meta_id 3438638

On August 27, 2026, the Commission de Surveillance du Secteur Financier (CSSF) published Circular CSSF 26/915, amending seven existing circulars to extend Digital Operational Resilience Act (DORA) requirements to third-country branches (TCBs) operating in Luxembourg. The update follows confirmation from the European Commission in December 2025 that DORA applies to TCBs established in European Union countries if their head offices would qualify as DORA entities in their home jurisdictions. The circular clarifies that TCBs of undertakings with head offices in third countries that would qualify under Article 2(1)(a) to (i), (k) to (m), (p), (r) and (s) of DORA, which include credit institutions, payment institutions, e-money institutions, crypto-asset service providers and investment firms, are now considered financial entities subject to DORA requirements. The amendments modify Circulars CSSF 20/750 , 22/806 , 25/881 , 25/882 , 25/883 , 25/892 and 25/893 . Key changes include removing TCBs from the scope of Circular CSSF 20/750 on information and communication technology (ICT) and security risk management, and removing ICT outsourcing requirements from Circular CSSF 22/806 while retaining general outsourcing provisions. TCBs are now included in Circulars CSSF 25/882 on ICT third-party services, CSSF 25/892 on aggregated costs from major ICT incidents, and CSSF 25/893 on incident reporting. The circular also introduces an alternative communication channel for reporting major ICT-related incidents and cyber threats. If technical impossibility prevents entities from using the primary submission channel, they may notify the CSSF via email at ictrisksupervision@cssf.lu, provided they explain the reasons for using the alternative channel and comply with applicable time limits. The circular applies with immediate effect.