The Luxembourg Commission de Surveillance du Secteur Financier (CSSF) has published instructions for the 2026 annual submission of the Digital Operational Resilience Act (DORA) register of information covering contractual arrangements for ICT services provided by ICT third-party service providers, at individual, sub-consolidated or consolidated level as applicable, for entities not under the European Central Bank’s direct supervision. Following a European Supervisory Authorities (ESAs) Q&A, third-country branches of DORA-in-scope financial entity types supervised by the CSSF must now also submit a register of information to the CSSF under the same submission window, with the 2026 reference date set to 31 December 2025. Submission is via the CSSF’s eDesk Portal and requires prior communication of the submitting entity’s Legal Entity Identifier (LEI) and assignment of the “DORA Reporting” role to at least one employee; the eDesk procedure “Submission of the Register of Information” is available from 11 February 2026. The CSSF noted that ESA validation checks (last updated in April 2025) are unchanged but will be applied to additional data fields, meaning a register accepted in a prior year may be rejected in 2026; entities are encouraged to submit early to allow time for corrections. Uploaded registers will be validated by the CSSF and, where errors are identified, entities will be asked to correct and re-submit before 31 March 2026; accepted registers may also be subject to further ESA checks, with re-submission required if the ESAs refuse the file. The CSSF also published and referenced supporting guidance for submission and for resolving ESA and CSSF error messages, and indicated these documents may be updated during the exercise.

Original source View in tracker