Where each obligation lands
We work only with supervised entities. This page is not a catalogue of regulations — it maps the texts you are accountable for onto the capability that handles them and the mode you buy it in.
Jurisdiction
Luxembourg and the European Union first
That is where we are based and where most of our clients are supervised. When a group extends beyond — a UK subsidiary, a Swiss entity, an Asian branch — we work the local requirement alongside your advisers there rather than claim a coverage we do not have.
Scope
This list is not exhaustive
These are the texts that come up most often in our engagements. If the obligation you are facing is not on this page, it does not mean we have not worked on it — ask.
DORA
ICT risk, third parties, resilience testing
Register of Information filed annually, critical-function mapping, contractual clauses, threat-led testing.
Where it lands: Resilience & security, all three modes.
CSSF 22/806
Outsourcing, cloud and providers
Materiality assessment, notification, register of arrangements, exit strategy, audit rights.
Where it lands: Resilience & security · Regulatory compliance.
EBA GL 2019/02
Outsourcing arrangements
The European baseline behind 22/806 — governance, due diligence, sub-outsourcing, monitoring.
Where it lands: Risk & assurance.
CSSF 25/882
ICT third-party risk
National application of the DORA third-party regime — classification, concentration, sub-contracting.
Where it lands: Resilience & security.
EU AI Act
Governance of AI systems
Inventory, risk classification, transparency, human oversight, post-market monitoring.
Where it lands: Technology & digital · Risk & assurance.
NIS2
Cyber resilience beyond finance
Management accountability, incident reporting deadlines, supply-chain security.
Where it lands: Resilience & security.
TIBER-LU
Threat-led penetration testing
Scoping, threat intelligence, red-team coordination, remediation tracking.
Where it lands: Resilience & security, Prove it.
Start from your obligation, arrive at a service. Tell us which line applies to you and we will scope a diagnostic on it. Agree the subject →