Circular CSSF 25/882 Released, Guiding Financial Entities On DORA-Compliant Use of ICT Third-Party Services, And Reporting Requirements

Luxembourg Financial Regulatory News:

Circular CSSF 25/882, effective April 9, 2025, provides practical guidance for financial entities on using ICT third-party services under DORA. It applies to a broad range of institutions, detailing requirements for contractual arrangements, professional secrecy, and daily backups of accounting positions. The circular mandates entities to notify the CSSF of new ICT service contracts for critical functions and to maintain a comprehensive register. It also introduces the role of a “cloud officer” for entities using cloud computing.

Read more at the official link: https://www.cssf.lu/en/Document/circular-cssf-25-882/

Basis and Inspiration for the Circular CSSF 25/882:

The Circular CSSF 25/882 is inspired by the Digital Operational Resilience Act (DORA), specifically Regulation (EU) 2022/2554. Its purpose is to provide practical instructions and to complement DORA by recalling general requirements related to the use of ICT third-party providers, in line with Luxembourg national laws.

Scope of Applicability:

The Circular CSSF 25/882 applies to a wide range of financial entities, including:

Credit institutions, investment firms, and market operators.
Payment institutions and electronic money institutions.
Crypto-asset service providers.
Central securities depositories and central counterparties.
Management companies and alternative investment fund managers (AIFMs).
Institutions for occupational retirement provisions.
Administrators of critical benchmarks.
Crowdfunding service providers.
Their respective branches in Luxembourg.

Exemptions

Luxembourg branches of financial entities whose head office is in another EU Member State are exempt from Chapter 2 of this circular (DORA reporting obligations).
Significant credit institutions for which the ECB is the competent authority are exempt from Chapter 2.

Date of Applicability:

This Circular CSSF 25/882 applies with immediate effect as of its publication date, April 9, 2025.

Main Subjects and Domains Covered:

The Circular CSSF 25/882 addresses the following key subjects:

The use of ICT third-party services, including compliance with professional secrecy.
DORA reporting obligations, such as notifying the CSSF of planned contractual arrangements.
The use of ICT third-party cloud computing services, including the appointment of a “cloud officer.”
Requirements for the backup of accounting positions.

High-Level Requirements

Financial entities must ensure compliance with professional secrecy when using ICT third-party services.
They must notify the CSSF at least three months in advance of any planned contractual arrangements for ICT services supporting critical or important functions.
They must maintain an updated register of information on all ICT contractual arrangements.
When using cloud computing, they must appoint a “cloud officer” with appropriate expertise.
A daily backup of all end-of-day accounting positions must be stored securely, either in Luxembourg or within the EEA.

Main Concerned Functions under Circular CSSF 25/882:

The primary functions concerned are those related to ICT, risk management, and regulatory compliance, particularly those involved in outsourcing and third-party vendor management.

List of Required Documents to be Prepared Entities are required to prepare and submit the following:

Notification of planned contractual arrangements regarding ICT services supporting critical or important functions.
A register of information on all ICT contractual arrangements.

This news for Circular CSSF 25/882 can be considered beneficial under CSSF-Circulars, Central Securities Depositories (CSDs) News, Credit Institutions News, Crowdfunding service providers (CSPs) News, Crypto-Assets Service Providers (CASPs) and Virtual Asset Service Providers (VASPs) News, Data Reporting Service Providers (DRSPs) News, IFMs (AIFMs, ManCos) News, Investment Firms News, Issuers of Tokens (EMTs, ARTs) News, Must Read, Payment Institutions (PIs) / Electronic Money Institutions (EMIs) /AISPs News, Pension funds News.