On 16 September 2026 the three European Supervisory Authorities, the EBA, EIOPA and ESMA, published joint operational instructions for DORA major incident reporting. Short and technical, the document addresses something narrow and, for reporting teams, immediate: how selected fields of the major-incident template are expected or recommended to be populated, so that the data reaching…
On 27 August 2026 the CSSF published Circular 26/915, and it applies with immediate effect. Circular CSSF 26/915 updates the Luxembourg ICT and outsourcing circular framework following the European Commission position on DORA’s applicability to third-country branches. It removes the TCB categories within the CSSF’s remit from the relevant pre-DORA circular provisions and maps them…
On 27 August 2026 the CSSF issued Circular CSSF 26/915, applicable with immediate effect, to bring specified third-country branches into the CSSF circular framework for DORA. For Luxembourg purposes, the governing scope is the branch perimeter set out in Circular CSSF 26/915 and in each amended circular; the change is not a blanket head-office-only test…
On 7 July 2026, the Chair of the ECB Supervisory Board, Claudia Buch, wrote to the CEO of every significant institution under a letter numbered SSM-2026-0301 and titled “Addressing AI-enabled cybersecurity threats”. The ECB AI cybersecurity letter does one operationally concrete thing behind its strategic language: it gives each directly supervised bank until 31 October…
A bank can hold a clean capital ratio, sit on more liquidity than it needs, and still be unable to open for business on a Monday morning. That gap between solvency and the ability to actually operate is where DORA AI risk reporting now lives. When a model your fraud team relied on starts approving…
If your firm filed a major incident under DORA in 2025, that report has now been counted. On 3 June 2026 the three European Supervisory Authorities published their first annual report on major ICT-related incidents, putting a hard number on what used to be guesswork: how many major incidents the EU financial sector reports, where…