Luxembourg: filing with the Commission de Surveillance du Secteur Financier

xbrl-csv-only

'plain CSV files, packaged in a .zip file, using the folder structure and file naming convention defined by the ESAs'. Only .zip accepted; .rar/.7z or renamed files rejected (ICTO002/003). No Excel route.

source high confidence

CSSF eDesk, procedure 'Submission of the Register of Information'

url https://edesk.apps.cssf.lu/edesk-dashboard/dashboard/getstarted?lng=en

login prerequisites Entity onboarded to eDesk; the entity's LEI communicated to the CSSF beforehand (nightly sync to eDesk); role 'DORA Reporting' assigned to at least one dedicated employee. Upload and validation messages go only to the user who uploaded. Warning: giving a third party eDesk access may expose other eDesk procedures.

source high confidence

LEI.IND_Country_Version_ReferenceDate_Timestamp.zip or LEI.CON_Country_Version_ReferenceDate_Timestamp.zip (ESA convention: ReportSubject.CON/.IND_Country_FrameworkCodeModuleVersion_Module_ReferenceDate_CreationTimestamp)

Example DUMMYLEI123456789012.IND_LU_DORA010100_DORA_2025-03-31_20250421141632000.zip (2025 guide example); for the 2026 cycle the reference date is 2025-12-31 (ICTO006), e.g. DUMMYLEI123456789012.IND_LU_DORA010100_DORA_2025-12-31_20260301120000000.zip

Notes LEI = 18 characters + 2 check digits, upper case; CON/IND consolidation flag; Country = two-letter ISO code of the submitting entity (LU); Version = DORA010100 ('constant for the reporting in 2025', still used in 2026 since the taxonomy is unchanged); Timestamp = YYYYMMDDHHMMSS000 and must be unique per upload (ICTO005). Non-compliant name -> ICTO001.

source high confidence

root folder must equal zip name yes

meta inf location <root>/META-INF/reportPackage.json (file name case-sensitive, content unmodified); <root>/reports/{report.json, parameters.csv, FilingIndicators.csv, b_xx.xx.csv}

size limit mb 20

timestamp uniqueness A file with the same name cannot be submitted twice (ICTO005); change the timestamp on every (re)submission

other rules

• Zip must contain one single report folder (ICTO011) named like the zip without .zip (ICTO010), 'name of the folder is in uppercase'
• Root folder contains exactly two subfolders 'META-INF' and 'reports' (ICTO012), case-sensitive; additional sub-folders/files prohibited; no .xls/.xlsx inside reports
• All .csv/.json UTF-8 (ANSI rejected)
• Table files lower case b_01.01.csv; missing table files tolerated if FilingIndicators has all 15 templates 'true'
• parameters.csv: entityID,rs:<LEI>.IND|.CON = first 24 characters of zip name; refPeriod = filename reference date; header 'name,value'
• Reference date in filename must be 31/12/2025 for the 2026 exercise (ICTO006)

source high confidence

Notes As of 16 March 2026 only 40% of required entities had submitted (CSSF update 17 Mar 2026). Validation checks unchanged since April 2025 'but will be applied to more data fields': 'a register of information which was accepted last year, may be rejected this year'. Feedback via eDesk 'Validation rules' section and downloadable .xlsx.

reference date 2025-12-31

opens 2026-02-11

deadline 2026-03-31

corrections until Resubmissions after CSSF-detected errors before 31 March 2026; ESA additional quality checks throughout April 2026, with CSSF-relayed refusals to be corrected and resubmitted so that the CSSF can forward them to the ESAs before end of April 2026 (CAA for insurers: by 30 April 2026)

extension Third-country branches of credit institutions: best-effort deadline 30 June 2026 (communiqué 17 Feb 2026)

source high confidence

reference date 2026-12-31

esa transmission deadline 2027-03-31

announced yes

opens 2027-02-28 (standing rule in Circular CSSF 25/882 point 18: 'between 28 February and 31 March of year n+1 at the latest', unless the CSSF communicates otherwise; in 2026 eDesk actually opened earlier, on 11 February)

deadline 2027-03-31 (Circular CSSF 25/882 point 18)

changes No 2027-specific communiqué found as of 31 Oct 2026. Circular 25/882 was amended by Circular 26/915 (27 Aug 2026) on third-country branches, not on the timetable. CSSF reserves the right to request the register at any time outside the window (point 20).

source high confidence

No test environment or dry-run window is mentioned in any CSSF RoI document found; the CSSF instead 'strongly recommends' submitting early so issues can be fixed before 31 March.

available no

source medium confidence

Upload -> immediate upload checks (ICTO001-012) -> CSSF analysis (Arelle/ESA framework 4.0 rules) -> 'Validation rules' section lists errors (blocking) and warnings; 'Download feedback' gives an .xlsx whose 'Validation' tab lists all findings. Accepted registers 'may then be forwarded on request to the ESA'.

roles 'DORA Reporting' eDesk role; any holder can upload. No maker/checker or second-user sign-off step is described in the CSSF guide, the error-message guidance or the 2026 communiqué.

source high confidence

format .xlsx downloadable from eDesk ('Download feedback' button in 'Validation rules'); tab 'Validation' = all error/warning messages (v88xx warnings are grouped on screen but itemised in the file); other tabs = parsed values and can be ignored. ESA refusals after forwarding are relayed by the CSSF.

timing Not stated as an SLA; messages are shown in eDesk after analysis.

resubmission Fix and re-upload with a new timestamp; include the eDesk Tracing Code when contacting ictrisksupervision@cssf.lu (content/ESA messages) or edesk@cssf.lu (onboarding/upload).

source high confidence

true

Entities 'shall ensure that they have communicated beforehand their LEI code to the CSSF'; otherwise upload fails with ICTO007 'No valid or existing LEI has been found for this entity'. Financial entities in B_01.01/B_01.02 are identified only by LEI (ESA FAQ 39).

source high confidence

All DORA financial entities under CSSF supervision (credit institutions not directly supervised by the ECB, investment firms, PIs/EMIs/AISPs, UCITS ManCos/AIFMs and funds, CASPs, data reporting providers, etc.); since 2026 also third-country branches (ESA Q&A #102, Circular 26/915). Insurance/reinsurance undertakings file with the Commissariat aux Assurances (SOFiE / E-File), not the CSSF.

source high confidence