Operational Resilience / Outsourcing

Key dates

2026-04-30

APRA issued its letter to banks, insurers and superannuation trustees calling for a step-change in governance, risk management, assurance and operational resilience for AI-related risks.

2026-05-08

ASIC issued its open letter to all licensees and market participants urging urgent strengthening of cyber resilience as frontier AI intensifies the global cyber-risk environment.

2026-06-01

ASIC and APRA began the June–July 2026 series of nine industry roundtables on frontier-AI preparedness and resilience; the source identifies June as the starting month but does not provide an exact day.

2026-07-31

ASIC and APRA completed the June–July 2026 roundtable period; the source does not provide an exact closing day.

2026-08-27

ASIC published the joint warning and related information paper and preparedness checklist, urging entities to move from awareness to action.

Suggested considerations

• Firms should consider presenting the ASIC and APRA roundtable themes, together with the available board and executive preparedness checklist, to the board and relevant risk or technology committees.
• Compliance teams may wish to map frontier-AI cyber and operational risks to existing obligations and controls under APRA CPS 230 Operational Risk Management, APRA CPS 234 Information Security, APRA CPS 220 Risk Management where applicable, and the entity's ASIC licence, governance and cyber-resilience arrangements.
• Firms should consider identifying critical assets, systems, data flows and material third-party dependencies, including common providers and concentration points that could create sector-wide disruption.
• Technology and security teams may wish to test patching, identity and privileged-access controls, attack-surface reduction, backup integrity, recovery-time priorities and incident-response playbooks against AI-accelerated attack scenarios.
• Boards and executives should consider documenting risk appetite, incident escalation authority, recovery priorities, internal and external communication strategies and decision rights before a frontier-AI-related crisis occurs.
• Firms should consider testing response and recovery arrangements under compressed timeframes and retaining evidence of exercise results, lessons learned, remediation owners and completion status.
• Entities using or procuring AI should consider applying existing model, data, supplier, change-management and assurance controls to internally developed models, vendor tools and embedded AI functionality, including defensive-AI tools used for threat intelligence, vulnerability detection, code review or incident response.
• Procurement and outsourcing functions may wish to strengthen supplier assurance, obtain relevant information on providers' AI and cyber controls, map material dependencies and assess substitutability and exit arrangements.

What changed

The regulators have consolidated a cross-sector expectation that entities address frontier-AI risk through cyber fundamentals, critical-asset identification, timely patching, strong identity and access controls, attack-surface reduction, reliable backups, tested response and recovery arrangements, and third-party risk management.

Key dates

2026-08-27

The Bank of England announced deferral of the entire November 2026 RTGS standards release, including CHAPS messaging standards; Swift announced the corresponding Standards Release delay on the same date.

2026-12-31

Swift has indicated that it will provide an update on the optimal timing and approach for the structured-address change by December 2026 at the latest; this is an expected communications milestone, not a confirmed implementation deadline.

Suggested considerations

• Firms should update regulatory-change inventories and project plans to record that the November 2026 RTGS and CHAPS standards release has been deferred, without assuming that the change has been cancelled.
• CHAPS and RTGS participants should obtain the BoE’s revised implementation timetable and monitor the BoE ISO 20022 implementation page, participant communications and Swift governance updates, including the expected update by December 2026 at the latest.
• Compliance and payments teams may wish to preserve completed analysis and technical preparations for structured or hybrid postal addresses, while reassessing sequencing, testing windows, release dependencies and vendor delivery dates against the revised timetable.
• Firms should distinguish the deferred BoE/CHAPS release from any other payment-system or bilateral requirements that may continue on their original schedules, and should confirm the treatment of address validation, message rejection, exception handling and operational support with relevant counterparties and vendors.
• Technology and operations teams should maintain regression-test environments and data-quality remediation plans so that implementation can resume without restarting discovery or delaying future mandatory testing.
• Firms using both CHAPS/RTGS and Swift CBPR+ should assess whether the coordinated deferral changes their customer communications, correspondent-bank testing, operational-resilience scenarios, payment-routing controls and incident-management assumptions.
• Governance committees may wish to record the deferral as a schedule and dependency change rather than as a reduction in scope, because the BoE states that the November release is deferred in its entirety and provides no indication that the underlying standards work is withdrawn.

What changed

The November 2026 RTGS standards release will not proceed as originally planned and has been deferred in its entirety rather than being split into separate changes. This includes the RTGS messaging standards applicable to CHAPS payments. The decision maintains alignment with Swift’s deferred CBPR+ release and means that the previously expected 2026-11-14 removal of fully unstructured postal addresses should not be treated as the operative BoE/Swift implementation date; Swift has indicated that it will consult market participants and provide an update by December 2026 at the latest.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing [email protected] when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-01-17

DORA became applicable to financial entities within its scope, subject to the specific DORA provisions and technical standards applicable to each entity.

2025-04-09

Circular CSSF 25/881 was published and took effect, removing DORA financial entities from Circular 20/750 and retaining 20/750 for entities outside DORA; PSP-specific provisions were reorganised under Circular 25/880.

2026-06-30 Deadline

CSSF extended the first Register of Information submission for Luxembourg branches of third-country credit institutions to this date on a best-efforts basis; the CSSF indicated that the required level of quality should be achieved for the 2027 submission.

2026-08-27

Circular CSSF 26/915 was published, confirming the DORA treatment of qualifying third-country branches and removing them from the full scope of Circular 20/750 and related overlapping circular provisions.

2027-03-31 Deadline

Target date identified by the CSSF for the required-quality Register of Information submission by Luxembourg branches of third-country credit institutions.

Suggested considerations

• Firms should classify each Luxembourg entity and branch against DORA Article 2 and the amended scope of Circular 20/750, including an assessment of whether a third-country head office would qualify under DORA Article 2(1)(a) to (t).
• Compliance teams may wish to determine whether the entity should operate under DORA rather than 20/750, and document the rationale, legal-entity perimeter and treatment of any Luxembourg branch.
• Firms remaining within Circular 20/750 should consider reviewing their ICT and security-risk-management framework, governance approvals, risk assessments, incident processes, business-continuity arrangements and control testing against the continuing requirements.
• Payment service providers should consider replacing references to the PSP provisions formerly contained in Circular 20/750 with the applicable requirements in Circular CSSF 25/880 and EBA/GL/2025/02.
• Third-country branches treated as DORA entities should consider validating their DORA governance, ICT-risk framework, incident-reporting arrangements, ICT contractual inventory and Register of Information processes, taking account of CSSF reporting communications.
• Firms should update policies, regulatory inventories, outsourcing and ICT-third-party registers, training materials and regulatory mapping to distinguish DORA obligations from the residual Circular 20/750 obligations.
• Compliance teams may wish to retain evidence of the scope assessment and implementation date, because the 2025 amendment was effective immediately and the 2026 amendment changes the treatment of a previously identified 20/750 population.

What changed

Circular 25/881 provides that DORA financial entities supervised by the CSSF no longer fall within Circular 20/750; for entities covered by 20/750 but outside DORA, the circular continues to apply in full. Payment-service-provider-specific ICT and security-risk provisions were removed from 20/750 and regrouped in Circular CSSF 25/880, reflecting the revised EBA Guidelines on ICT and security risk management for payment service providers, including EBA/GL/2025/02.

Key dates

2025-01-17

DORA became applicable to in-scope financial entities, according to the CSSF implementation communication referenced by Circular CSSF 25/882.

2025-04-09

Circular CSSF 25/882 was published and applied with immediate effect.

2025-04-01 Deadline

The first exceptional CSSF register submission window opened for arrangements contracted up to 31 March 2025.

2025-04-15 Deadline

The first exceptional CSSF register submission window closed.

2026-08-27

Circular CSSF 26/915 was published and immediately amended Circular CSSF 25/882 to include qualifying third-country branches in Luxembourg.

2027-03-31 Deadline

Latest date for submission of the register covering arrangements contracted through the end of 2026, under the recurring annual window running from 28 February to 31 March of the following year.

Suggested considerations

• Firms should assess whether Luxembourg third-country branches now fall within the amended scope by comparing the branch’s undertaking and head-office activities with the DORA categories in Article 2(1)(a) to (t) and documenting the conclusion.
• Compliance teams may wish to inventory all ICT third-party arrangements, including digital, data, cloud, infrastructure and operational services that may not qualify as outsourcing under prior CSSF terminology.
• Firms should consider updating ICT third-party approval workflows so arrangements supporting critical or important functions are notified through the CSSF-prescribed form at least three months before commencement, or one month before commencement where the provider is an eligible Luxembourg support PFS.
• Firms should maintain an accurate register of information at individual, sub-consolidated and consolidated levels, with controls for prompt correction when requested by the CSSF and the ability to provide the register outside the annual submission window.
• Compliance and outsourcing teams may wish to reassess contractual access to professional-secrecy data against Article 41(2a) LFS or Article 30(2a) LPS and verify that Luxembourg ICT management or operations providers hold the required Article 29-3 LFS authorisation or qualify for an applicable exception.
• Firms using cloud services should confirm that the resource operator has designated a suitably qualified cloud officer and that internal cloud, information-security and third-party oversight responsibilities are clearly allocated.
• Third-country branches should consider implementing the requirements immediately because Circular CSSF 26/915 provides no transition period, while preserving evidence of governance, notification and register controls for supervisory review.

What changed

Circular CSSF 26/915 includes in Circular CSSF 25/882’s scope all Luxembourg third-country branches of undertakings covered by the specified DORA financial-entity categories where the head office would qualify as a DORA entity under Article 2(1)(a) to (t) in the relevant third country. The requirements apply to ICT services broadly, not only arrangements that meet a traditional outsourcing definition.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

2020-08-25

Circular CSSF 20/750 was originally published, establishing CSSF expectations for ICT and security risk management.

2025-01-17

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable to DORA-defined financial entities supervised by the CSSF.

2025-04-09

Circular CSSF 25/881 amended Circular 20/750, narrowing it primarily to non-DORA entities and moving PSP-specific requirements to Circular CSSF 25/880.

2026-08-27

Circular CSSF 26/915 was published and applies with immediate effect; DORA-equivalent third-country branches are removed from Circular 20/750 and addressed through the DORA-related CSSF framework.

Suggested considerations

• Firms with Luxembourg third-country branches should document an entity-by-entity DORA scoping analysis, including the classification of the non-EU head-office undertaking under Article 2(1)(a) to (t) of Regulation (EU) 2022/2554 and the relevance of Article 2(2).
• Affected branches should consider retiring Circular 20/750 as their primary ICT framework and mapping controls instead to DORA and the applicable CSSF circulars, including Circular CSSF 25/882 on ICT third-party services and Circular CSSF 25/893 on major ICT-related incidents and significant cyber threats.
• Firms should review ICT third-party inventories, contracts, due diligence files, exit strategies and, where relevant, the DORA Register of Information so that all ICT services are captured regardless of whether the arrangement is formally classified as outsourcing.
• Entities remaining within Circular 20/750 should consider confirming that the management body has approved the ICT and security risk-management framework and that it is reviewed at least annually.
• Remaining in-scope entities should consider refreshing their annual ICT and security risk assessment, critical-function and information-asset mapping, threat and vulnerability monitoring, access controls, patching, backup, recovery, incident-response and business-continuity documentation.
• Compliance teams may wish to verify that critical ICT systems undergo security testing at least annually, non-critical systems are tested regularly and at least every three years, and critical business continuity arrangements are tested at least annually.
• Branches and PSP-related entities should consider validating incident-reporting channels and escalation procedures, including the CSSF alternative email channel for exceptional technical failures where the prescribed DORA reporting channel cannot be used.
• Firms should consider preserving evidence of proportionality assessments, control testing, audit findings, remediation, management-body reporting and staff security training for CSSF supervisory review.

What changed

Circular 26/915 applies with immediate effect and removes DORA-equivalent third-country branches from the scope of Circular 20/750. A third-country branch is treated as DORA-relevant where, in the jurisdiction of its head office, the undertaking would qualify as an entity listed in Article 2(1)(a) to (t) of Regulation (EU) 2022/2554, subject to the applicable exclusions and Article 2(2) conditions.

Key dates

2026-08-26

EBA consultation launched and consultation period opened.

2026-09-25 Deadline

Deadline to register for the EBA virtual public hearing, at 16:00 CEST.

2026-09-29

EBA virtual public hearing from 10:00 to 12:00 CEST (Paris time).

2026-12-31 Deadline

Deadline for submitting consultation responses to the EBA, at 23:59 CEST.

Suggested considerations

• Compliance and operational-risk teams should obtain and map the consultation draft against Article 323(1), points (a) to (h), of the CRR and identify requirements that would require changes to policies, committee mandates, controls or management information.
• Institutions should determine their business indicator and assess whether it is below the proposed EUR 750 million proportionality threshold, while treating that threshold as proposed rather than final.
• Firms should inventory operational-risk data sources, loss-event thresholds, taxonomies, reporting processes, validation controls and audit coverage, and assess whether data granularity is sufficient for the proposed framework.
• Management-body and senior-management responsibilities should be compared with existing governance arrangements, including the independence, authority and resourcing of the operational risk management function.
• Firms should assess alignment between the proposed RTS, CRR3 operational-risk capital and reporting implementation, the EBA Guidelines on internal governance and DORA, avoiding duplication or gaps for ICT-related risk.
• Affected stakeholders should consider submitting comments to the EBA by 31 December 2026; compliance teams may wish to coordinate responses with risk, finance, internal audit and industry associations.
• Stakeholders wishing to participate in the EBA public hearing should register by 25 September 2026 at 16:00 CEST and prepare questions on proportionality, data granularity, thresholds, reporting frequency and implementation timing.
• Institutions should monitor the EBA’s final draft, the European Commission’s endorsement process and the eventual application date before treating the consultation text as a binding requirement.

What changed

The proposed RTS would give detailed effect to Article 323(1), points (a) to (h), of the CRR by requiring three framework components: governance arrangements, an operational risk management process and an operational risk assessment system. They clarify responsibilities of the management body, senior management and the independent operational risk management function, and address operational risk data and taxonomy, the business indicator component, reporting, validation and audit. ICT risk requirements are intended to remain governed primarily by Regulation (EU) 2022/2554 (DORA).

Key dates

2026-12-31 Deadline

AST critical recommendations expected to be implemented, including same-day trade allocation/confirmation and adoption of the FMSB SSI standard

2027-10-11 Deadline

UK T+1 securities settlement cycle begins; transferables securities traded on a UK venue and settled on a UK CSD are expected to settle on T+1 basis

Suggested considerations

• Review whether the firm has completed a T+1 project plan, secured budget and governance, and mapped all required system and process changes.
• Check that trade allocation and confirmation processes can operate by end of trade date, or identify remediation needed to reach that standard.
• Confirm adoption of the FMSB standard for sharing standard settlement instructions and align client outreach to ensure clients use the same standard where relevant.
• Assess whether current settlement performance can be measured clearly, including failure rates and root causes, and whether management information is sufficient to track progress.
• Validate dependencies on custodians, counterparties, clients and third-party providers, and obtain their implementation timelines and testing plans.
• Prepare testing strategy and evidence for testing readiness, including alignment with the UK/EU joint testing plan.
• Consider whether the firm’s fund settlement cycle should move to T+2 before 11 October 2027 to reduce cycle mismatch risk.
• Increase automation where manual processes remain material, particularly in matching, confirmation and settlement instruction workflows.

What changed

This is not a new rule notice, but it is a supervisory signal about expectations for the 11 October 2027 T+1 transition. The FCA expects firms to have completed T+1 project planning, secured budget and governance, and be well into implementation, with system and process changes underway and testing plans finalised by the time the market moves closer to 2027. The FCA highlighted specific implementation priorities drawn from the Accelerated Settlement Taskforce framework, including allocating and confirming trades by the end of trade date, adopting the Financial Markets Standards Board...

Key dates

2026-03-25

NCUA issued the proposed rule to remove the prescriptive requirements

2026-05-26 Deadline

Public comment period closed

2026-08-06

Final rule was published in the Federal Register at 91 FR 50677

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to review current indirect vehicle lending policies to confirm they no longer reference the removed 50% and 100% net-worth limits.
• Boards may wish to document a board-approved risk appetite and concentration framework for third-party serviced indirect vehicle loans.
• Credit unions may wish to align vendor oversight, due diligence, and servicing controls with their internal policies since the prior waiver pathway is no longer the operative framework.
• State-chartered federally insured credit unions may wish to verify any conforming updates needed to insurance-related procedures and governance materials.
• Compliance functions may wish to update training, policy manuals, and examination binders to reflect that supervision will now focus on principles-based oversight rather than the deleted rule text.

What changed

The final rule removes 12 CFR 701.21(h) in full, eliminating the existing concentration limits, the 30-month step-up to a higher limit, the waiver process to a Regional Director, the related response timeline, and the embedded definition framework tied to that paragraph. NCUA also states that it removed the parallel requirement in 12 CFR 741.203(c) and the related citation in 12 CFR 746.201(c), as part of the same deregulatory package.

Key dates

2026-02-25

NCUA issued the proposed rule removing 12 CFR 701.26; public comments were invited through April 27, 2026

2026-04-27 Deadline

Public comment deadline on the proposal

2026-08-06

Final rule published in the Federal Register at 91 FR 50674

2026-09-08 Deadline

Final rule becomes effective

Suggested considerations

• Compliance teams may wish to remove references to 12 CFR 701.26 from policies, procedures, and training materials once the rule is effective.
• Firms should consider confirming that contract templates still include written terms addressing audit rights, information security, business continuity, indemnification, performance metrics, data ownership and return, termination, and dispute resolution.
• Credit unions involved in shared operational arrangements may wish to review whether documentation now reflects the updated clarification in 12 CFR 721.3.
• Firms may wish to confirm that third-party risk management, vendor oversight, and due diligence controls remain aligned with existing supervisory expectations despite the regulatory deletion.

What changed

The final rule rescinds 12 CFR 701.26, which had addressed FCU authority to enter written contracts for assets or services relating to daily operations and required those agreements to be in writing. NCUA states that the contractual authority already exists under the FCU Act and incidental powers authority, so the regulation was redundant. The Board also amended 12 CFR 721.3 to formally clarify that credit unions may act as representatives in shared operational arrangements with other credit unions or organizations, and that fixed assets may be shared.

Key dates

2026-07-31

Joint ESA statement on ICT risks from frontier AI models in the EU financial sector published

Suggested considerations

• Compliance teams may wish to map existing and planned uses of frontier AI models (including large language models and other advanced generative or predictive systems) to current ICT risk and cyber resilience frameworks under Regulation (EU) 2022/2554 (DORA) to demonstrate that these models are covered by documented risk assessments, controls and monitoring.
• Firms should consider reviewing governance arrangements for frontier AI, including board and senior management oversight, clear accountability, and integration of AI-related ICT risks into the firm’s risk appetite, risk taxonomy and operational risk frameworks, with specific escalation and reporting lines.
• Risk and technology functions may wish to update ICT and cyber risk management policies to explicitly address frontier AI threats (e.g. prompt injection, model poisoning, data leakage, adversarial attacks) and to align detection, logging and incident response capabilities with the ESAs’ emphasis on prevention, detection and management of AI-related cyber risks.
• Operational resilience teams should consider conducting scenario analysis and testing around frontier AI incidents (such as compromised AI-enabled customer interaction tools or automated decision engines) to evidence the ability to maintain critical services in line with DORA requirements on ICT-related incident management and business continuity.
• Compliance and procurement teams may wish to review contracts and due diligence for critical ICT third‑party providers that supply or host frontier AI models, assessing how provider controls, service levels and incident processes meet DORA expectations and the ESAs’ focus on frontier AI risks.
• Supervisory engagement teams should consider preparing to discuss the firm’s frontier AI strategy, risk management and governance with competent authorities, using the ESA statement as a reference point for how existing supervisory expectations on ICT risk and cyber resilience are applied to AI use cases.
• Internal audit and second‑line control functions may wish to plan thematic reviews of frontier AI deployments to assess coverage of AI-specific ICT risks within existing control frameworks, including documentation quality, model oversight, and alignment with DORA and sectoral guidance.
• Firms should consider monitoring forthcoming ESA and national competent authority publications on frontier AI and DORA oversight activities, as the statement signals that supervisory practices and expectations in this area are evolving and may be further operationalised.

What changed

The publication introduces a consolidated supervisory expectation that frontier AI models be treated explicitly as a source of ICT and cyber risk within existing EU operational resilience and ICT risk management frameworks, rather than as a separate technology domain. It emphasises the need for robust governance, risk management, and controls around the prevention, detection and management of cyber risks stemming from frontier AI, including model governance, validation, monitoring and incident handling.

Key dates

19 September 2022 – 7 October 2022

- Approximate three‑week period during which LFSHK’s systems were restored in phases and clients could not trade via mobile app or internet platform, relying only on account executives to place orders

19 September 2022

- Ransomware attack on LFSHK’s critical IT infrastructure, affecting servers and core trading‑related systems

7 October 2022

- Completion of LFSHK’s system restoration following the ransomware attack

TBD (post‑incident)

- LFSHK conducted internal reviews and appointed an independent reviewer at the SFC’s request to assess the incident and cybersecurity internal controls; exact dates are not specified but occurred after the attack and prior to enforcement

TBD (enforcement publication date)

- SFC issues public disciplinary action reprimanding and fining LFSHK HK$2.1 million for misconduct relating to inadequate cybersecurity controls; the reference number indicates 2026 publication but the precise calendar date is not specified in the excerpt

Suggested considerations

• Conduct a comprehensive cybersecurity risk assessment and control gap analysis across all critical systems, including trading platforms, email servers, domain controllers, file servers, and accounting systems.
• Implement and regularly review firewall configurations and network monitoring tools to ensure effective protection and detection capabilities for internal and external network traffic.
• Upgrade all operating systems and antivirus software to supported, fully patched versions and establish formal patch and vulnerability management procedures with defined timelines and testing steps.
• Establish and enforce robust user access management policies, including least‑privilege access, periodic recertification of user and privileged accounts, and logging and monitoring of admin activities.
• Implement secure password management solutions and technical controls, eliminating unencrypted storage of credentials and enforcing strong password complexity, rotation, and multi‑factor authentication where applicable.

What changed

• - Licensed corporations must ensure that firewall protection and network monitoring are implemented and effective across critical infrastructure, including file servers, domain controllers, email...
• Licensed corporations must maintain up‑to‑date operating systems and antivirus software, avoiding end‑of‑life or unpatched environments that materially increase vulnerability to ransomware and other...
• Firms must enforce strong user access and privileged account controls, including robust administration of system admin accounts, least‑privilege access models, periodic reviews of access rights, and...
• Firms must implement secure password management practices, prohibiting the storage of credentials in unencrypted files and enforcing strong password policies and technical controls for credential...
• Remote access must be subject to strict controls, including secure configuration of VPN or other remote access solutions, need‑to‑have access principles, and monitoring for unusual or unauthorized...

Key dates

2026-06-25

CFTC published the original request for comment in the Federal Register at 91 FR 38334

2026-07-08

CME NYMEX self-certified a 24/7 oil contract

2026-07-09

CFTC stayed the self-certified 24/7 oil contract

2026-07-28

CFTC published the extension of the comment period at 91 FR 47158

2026-08-26 Deadline

Extended comment deadline for the request for comment

Suggested considerations

• Compliance teams may wish to assess whether existing trading, clearing, settlement, surveillance, and customer-protection controls would function on a 24/7 basis.
• Firms may wish to review the CFTC’s additional questions on the stayed CME NYMEX crude oil contract and consider whether their comments should address execution, settlement, market integrity, and operational resilience issues.
• Market participants may wish to prepare data-driven comments, because the CFTC’s consultation is focused on factual and empirical input rather than conclusory policy statements.
• Firms considering perpetual or around-the-clock products may wish to map any dependencies on payment systems, margin processes, and holiday/weekend operational support before submitting comments.

What changed

This publication does not impose a new binding rule; it extends the comment deadline for an existing request for comment by 30 days. The underlying consultation covers two issues: whether standard futures contracts, including energy futures, can trade on a 24/7 basis without changing expiration, delivery, or settlement terms, and whether perpetual contracts referencing physically delivered or storable energy commodities should be permitted.

Key dates

31 July 2023

- Consumer Duty came into force for open products and services and firms were expected to have outcomes monitoring capability in place from day one

31 July 2024 Deadline

- The final Consumer Duty implementation deadline applied to all in-scope financial services firms

2025

- The FCA reviewed firms’ approaches to outcomes monitoring over the past year and published its findings in this blog and related review material

TBD (ongoing)

- Firms are expected to continue regular monitoring, testing, and evidence-gathering on an ongoing basis under PRIN 2A.9

Suggested considerations

• Firms must establish and maintain a documented outcomes monitoring framework that defines good and poor customer outcomes for each relevant product or service.
• Firms must map metrics to the full customer journey, including product design, communications, customer support, and distribution arrangements.
• Firms must collect MI that can identify poor or potentially poor outcomes, root causes, and emerging risks before harm crystallises.
• Firms must document the rationale for each metric, threshold, and tolerance, including why those measures are appropriate for the customer population and product.
• Firms must maintain a clear audit trail linking MI, governance review, decisions, remediation, and outcome improvement testing.

What changed

• - The FCA expects firms to regularly assess, test, understand, and evidence the outcomes retail customers are receiving under the Consumer Duty.
• Firms should use monitoring to identify whether any group of retail customers is experiencing different outcomes from another group for the same product and understand why those differences exist.
• Monitoring frameworks should define what good outcomes look like in practice and translate those outcomes into measurable indicators tied to the customer journey.
• Firms should not rely on broad or high-level MI alone; they must use information to challenge performance, identify risks, and drive improvements.
• Firms should be able to explain why metrics and tolerances were chosen and whether any actions taken have been tested and shown to reduce harm or friction.

Key dates

22 June 2026

- CFTC issues the targeted request for comment on extending standard energy futures to 24/7 trading and on the listing of perpetual contracts referencing physically delivered or storable energy commodities

26 July 2026 Deadline

- Original 30‑day comment deadline for the RFC on 24/7 trading and energy perpetual contracts (now superseded by the extension)

26 August 2026 Deadline

- Extended deadline for submission of public comments on the RFC regarding 24/7 trading of standard energy futures and perpetual contracts referencing physically delivered or storable energy commodities

Suggested considerations

• Identify and convene an internal cross‑functional working group (trading, risk, operations, compliance, legal, and IT) to assess potential impacts of 24/7 trading and energy perpetual contracts on your firm’s business model and control environment.
• Perform a gap analysis of current trading, clearing, surveillance, margin, and risk management frameworks against the operational and risk expectations articulated in recent CFTC staff advisories and policy statements on 24/7 markets and perpetual contracts.
• Draft and submit a data‑driven comment to the CFTC by 26 August 2026 addressing the RFC questions most relevant to your activities, including empirical analysis of liquidity, price formation, manipulation risk, funding rate behavior, and customer protection in energy derivatives.
• Review and update internal policies and procedures for trade surveillance, market abuse monitoring, and manipulation detection to address continuous 24/7 trading windows and any contemplated use of energy perpetual contracts.
• Assess whether current staffing models, systems support, and incident‑response processes can support 24/7 trading or clearing operations, and document enhancements or mitigations that would be needed to maintain operational resilience.

What changed

• - The CFTC has extended the comment deadline on the RFC regarding 24/7 trading of standard futures contracts and perpetual contracts in energy markets by 30 days, moving the due date to 26 August...
• The RFC focuses on the extension of standard futures contracts, including energy futures, to a 24/7 trading schedule while keeping fixed expirations but allowing potentially material economic changes...
• The RFC separately focuses on the listing and regulation of perpetual contracts that reference physically delivered or storable energy commodities, such as crude oil, and that have no fixed...
• The Commission has added additional questions to the original RFC to probe market integrity, price formation, operational resilience, customer protections, and risk management implications of 24/7...
• The RFC builds on and is informed by the CFTC’s May 29, 2026 coordinated actions on perpetual contracts and 24/7 trading in digital commodities, including the Policy Statement on perpetual contracts,...

Key dates

Late 2026

- Expected Governing Council decision on the final design proposal for the new euro banknote series

Subsequent years (post‑2026)

- Progressive introduction of new‑series euro banknotes into circulation, co‑circulating with existing series which retain value

21 September 2026

- Closure of the ECB public online survey on the ten shortlisted euro banknote design proposals

Suggested considerations

• Establish an internal project workstream to monitor ECB communications on the banknote redesign and plan for operational impacts on cash handling, ATM networks and merchant devices.
• Conduct a preliminary impact assessment of how new banknote security and design features may affect existing banknote sorting, authentication and recycling equipment, and identify likely upgrade or replacement needs.
• Engage with ATM and cash‑handling hardware vendors to understand expected firmware, sensor and software changes required to support the new banknote series and to secure upgrade slots ahead of issuance.
• Review and update internal cash‑handling and banknote authentication procedures, including staff training materials, to incorporate new design and security features once technical specifications are published.
• Plan customer communications strategies to explain the coexistence of old and new series banknotes, reaffirm the continued validity of previous series, and address any fraud or counterfeiting concerns.

What changed

• - The ECB has published ten shortlisted design proposals for the next series of euro banknotes, based on the two themes “European culture” and “Rivers and birds”.
• An EU‑wide online public survey has been launched to collect feedback on the shortlisted designs, forming part of the ECB’s inclusive approach to banknote design.
• The ECB’s Governing Council will select a single design proposal around the end of 2026, informed by the Design Contest Jury conclusions, technical assessments and survey results.
• The chosen design will undergo further development and testing before production, including integration of new and improved security features.
• The new series of euro banknotes will be introduced into circulation in subsequent years, alongside existing series, which will retain their legal value and continue to circulate.

Key dates

20 January 2026

– CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions, electronic money institutions and account information service providers is published

23 March 2026

– Decision date of the administrative sanction imposed on members of the board of directors of an electronic money institution

30 June 2026

– Application date of CSSF Circular 26/906, from which its governance and risk‑management requirements formally apply to payment institutions and electronic money institutions

21 July 2026

– CSSF publicly releases the notice “Administrative sanction of 23 March 2026 – Administrative sanction imposed on the members of the board of directors of an electronic money institution.”

Suggested considerations

• Review and map the institution’s current governance framework, board charter and committee mandates against the detailed requirements of CSSF Circular 26/906, including central administration, board composition, responsibilities and functioning.
• Ensure that the board of directors collectively has the required expertise, independence, diversity and time commitment, and that this is documented and periodically reassessed in line with CSSF expectations.
• Update board policies to explicitly assign responsibility for strategy, risk appetite, safeguarding of client funds, information security, outsourcing, conflicts of interest and AML/CFT, and ensure these responsibilities are effectively discharged and evidenced.
• Confirm that the institution’s central administration, decision‑making centre and administrative centre are physically located in Luxembourg and that members of the management body are sufficiently present on site, as required under the governance framework.
• Establish or reinforce the “three lines of defence” model by clearly separating business units, control functions (compliance and risk) and internal audit, and ensure reporting lines to the board are independent and robust.

What changed

• - The CSSF demonstrates that it is prepared to impose administrative sanctions directly on members of the board of directors of electronic money institutions, not just on the institution as a legal...
• Board members of Luxembourg‑authorised electronic money institutions are now clearly exposed to personal regulatory liability for governance, risk management and safeguarding failures under the CSSF...
• This enforcement confirms that CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions and electronic money institutions is not only a formal...
• The sanction underscores CSSF expectations that the supervisory body (board of directors) must ensure sound and prudent management, continuity of the institution and protection of its reputation, and...
• The case signals a stricter enforcement posture by the CSSF towards the payments and e‑money sector, aligning its expectations and enforcement intensity more closely with bank‑equivalent governance...

Key dates

2026-07-16

FDIC, Federal Reserve Board, and OCC issued the joint statement on handling highly sensitive information during examinations

2026-07-16 Deadline

Affected banks must be notified of any potential or confirmed material data breach involving confidential supervisory information no later than 72 hours after discovery, unless legal restrictions apply

Suggested considerations

• Compliance teams may wish to review examination response procedures for materials that could be treated as highly sensitive, including technology diagrams, penetration test results, detailed control-weakness reports, and similar data.
• Banks may wish to establish an internal process for flagging sensitive examination materials to examiners and documenting the basis for the sensitivity designation.
• Firms may wish to confirm that exam-response playbooks address on-site review, direct-from-system access, redaction, and summarization options for especially sensitive documents.
• Compliance and information security teams may wish to ensure escalation paths are ready if examiners disagree about whether information should receive enhanced handling.
• Firms may wish to verify incident-response and supervisory-notification procedures can support rapid engagement if a material supervisory-information breach is suspected.

What changed

The agencies said they will use a coordinated approach to identify highly sensitive data and documents during examinations and will apply enhanced handling procedures to reduce cybersecurity risk while preserving examiner access. The statement says review may occur on-site rather than by transferring materials onto agency systems, and the agencies may use other protective methods such as direct digital review from the bank's own systems or review of redacted or summarized materials where appropriate.

Key dates

14 October 2026 Deadline

- Deadline for submitting responses to PRA Consultation Paper CP10/26 on the deletion of the Continuity of Provision of Services Chapter and related changes to the Ring‑fenced Bodies Part

Suggested considerations

• Assess the current use of the Continuity of Provision of Services Chapter in the Ring‑fenced Bodies Part within your firm’s ring‑fencing policies, procedures, contracts and governance, and identify all controls that explicitly rely on those rules.
• Prepare and submit a considered response to CP10/26 by 14 October 2026, addressing the practical impact of deleting the Continuity of Provision of Services Chapter, any residual areas of concern, and suggestions for guidance or transitional arrangements.
• Coordinate with group entities acting as permitted suppliers or critical service providers to ensure their OCIR documentation, service catalogues, TSAs and liquidity arrangements remain aligned with the ring‑fenced body’s continuity requirements in the absence of the deleted chapter.
• Monitor for the subsequent PRA policy statement that will follow CP10/26, and be prepared to implement any final rule changes, transitional provisions or clarifications on how ring‑fencing continuity expectations intersect with OCIR and operational resilience regimes.

What changed

• - The PRA proposes to delete in full the Continuity of Provision of Services Chapter in the Ring‑fenced Bodies Part of the PRA Rulebook, removing the specific ring‑fencing continuity‑of‑services...
• The PRA will make consequential amendments to the Ring‑fenced Bodies Part to remove or adjust cross‑references, defined terms and obligations that are linked to the deleted Continuity of Provision of...
• The proposal effectively retires the bespoke continuity‑of‑services construct that was introduced when ring‑fencing was implemented (including detailed constraints on termination, suspension or...
• The consultation paper explains how the PRA intends to align ring‑fenced bodies’ continuity‑of‑services expectations with existing supervisory statements on operational continuity in resolution (for...
• The PRA invites stakeholders to comment on whether deleting the Continuity of Provision of Services Chapter, and relying on the broader operational continuity regime, still adequately protects the...

Key dates

12 November 2024

- UK regulators publish final policy and supervisory materials setting out the CTP oversight regime, including Fundamental Rules and operational risk and resilience requirements

01 January 2025

- CTP rules and oversight regime take legal effect, but only apply once a provider is designated as a CTP

13 July 2026

- Regulations for CTP oversight come into effect for the first designated CTPs; Bank of England, PRA and FCA formally start supervising AWS EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle UK as CTPs

Suggested considerations

• Review and update the firm’s operational resilience framework, including impact tolerances and scenario testing, to explicitly incorporate systemic risk arising from reliance on the designated CTPs and potential correlated failures affecting multiple services or regions.
• Re‑assess outsourcing and third‑party risk management policies to ensure they clearly distinguish between obligations placed on regulated firms and those placed directly on CTPs, while maintaining robust due diligence, ongoing monitoring and exit strategies for all CTP‑hosted services.
• Engage with designated CTPs (through account management, risk and security channels) to understand their approach to compliance with the CTP regime, including incident reporting arrangements, resilience testing, communication protocols and any new assurance artifacts they plan to provide.
• Update board and senior management reporting so that reliance on designated CTPs, associated systemic risk and regulatory developments under the CTP regime are regularly monitored and discussed at appropriate governance forums (e.g. risk committee, operational resilience committee).
• Review major incident management and crisis communication playbooks to ensure they include specific escalation paths, contact points and joint incident handling procedures with designated CTPs and relevant regulators.

What changed

• - A new CTP oversight regime becomes operational on 13 July 2026, under which the Bank of England, PRA and FCA will jointly supervise certain technology and service providers whose failure could...
• HM Treasury has made the first formal CTP designations: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited.
• Designated CTPs must identify and manage risks to their critical services effectively, including governance, risk management and operational resilience arrangements specifically focused on services...
• CTPs are required to maintain open, timely communication with regulators and with firms that rely on them, particularly during major incidents, implying strengthened incident reporting,...
• The three regulators will jointly oversee CTPs under a proportionate regime focused on resilience of “critical services”, including assessing and mitigating system‑level risks and reducing the risk...

Key dates

20 January 2026

– CSSF publishes Circular 26/906 on central administration, internal governance and risk management for payment and e‑money institutions, raising supervisory expectations for the sector

2 March 2026

– CSSF issues the administrative sanction decision imposing an administrative fine of EUR 12,000 on PingPong Europe S.A. as an electronic money institution

30 June 2026

– Effective date of CSSF Circular 26/906, from which strengthened governance, risk management and safeguarding requirements apply to payment and e‑money institutions

8 July 2026

– CSSF publicly publishes the administrative sanction of 2 March 2026, formally informing the market and stakeholders

Suggested considerations

• Review the CSSF sanction against PingPong Europe S.A. and identify which categories of requirements (e.g. governance, safeguarding of client funds, reporting, outsourcing, internal controls) were implicated, then map these to your own control framework.
• Conduct a gap analysis against CSSF Circular 26/906, focusing on central administration, internal governance, risk management, and safeguarding of client funds for payment and e‑money institutions.
• Update policies, procedures and internal control documentation governing payment services, e‑money issuance, safeguarding (segregation, reconciliations), outsourcing and IT connectivity to ensure alignment with CSSF Circular 26/906.
• Ensure that a clearly designated member of the management body holds documented responsibility for oversight of safeguarding arrangements and compliance with CSSF requirements for payment and e‑money institutions.
• Implement or enhance daily reconciliations and robust segregation of client funds accounts, supported by periodic internal reviews and testing of safeguarding controls.

What changed

• (From the enforcement notice itself, there are no new rules; the impact is interpretative and enforcement‑related.)
• CSSF confirms that authorised electronic money institutions are subject to active supervisory and enforcement scrutiny, including public administrative sanctions for regulatory breaches.
• The sanction demonstrates that failures which may appear operational or procedural can nonetheless result in monetary fines and public naming, reinforcing the need for robust compliance frameworks in...
• The case is likely to be assessed by CSSF in light of the new governance, risk management and safeguarding expectations introduced under CSSF Circular 26/906 for payment and e‑money institutions,...
• The public nature of the sanction underscores CSSF’s use of transparency as a deterrent tool, increasing reputational risk for firms that do not comply with licensing, governance, reporting or...