DORA – Submission timeframe for register of information – eDesk Portal open as of 1 April 2025

(3)of Regulation (EU) 2022/2554 (DORA), the financial entities subject to DORA shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers. The Joint ESA decision published on 08 November 2024 (Joint ESA decision) requires competent authorities to submit to the ESAs the registers of information in relation to financial entities for which they ensure compliance with in accordance with Article 46 of DORA, by 30 April

1. Therefore, financial entities are required to submit their register of information to the CSSF for further transmission to the ESAs. Financial entities shall provide their registers at individual or consolidated level in line with Article 3 of the Joint ESA decision and as further explained in the Frequently Asked Questions published by the ESAs. As announced in a previous communiqué dated 15 January 2025, the financial entities are required to submit their register of information as relevant to the CSSF between 1 April 2025 and 15 April 2025 via eDesk. For 2025 (first year of submission), the reference date of the register of information is set to 31 March 2025, i.e. the register of information should contain all contractual arrangements contracted until 31 March
2. Additional information related to the eDesk procedure is provided below. Procedure to submit the register To be able to upload the register of information via the eDesk Portal, the role “DORA Reporting” needs to be assigned by a financial entity to at least one dedicated employee. Further details on how to assign this role can be found in the eDesk Portal user guide. When the role “DORA Reporting” has been granted, the eDesk procedure “Submission of the Register of Information” can be selected starting as from 1st April. During the upload and validation processes, certain messages will be generated and communicated to the financial entity. Please note that those messages will only be addressed to the person having effectively uploaded the register of information and not to all employees to whom the “DORA Reporting” role may have been granted. The CSSF highlights that the register of information must be submitted in plain-csv files, enclosed in a .zip-file following a predefined folder structure and file naming convention, as defined by the ESAs. Please note that it will be the first check done by the CSSF: if the extension, folder structure or naming convention are not correct, the entity will not be able to upload the register on the eDesk platform. As a reminder, the CSSF highly recommends financial entities to follow closely the ESAs’ practical information and instructions available on the EBA website for the preparation and submission of the register of information (Preparations for reporting of DORA registers of information). Further details on how to submit the register to the CSSF can be found in the User Guide for DORA – Submission of the Register of Information in the eDesk Portal. Potential requests for re-submission Uploaded registers of information will be subject to validation checks to be performed by the CSSF in due time. In case errors are detected, the submitting financial entity will be invited to fix them and re-submit its register of information before 30 April
3. During the month of May 2025, the ESAs will perform an additional second round of validation checks. Should the ESAs detect additional errors and consequently refuse the register of information on their side, the submitting financial entity must fix the detected errors and re-submit its register of information to the CSSF which will then forward it again to the ESAs. Disclaimer on providing access to the eDesk Portal In case financial entities will be assisted by third parties in the submission of their register of information, the CSSF would like to draw attention to the following. Providing access, even with a specific role, to the eDesk Portal to a third party entails the risk that such third party may have access to other eDesk reporting procedures, i.e. data of your entity that go beyond the data that are strictly linked to the submission of the register of information, including potentially sensitive data. Please ensure that any third party with access to the eDesk Portal confirms strict compliance with the confidentiality obligations relating to the data that may be accessed. Note that you remain solely responsible for the protection of your sensitive data in line with applicable regulations. Helpdesk For any question related to the submission of the register of information, please contact: ictrisksupervision@cssf.lu. For any technical question related to the use of the eDesk Portal, please contact: edesk@cssf.lu. 7 April 2025 - Updated on 24 April 2025 Register of information: Guidance tables on submission to the CSSF Guidance allowing financial entities to identify the National Competent Authority to which their register of information has to be submitted. CSSF guidance PDF (86.42Kb) Main topic: ICT and cyber risk – for DORA entities Relevant for Alternative investment fund managers Central Securities Depositories (CSDs) Credit institutions Crypto-Assets Service Providers (CASPs) Data Reporting Service Providers (DRSPs) Investment firms Management companies - Chapter 15 Payment institutions/electronic money institutions/AISPs Register of information: Guidance tables on submission to the CSSF The summary tables below are designed to help Luxembourg-based financial entities falling under the scope of the DORA regulation and supervised by the CSSF or the ECB (FE) to determine, whether a register of information needs to be communicated to the CSSF and based on which consolidation level, or whether it needs to be submitted to another competent authority (table 1) as part of the consolidated register of its parent company. In case it is to be submitted to the CSSF on a consolidated basis, the second table provides details for which entities the information needs to be included in the register. These tables should identify a number of cases, without claiming to be exhaustive. In case of doubt, financial entities may always contact their supervision departments. Table 1: Obligation of submission and level of consolidation The Financial Entity (FE) is not part of a group FE Individually To CSSF The FE is the EU parent of a group of FEs FE Supervised by the CSSF FE supervised by the ECB FE Consolidated To CSSF FE Consolidated To ECB* The FE is a subsidiary within a group of FEs whose parent company (PC) is not in the EU/EEA FE Individually To CSSF The FE is a subsidiary within a group of FEs whose EU PC is established in Luxembourg The FE is a subsidiary within a group of FEs whose PC in the EU is established in a Eurozone country The FE is a subsidiary within a group of FEs whose PC in the EU is established in an EU/EEA country outside the Eurozone PC is supervised by the CSSF PC is supervised by the ECB PC is not supervised by the CSSF or ECB PC is supervised by the ECB PC is supervised by an NCA from the same sector PC is supervised by an NCA from the same sector PC Consolidated To CSSF PC Consolidated To ECB* FE Individually To CSSF PC Consolidated To ECB* PC Consolidated To same sector NCA PC is supervised by an NCA from another sector FE Individually To CSSF PC Consolidated To same sector NCA PC is supervised by an NCA from another sector FE Individually To CSSF * The ECB asks that the information be submitted at the highest level of consolidation within the Single Supervisory Mechanism (SSM) considering the prudential scope of consolidation. In accordance with the DORA FAQs No 5, if the prudential scope of consolidation were to encompass financial entities within the meaning of DORA that belong to another (non-banking) financial sector, the register of information of this entity would therefore be encompassed in the consolidated/sub-consolidated RoI of the group and should consequently be reported to the ECB at consolidated level. Table 2: Identification of subsidiaries whose information must be included in the consolidated register to submit to the CSSF (submission of an EU parent entity established in Luxembourg under CSSF supervision) Does the subsidiary belong to the same Where is the subsidiary located? sector? Yes Yes Yes No In Luxembourg In the EU or EEA Outside the EU or EEA In Luxembourg No No In the EU or EEA Outside the EU or EEA REGISTER OF INFORMATION: GUIDANCE TABLES ON SUBMISSION TO THE CSSF Is the subsidiary supervised by the Should the consolidated RoI include information about CSSF? this subsidiary? Yes No No Yes No No No Yes Yes No Yes No No No