AWS, Google Cloud, Salesforce, etc.) as soon as the ESAs publish their designation.
Any answer to the CSSF concerning a supervised provider must be aligned with the Lead Overseer's assessment, otherwise you create a contradiction that can be used against you during an inspection.
You must maintain a unified audit trail: same register, same risk classification, same mitigation measures, regardless of which authority asks.
The recital protects your provider from double investigations, but it does not protect you from an internal inconsistency between your CSSF answers and your Lead Overseer answers.

How Luxgap automates this risk

Our Luxgap Oversight Sync Hub guarantees that every regulatory communication on a given critical ICT third-party provider stays perfectly consistent between the CSSF and the designated Lead Overseer, by consolidating each exchange in a single timestamped vendor file. The tool connects to your Microsoft 365 mailboxes, your DMS (SharePoint, Alfresco, eDOCS), your contract register in Odoo or Sage BOB 50, and the public list of critical ICT third-party providers designated by the ESAs to reconcile in real time who supervises what.

Automatically identifies every critical ICT third-party provider you rely on by cross-referencing your contracts, invoices and network flows against the official list of CTPPs designated by the ESAs.
Maps each provider to its competent Lead Overseer (ESMA, EBA, EIOPA) and propagates that information into your DORA article 28(3) register.
Detects contradictions between your CSSF answers and the public Lead Overseer assessments on the same provider, and alerts the DPO/CISO via Teams or Slack before sending.
Generates a consolidated vendor file, enforceable before the CSSF during an inspection, proving the alignment of your positions with those of the Lead Overseer.
Produces a timestamped, cryptographically sealed PDF report for every regulatory exchange, evidencing the prior coordination required by recital 93.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module, depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual providers, with a free 48-hour blank audit to map your CTPPs and their Lead Overseers before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 93

They trust us

Before we chat