Luxembourg’s Law of 1 July 2024 implements the EU Digital Operational Resilience Act (DORA), integrating ICT risk management, resilience testing, and third-party oversight across financial entities. It designates the CSSF and CAA as supervisory authorities, empowers them to impose sanctions up to €5 million, and enters into force on 17 January 2025.
