Update To CSSF Circulars: ICT Risk Management And Use Of ICT Third Parties/ICT Outsourcing

The CSSF published new circulars to remove duplication and overlaps with DORA, therefore providing the market with clarity and transparency.

On 9 April 2025, the Commission de Surveillance du Secteur Financier (CSSF) published a press release announcing important updates to CSSF circulars that concern not only entities falling in the scope of DORA and supervised by the CSSF (DORA entities), but also other entities supervised by the CSSF (non-DORA entities) in relation to ICT risk management, use of ICT third parties and ICT outsourcing. The CSSF also published a new notification formfor financial entities subject to DORA for the purpose of notifying the CSSF in a timely manner about any planned contractual arrangements involving the use of ICT services supporting critical or important functions, as well as when a function has become critical or important.