DORA: addressing the second batch of technical standards

On 1 October 2024, Luxembourg’s banking and fund industries gathered for an event organised by ABBL and ALFI in cooperation with the CSSF, focusing on the Second Batch of Regulatory Technical Standards (RTS) under the EU Digital Operational Resilience Act (DORA). The event titled “DORA Getting Real: Second Batch of Technical Standards” aimed to provide a comprehensive overview of the latest regulatory requirements and their impact on financial institutions.

Insights from the CSSF on DORA readiness and compliance

The event delved into key topics such as subcontracting ICT services (RTS), notification and reports for major ICT incidents (RTS & ITS), aggregated annual costs and losses caused by major ICT-related incidents (Guidelines), and threat-led penetration testing (RTS).

A keynote speaker from the CSSF provided crucial insights into Luxembourg’s regulatory stance on DORA compliance and readiness, reinforcing the importance of timely preparedness to the application of DORA (17 January 2025).

CSSF’s survey of 389 entities in Luxembourg showed that:

• Nearly 90% of entities have carried out a gap analysis between their situation and DORA requirements.
• Overall, there is a strong progression in gap analysis realized compared to results from previous surveys (e.g. ABBL or PwC surveys done between March and June on a sample of entities).
• Credit institutions are the most advanced, with more than 97% having carried out a gap analysis, followed by AIFM and ManCo with nearly 90%.

Addressing key challenges in DORA implementation

The survey revealed the top 4 most critical challenges seen by credit institutions regarding DORA compliance, namely:

1. contractual negotiations with ICT third party service providers
2. dependencies on group
3. short delays to implement DORA requirements,
4. and shortage of resources (technical, human resources, budget).

Presentation of the survey results was followed by an engaging Q&A session where representatives from ABBL and ALFI conveyed questions collected from their members to the representatives of the CSSF on subjects related to subcontracting ICT services, reporting timelines, and TLPT requirements, offering attendees further much-needed clarity on DORA Second Batch of policy documents. Presentation materials of the event are reserved for ABBL members.

As DORA’s January 2025 implementation date approaches, this event served as a timely reminder for financial entities to ensure their digital operational resilience strategies are firmly in place.

Looking ahead

ABBL will continue following the DORA subject and will keep its members informed about further developments.

The ABBL thanks ALFI and CSSF for the cooperation on this event and specifically all the speakers: Ananda Kautz (ABBL), Gildas Blanchard (ALFI), Cécile Gellenoncourt (CSSF), Kathrin Moules (CSSF), Cristina Spinelli (CSSF), Karim Bouaissi (EY Luxembourg), Olga Frenkel (Franklin Templeton International Services), Luc Maquil (MAQIT), Grainne Goodman (M&G Luxembourg), Onur ÖZDEMIR (KPMG Luxembourg), Isadora Pardo (ALFI), and Andrey Martovoy (ABBL). We also extend our gratitude to 300 attendees of the event that turned to be a success.