DORA / ICT and cyber resilience
CSSF replaced Excel-based prudential reporting for CASPs
The CSSF announced a project to replace Excel-based prudential reporting for payment institutions, e-money institutions and MiCAR-authorised CASPs. The CSSF indicated that the current Excel-based submission process will be replaced by a more integrated and user-friendly reporting interface within the eDesk platform.
The CSSF published a new circular clarifying the application of DORA to third-country branches (TCBs) in Luxembourg, bringing them into the scope of DORA-related circulars (amending Circulars 25/882, 25/892, 25/893) while removing them from pre-DORA ICT circulars (20/750, 22/806).
ESMA launched a CSA focused on the digital operational resilience of crypto-asset service providers, with a particular emphasis on custody services. National Competent Authorities (NCAs) will carry out the exercise on a risk-based sample of authorised CASPs. The exercise runs H2 2026 into H1 2027.
The CSSF reported receiving 326 major ICT incident notifications between January 2025 and June 2026; IFMs accounted for 19% of notifications.