DORA LEI Luxembourg: ICT Supplier and CSSF Register Rules

A DORA LEI Luxembourg request from a financial-entity client does not, by itself, mean an ICT supplier must obtain an LEI. The financial entity must identify suppliers that are legal persons in its register of information using a valid and active LEI or a European Unique Identifier (EUID), and both where available; a provider not established in the Union must be identified by LEI only. In Luxembourg, the CSSF also required the submitting financial entity’s LEI before its 2026 register could be uploaded through eDesk.

What this means in Luxembourg

The Commission de Surveillance du Secteur Financier (CSSF) – DORA submission timeframe for register of information set the Luxembourg submission window for the 2026 register cycle. Financial entities had to submit their registers to the CSSF via eDesk between 11 February 2026 and 31 March 2026. The register’s reference date was 31 December 2025.

The CSSF specified a separate upload prerequisite: it had to receive the LEI of the submitting financial entity beforehand. This is not the same as a request for an ICT supplier’s identifier. When a Luxembourg financial-entity client asks a supplier for an LEI or EUID, it needs to identify that supplier in its register; when the client uploads the register, the CSSF’s stated prerequisite concerns the client’s own LEI.

Consider a fintech from Esch-sur-Alzette supplying a Luxembourg payment institution. The payment institution’s request for supplier identification should be assessed against the rules for the fintech’s legal person, while the eDesk upload prerequisite concerns the submitting payment institution. For a US cloud provider serving a Kirchberg fund manager, the provider is not established in the Union, so the register uses an LEI only. These examples distinguish the supplier identifier from the financial entity’s own LEI without treating every supplier request as a direct obligation on the supplier under DORA.

The CSSF notice describes the 2026 submission window. It does not provide a Luxembourg submission window for the next cycle, so financial entities should check subsequent CSSF instructions rather than reuse those dates.

DORA LEI Luxembourg: the rules at a glance

• DORA has applied since 17 January 2025. Financial entities register their ICT service arrangements.
• For an ICT provider that is a legal person, the register uses a valid and active LEI or an EUID, and both where available. A provider not established in the Union is identified by LEI only.
• The rule also covers recorded subcontractors that effectively underpin a service supporting a critical or important function.
• Ask the client for its data-collection deadline, which differs from the reporting deadline for competent authorities.

Why financial entities ask suppliers for identifiers

Regulation (EU) 2022/2554 (DORA), Article 28(3), requires financial entities to maintain and update a register of all contractual arrangements for ICT services provided by ICT third-party service providers. Part of their ICT risk management framework, it is maintained at entity, sub-consolidated and consolidated levels.

Financial entities must provide the register, or requested sections, to their competent authority on request and report at least yearly on new arrangements. The ESAs use registers to designate critical ICT third-party service providers. AFM DORA update 7 (August 2026) reported nineteen designations based on the registers.

Identification is the financial entity’s task, but it may ask a supplier to confirm its contracting legal person, identifier and ultimate parent, or obtain a relevant subcontractor’s details.

When an LEI or EUID can be used

Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024, published in the Official Journal on 2 December 2024, sets the standard register templates. Under Article 3(5), financial entities identify ICT providers that are legal persons using a valid and active LEI or the EUID referred to in Article 16 of Directive (EU) 2017/1132, and both where available. Individuals acting in a business capacity are excepted.

The Annex permits only an LEI or EUID for a provider that is a legal person; alternative codes are reserved for individuals acting in a business capacity. A legal person not established in the Union must be identified by LEI only, so the EUID option does not extend to the US cloud provider in the Luxembourg example.

Article 3(6) extends the rule through a direct provider whose ICT service supports a critical or important function. The financial entity must ensure that subcontractors recorded in the register which effectively underpin that service use a valid and active LEI or provide their EUID, and both where available. Individuals acting in a business capacity are excepted.

The ESAs RoI reporting FAQ (28 March 2025) confirms that templates B_01.01 and B_01.02 identify a financial entity by LEI only. An LEI is a 20-character alphanumeric code based on ISO 17442. The supplier’s EUID option differs from the financial entity’s LEI requirement and the CSSF’s eDesk prerequisite.

Check LEI status and understand reporting guidance

Article 3(5) requires a valid and active LEI. The ESAs check LEIs against the GLEIF database and EUIDs against BRIS reference data. Their FAQ also requires each ICT provider’s ultimate parent to be identified in the register. Suppliers should check an existing LEI’s status before sending it.

The FAQ says strict LEI-status checks, including active or lapsed status, would not be enforced during initial reporting, particularly in 2025. It gives no end date, so it does not confirm how checks will work in the next cycle.

For a third-country provider without an available LEI, the FAQ allows a financial entity to report another identifier: the file is not rejected, but the entry is flagged as a data-quality issue. This guidance does not change the Annex rule requiring LEI identification for a legal person not established in the Union. A supplier can apply for an LEI or, if its LEI has lapsed, renew its LEI.

Register dates and supplier preparation

Under the ESAs RoI reporting FAQ, from 2026 the reference date is 31 December of the preceding year. Competent authorities report to the ESAs by 31 March each year and set earlier deadlines for financial entities. The CSSF’s 2026 window is not a supplier data-collection deadline.

Cycle	Reference date	ESA reporting deadline for competent authorities	Luxembourg submission information
2026	31 December 2025	31 March 2026	CSSF eDesk window: 11 February 2026 to 31 March 2026
Next cycle	31 December 2026	31 March 2027	Check future CSSF instructions

The EBA – Preparations for reporting of DORA registers of information page collects the ITS, data model, validation rules and FAQ. Financial entities should check applicable competent-authority instructions.

1. Identify the contracting legal person and whether it is established in the Union.
2. Provide the requested LEI or EUID, and both where available; check an LEI’s active status first.
3. If the service supports a critical or important function, identify recorded subcontractors that effectively underpin it and collect their applicable identifiers.
4. Confirm the information identifying the supplier’s ultimate parent and ask the client for its collection deadline.

The guide to Luxembourg AMLR LEI checks covers a separate use case; other topics appear in the LEIFast regulation updates. For this register, confirm the contracting entity, eligible identifier and client collection deadline, and check with your regulator or adviser if the arrangement’s details affect your position.