Digital··4 min
DORA: third-country branches in Luxembourg fall within scope
On 27 August 2026 the CSSF confirmed that Luxembourg branches of banks, investment firms, CASPs or payment institutions headquartered outside the EU may fall within the scope of DORA. Compliance officers concerned have until 30 June 2026 to file their first register of information.
Translated from French · Lire l'original en français
On 27 August 2026 the CSSF confirmed that Luxembourg branches of financial entities whose registered office is located outside the European Union (banks, investment firms, CASPs or payment institutions) may be subject to the DORA regulation on digital operational resilience. If your Luxembourg entity is a branch of a Swiss, British, American or Asian group, this point deserves a quick check with your regulatory adviser.
The test to apply: would your head office be a DORA entity in its home country?
According to the CSSF, a third-country branch established in Luxembourg falls within the scope of DORA if, in the country where its registered office is located, it would qualify as one of the entities listed in Article 2(1)(a) to (t) of the regulation, that is, the list of financial entities covered by the text (banks, investment firms, crypto-asset service providers, payment institutions, among others). In practice, what matters is not the branch's legal status in Luxembourg but the nature of the activity carried out by the head office in its home country. This clarification is based on an opinion issued by the European Commission on 17 December 2025 on the territorial scope of DORA as it applies to third-country branches, according to the CSSF.
What CSSF Circular 26/915 changes
On 27 August 2026 the CSSF published Circular 26/915, dedicated specifically to the applicability of DORA to third-country branches operating in Luxembourg. At the same time, it amended seven existing circulars (20/750, 22/806, 25/881, 25/882, 25/883, 25/892 and 25/893) to reflect this interpretation. For a compliance officer, this means the subject is no longer a grey area: the position of the Luxembourg supervisory authority is now set out in an enforceable text. The resulting obligations are those of the general body of DORA: maintaining a register of information on contracts with ICT providers, a framework for managing information and communication technology risks, and reporting major incidents to the CSSF.
The filing timetable for the register of information
Filing of the register of information normally follows an annual timetable, with a submission window via eDesk. However, the CSSF has set out a specific case for third-country branches of credit institutions, because of the tight timetable created by the late publication, in December 2025, of the European clarification (Q&A DORA102 3097).
| Type of entity | Filing deadline | Source |
|---|---|---|
| Financial entities subject to DORA, general case | 31 March 2026 (eDesk window from 11 February to 31 March 2026) | Standard CSSF timetable |
| Third-country branches of credit institutions | 30 June 2026, on a best-efforts basis | CSSF communiqué of 17 February 2026 |
If your branch belongs to a third-country bank, take 30 June 2026, not 31 March, as the tolerance deadline for the first filing of the register of information. For the other categories of entities covered by Circular 26/915, you should check case by case with your regulatory adviser which deadline applies, as the CSSF has only announced an explicit extension for credit institutions.
A market that has fallen behind on DORA
The context adds to the urgency of acting early. As at 16 March 2026, only 40% of the financial entities concerned had filed their register of information with the CSSF, which led the authority to publicly urge entities to speed up their filings, according to consistent reports by Paperjam and Delano. This filing rate shows that DORA remains under-anticipated in the Luxembourg financial centre, including by entities that already knew they were within the regulation's scope. For third-country branches, which have only just received official confirmation that they are subject to it, the risk of discovering the issue too late is real. Further reading on this topic: KYT, continuous transaction monitoring.
Checklist for your compliance officer
Before considering the format of the register, the first step is to determine whether your Luxembourg branch falls within the scope of DORA based on the status of its head office in its home country. Here are the points to check:
- Identify the regulatory status of the registered office in its third country of origin and compare it with the list of entities in Article 2(1)(a) to (t) of DORA
- Read CSSF Circular 26/915 and the amended circulars (20/750, 22/806, 25/881, 25/882, 25/883, 25/892, 25/893) to determine your entity category
- Check whether your branch qualifies for the extension to 30 June 2026 (third-country credit institutions) or falls under the general deadline of 31 March
- If not already done, start the inventory of contracts with ICT providers for the register of information
- Document the ICT risk management framework and the procedure for reporting major incidents
This content is for information purposes only and does not constitute legal advice: the qualification of your branch under DORA and the applicable timetable must be confirmed with your regulatory adviser, in light of the CSSF texts on the application of DORA to third-country branches and CSSF Circular 26/915.
