Regulatory Alerts2025-04-09
Added · Updated
Circular CSSF 25/882 on requirements for the use of ICT third-party services under DORA
Financial Entities supervised by the CSSF must notify the authority at least three months before planned contractual arrangements for ICT services supporting critical or important functions take effect, reducing this period to one month for providers governed by specific Luxembourg laws. These entities are required to maintain a register of all ICT third-party service arrangements and submit it annually to the CSSF between 28 February and 31 March, with a special deadline of 15 April 2025 for the first collection covering arrangements until 31 March 2025. When using accounting systems located outside Luxembourg, Financial Entities must secure daily backups of end-of-day positions stored within Luxembourg or the EEA. Additionally, entities using cloud computing services must designate a qualified cloud officer to manage competencies and security responsibilities.
More like this from CSSF
We email you every new CSSF publication the day it's published.