Introduction
Since the Digital Operational Resilience Act (DORA) came into force on 17 January 2025, financial institutions across Europe have been recalibrating their approach to ICT risk. In Luxembourg, where outsourcing is not an exception but a systemic model—especially in fund administration, transfer agency, compliance monitoring, and IT infrastructure—the regulation poses both governance and operational challenges.
DORA elevates third-party risk management, incident reporting, and ICT governance to board-level priorities. But while the intent is clear, the reality of execution—especially in a multi-tier outsourcing ecosystem—is far more complex. This article explores the concrete implementation challenges facing Luxembourg-based institutions and their service providers, with a focus on incident notification chains and the alignment of governance models across delegation layers.
1 CSSF Alignment: A Rapid Regulatory Shift
The CSSF has moved quickly to align its framework with DORA, replacing or adapting key circulars:
- CSSF Circular 25/893 (May 2025) introduces the DORA-aligned incident reporting model, which emphasizes a “no aggregation” principle: each entity in the service chain must be capable of notifying critical ICT incidents independently, within 4 hours of detection.
- Circulars 25/880–882 (April 2025) outline updated obligations for outsourcing arrangements, the use of ICT third-party service providers, and the format for the required “Register of Information” (RoI). The RoI must be submitted to CSSF via eDesk annually, covering all ICT dependencies.
- These circulars align and in some cases replace earlier texts such as Circulars 20/750, 22/806, and 24/847, bringing Luxembourg into full compliance with DORA.
The CSSF has also issued FAQs and guidance confirming that reporting obligations extend across outsourcing chains. The institution at the top of the chain bears the ultimate responsibility for notifying the CSSF within 4 hours—but it must rely on upstream notifications from providers within a much shorter timeframe (often less than 1 hour).
2 Where Regulation Meets Reality: Four Pain Points
A. Incomplete ICT Registers and Overlapping Responsibilities
Despite previous CSSF requirements, many institutions and their providers still struggle with maintaining a comprehensive Register of Information. Sub-outsourcing layers are often opaque, and definitions of “critical or important” functions are inconsistently applied. In some cases, institutions are unaware of their providers’ own outsourcing arrangements until an incident occurs.
B. Incident Reporting Chains: Too Slow for DORA
One of DORA’s most challenging aspects is the speed of major ICT incident reporting. In Luxembourg, a typical outsourcing chain might involve:
- A bank outsourcing fund administration to a local PSF
- The PSF using a nearshore processing center (e.g., in Portugal or Poland)
- The nearshore center operating on cloud infrastructure managed by a hyperscaler
If a disruption occurs at the cloud provider level, upstream notification must occur within minutes to allow the bank to report to CSSF in less than four hours. However, few contracts currently impose strict timelines on internal reporting, and roles are rarely defined with this granularity.
C. Contractual Gaps: When Governance Is an Afterthought
The new circulars require that contracts include explicit provisions on:
- Incident notification timelines
- Data portability and exit strategies
- Audit rights and supervisory cooperation
In practice, many existing agreements omit these clauses or include them only superficially. Providers are often hesitant to accept aggressive terms, and clients may lack negotiating leverage. Without updates, institutions face audit risks—even if their technical setups are solid.
D. TLPT and Shared Testing: Who Pays, Who Participates?
Threat-Led Penetration Testing (TLPT) is mandated for significant institutions under DORA, but there is little guidance on the role of service providers. Should providers undergo TLPT themselves? Should clients scope their providers into their own testing regimes? Should costs be shared?
As of mid-2025, most market participants have no structured plan, and CSSF has yet to provide operational clarifications. This is a critical blind spot in an otherwise robust framework.
3 What Luxembourg-Based Providers Are Doing (or Should Do)
Leading PSFs and service providers have started to adapt:
- Contract template updates: Providers are revising master service agreements to include 1-hour incident notification clauses, supervisory cooperation obligations, and audit rights.
- Shared Registers of Information: Some firms are proactively offering clients a breakdown of their full outsourcing stack, mapped to DORA’s definitions.
- Incident response playbooks: Cross-client crisis playbooks are being developed to ensure response coherence.
- TLPT scoping discussions: Forward-looking providers are initiating conversations about TLPT planning, data sharing, and funding.
However, many providers are still in reactive mode. Institutions that rely on them must assess whether they can deliver under DORA’s expectations—or face joint regulatory consequences.
4 What Financial Institutions Must Demand
The CSSF has made it clear: responsibility cannot be outsourced. Institutions must:
- Request a detailed, up-to-date Register of Information, including sub-outsourcers
- Set contractual SLAs for incident escalation (e.g., <1 hour)
- Define governance touchpoints (e.g., frequency of reporting, access to controls)
- Integrate service providers into their own ICT risk frameworks, TLPT plans, and audit programs
These actions are not optional—they are fundamental to demonstrating compliance during CSSF reviews or ESAs’ joint inspections.
Conclusion
DORA is more than a technical regulation; it redefines how outsourcing relationships are governed. In Luxembourg, this shift strikes at the heart of business models built on delegation. Providers and clients are now co-responsible for cyber resilience, auditability, and governance quality.
Institutions that treat their service providers as true governance partners—not just external vendors—will be better prepared for the operational and reputational stakes of the DORA era. And providers who embrace transparency, collaboration, and structured escalation will emerge not just as compliant—but as trusted enablers of a new operational standard.
References
CSSF Circular 25/893 – Reporting of Major ICT-Related Incidentshttps://www.cssf.lu/wp-content/uploads/cssf25_893eng.pdf
CSSF Circular 25/880 – Register of Information Requirementshttps://www.cssf.lu/wp-content/uploads/cssf25_880eng.pdf
CSSF Circular 25/882 – ICT Third-Party Risk Managementhttps://www.cssf.lu/wp-content/uploads/cssf25_882eng.pdf
DORA Regulation (EU 2022/2554)
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554
EBA Guidelines on Outsourcing Arrangementshttps://www.eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-outsourcing
ESAs Statement on DORA Application (JC 2024 99)https://www.esma.europa.eu/sites/default/files/2024-12/JC_2024_99_ESAs_Statement_on_DORA_application.pdf
ESMA Q&A on Third-Party Providers Outside EUhttps://www.esma.europa.eu/publications-data/questions-answers/2107
CSSF – ICT and Cyber Risk Toolbox for DORA Entities
https://www.cssf.lu/en/ict-and-cyber-risk-for-dora-entities/