Luxembourg “DORA Law” published in the Official Journal

After an unanimous adoption earlier in June, the national “DORA law” of 1 July 2024 was published in the Official Journal and will apply by 17 January 2025. This constitutes one more step towards a more resilient financial sector in Luxembourg.

As the provisions of the DORA Regulation are directly applicable in the European Union, the DORA Law, for the purpose of the implementation of DORA, aims to provide the competent national authorities responsible for ensuring the application of DORA (i.e. the CSSF and the CAA) with the supervisory and investigative powers necessary for the performance of their duties and to provide for an appropriate system of sanctions.

In addition, the DORA law transposes into Luxembourg law the DORA directive, which makes specific amendments relating to digital resilience and ICT security to the European directives on the financial sector. The DORA law thus carries out a targeted adaptation of a series of national laws relating to the financial sector. These amendments are necessary to ensure, in the interest of legal certainty, that these national laws are consistent with the DORA regulation as regards the application of operational digital resilience requirements currently dispersed across the various existing sector-specific laws.

The CSSF reminds financial entities that DORA will be applicable from 17 January 2025 and that they shall work towards compliance with the requirements of DORA. The DORA law is available on the DORA page of the CSSF website. The CSSF invites financial entities to regularly consult this site, which is kept up to date with new publications and relevant information.