DORA for US firms with Luxembourg operations

Luxembourg is where American asset managers keep their European fund range, and the numbers are not marginal. In the CSSF's origin-of-initiators statistics for 30 June 2026, US-based initiators account for EUR 1,309.608 billion of net assets, 19.4 % of the EUR 6,731.325 billion held by Luxembourg undertakings for collective investment, ahead of the UK and Germany. By number of funds Germany leads; by money, the US does.

DORA's scope is drawn by the entity's own EU authorisation. Article 2(1) lists managers of alternative investment funds and management companies among the covered entities: a Luxembourg AIFM or ManCo owned by a US group is in scope on its own account, and the nationality of the parent changes nothing.

The newest development is the one most US groups have not yet priced in. Following a European Commission DORA Q&A of 17 December 2025, the CSSF published Circular 26/915 on 27 August 2026: third-country branches in Luxembourg fall under DORA where their head office would qualify as an entity listed in Article 2(1)(a) to (t). The circular applies with immediate effect, brings those branches into Circulars 25/882, 25/892 and 25/893, and pulls them out of the old ICT-outsourcing regime.

DORA is Regulation (EU) 2022/2554, adopted 14 December 2022. It entered into force on 16 January 2023 and has applied since 17 January 2025, so the transition period is behind us: this is live supervision, not preparation.

The five pillars people refer to are simply Chapters II to VI of the regulation: ICT risk management; ICT-related incident management, classification and reporting; digital operational resilience testing; management of ICT third-party risk; and information-sharing arrangements.

Two useful pieces of nuance that get lost in vendor decks. First, threat-led penetration testing (Article 26) is not a universal obligation: only entities identified by their competent authority must run it, then at least every three years, on live production systems. Second, information sharing (Article 45) is voluntary in substance but carries one mandatory step: you must notify the authority when you join such an arrangement, and when you leave it.

This is the point that surprises US groups most often. DORA defines an ICT third-party service provider in Article 3(19) as, simply, an undertaking providing ICT services. Article 3(20) then defines an ICT intra-group service provider as one inside the financial group providing ICT services to entities of that same group, expressly including parent undertakings, subsidiaries and branches.

Recital 31 removes the escape hatch: intra-group provision of ICT services should not be automatically considered less risky than provision from outside the group, and should be subject to the same regulatory framework. If your Luxembourg ManCo runs on a data centre, a service desk or an application platform operated by the US parent, that is a contractual arrangement DORA expects to see documented.

The register-of-information standard, Commission Implementing Regulation (EU) 2024/2956, is built on that assumption. Template B_02.03 exists precisely to link intra-group arrangements to arrangements with providers outside the group, and the supply-chain template B_05.02 requires you to name at least the first subcontractor outside the group, even when the service does not support a critical or important function.

And Article 28(1)(a) closes it: the financial entity remains fully responsible for compliance at all times. You cannot delegate the obligation upward to the parent that provides the service.

The incident clock is the sharpest cultural difference. Under Article 5 of Commission Delegated Regulation (EU) 2025/301, an initial notification of a major ICT-related incident is due as early as possible and in any case within four hours of classifying it as major, and no later than 24 hours from becoming aware of it. The intermediate report follows within 72 hours of that initial notification, and the final report within one month of the intermediate one. Each stage runs from the previous filing, not from the incident.

Compare that with the US public-company rule most American groups have internalised: an Item 1.05 Form 8-K within four business days of determining an incident is material. Four hours against four business days is not a difference of degree; it changes who has to be reachable, and when.

The second clock is the register of information. The standing rule set by Circular CSSF 25/882 is that the register for year n covers all arrangements contracted to the end of that year and is submitted between 28 February and 31 March of year n+1. For the 2026 cycle the CSSF opened the eDesk window from 11 February to 31 March 2026 with a reference date of 31 December 2025, and warned that the ESA validation checks would be applied to more data fields than last year, so a register accepted one year can be rejected the next.

A US group might reasonably have assumed that domestic cyber rules would converge with DORA. They have not. On 17 June 2025 the SEC formally withdrew fourteen proposed rulemakings, stating it did not intend to issue final rules on them. The withdrawn set includes both the March 2022 cybersecurity risk-management proposal for investment advisers, registered investment companies and BDCs, and the April 2023 proposal for broker-dealers and other market entities. A search of Federal Register cybersecurity rulemakings from that date to 30 August 2026 returns no replacement.

The practical consequence for a US asset manager is a split house: the American entities work under a disclosure-centric regime aimed at materiality and investors, while the Luxembourg entity works under a resilience-centric regime aimed at supervisors, with hard operational clocks, a contractual register and testing obligations. Running one global policy and hoping it satisfies both is how firms discover, during an incident, that it does not.

Luxembourg's DORA law of 1 July 2024 designates two national competent authorities: the CSSF for financial entities, and the Commissariat aux Assurances for insurance and reinsurance, which confirmed its own competence in Circular Letter 25/1 of 14 January 2025.

For CSSF-supervised entities, the register of information is submitted through the eDesk portal as plain CSV files inside a zip archive, following the folder structure and naming convention defined by the ESAs. Incident and significant-cyber-threat reporting runs through the eDesk procedure set out in Circular CSSF 25/893 of 27 May 2025, or through the CSSF's API.

Circular CSSF 25/883 of 9 April 2025 rewrote how the old outsourcing regime interacts with DORA: for the entities concerned, Part I of Circular 22/806 still governs non-ICT outsourcing, while the ICT outsourcing part gives way to DORA. If your Luxembourg governance documents still describe ICT outsourcing under 22/806 alone, they are out of date.

One last piece of context for a board: on 18 November 2025 the European Supervisory Authorities published the first list of designated critical ICT third-party service providers under Article 31(9). Nineteen providers were designated. If your platform depends on one of them, oversight of that provider now happens at Union level as well as through your own contract.