I need to bring my Luxembourg organisation into compliance with recital 94 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 94 DORA — Recital 94 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 94

Digital Operational Resilience Act · UE 2022/2554

(94)

To promote convergence at international level as regards the use of best practices in the review and monitoring of ICT third-party service providers’ digital risk-management, the ESAs should be encouraged to conclude cooperation arrangements with relevant supervisory and regulatory third-country authorities.

Luxembourg specificity

loi luxembourgeoise du 1er juin 2023 portant mise en oeuvre du règlement (UE) 2022/2554 DORA

In Luxembourg, the CSSF actively participates in supervisory colleges and bilateral memoranda of understanding with the SEC, FINMA and FCA. The Luxembourg financial centre, particularly exposed to US and UK hyperscalers (fund servicing, depositaries, PFS support), is on the front line of recital 94 enforcement. The law of 1 June 2023 implementing the DORA Regulation confirms the CSSF and CAA as single points of contact for these international exchanges.

Luxgap practice: systematically log in your RT register (Article 28) the jurisdiction of incorporation, hosting jurisdiction and third-country supervisory authority of each critical provider, to anticipate CSSF questions in supervisory colleges.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 94 sheds light on an operational blind spot: your critical ICT providers (AWS, Microsoft, Google Cloud, Salesforce) are supervised from third-country jurisdictions (US, UK, Singapore). The CSSF and ESAs will rely on cooperation arrangements with the SEC, FCA or MAS to oversee these actors. Concretely, a failure at a hyperscaler in the US will trigger a CSSF-SEC information exchange, and your file will be scrutinised in both jurisdictions simultaneously.

Why this recital reshapes your vendor mapping

Your critical non-EU ICT providers will be supervised via bilateral channels: their incidents will reach the CSSF without going through you.
International standards (NIST CSF, ISO 27001, SOC 2 Type II, FedRAMP) become de facto assessment benchmarks, beyond mere DORA requirements.
Divergences between regimes (UK Operational Resilience PRA SS1/21, US Interagency Guidance on Third-Party Relationships) must be traced in your contracts.
The exit strategy for a critical third-country provider (Article 28) must anticipate jurisdictional conflicts over data restitution.
Post-Schrems II TIAs stack with operational resilience evaluation: a dual grid is now mandatory.

How Luxgap automates this risk

Our Luxgap Cross-Border Resilience Watch turns cross-jurisdictional surveillance of your critical ICT providers into continuous, court-ready monitoring. A specialised LLM agent watches in real time the publications of third-country authorities (SEC EDGAR, FCA Handbook updates, MAS notices, OCC bulletins, FedRAMP marketplace) cross-referenced with your vendor contracts extracted from your CLM or Odoo, to automatically detect gaps between declared posture and regulatory reality of the hosting jurisdiction.

Scans daily the public registers of third-country authorities (SEC, FCA, MAS, OCC, FINMA) and alerts on any enforcement action affecting one of your critical ICT providers.
Maps the international subcontracting chain (AWS Frankfurt -> AWS US support, M365 EU Data Boundary -> documented exceptions) by querying hyperscalers transparency APIs.
Generates a cross-compliance matrix DORA / UK Operational Resilience / US Interagency Guidance, ready to present in supervisory colleges.
Produces the reinforced TIA combining Schrems II and operational resilience assessment, timestamped and cryptographically signed.
Alerts on Teams or Slack as soon as a third-country authority publishes a cooperation arrangement with a European ESA affecting one of your suppliers.
Maintains a CSSF-ready file demonstrating the cross-jurisdictional due diligence required by Article 28 DORA.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real critical ICT providers, with a free blank audit within 48h to measure your cross-jurisdictional exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 94

They trust us

Before we chat