Critical or important functions: classification with reasons

This page applies to both frameworks: to financial entities under the full framework of Articles 5 to 15 DORA and under the simplified framework of Article 16, including factoring and leasing firms, guarantee banks and the other institutions under Section 1a(2a) of the German Banking Act (KWG) (here: the KWG group) that move to DORA on 1 January 2027. Which framework applies to you is covered on the page on DORA applicability. This page deals with the question many obligations depend on: which of your functions are critical or important, and how you justify that.

What is a critical or important function?

Article 3(22) DORA describes a function with two alternatives. If one of them is met, the function is critical or important:

Three points follow directly from the wording and are often overlooked:

• Yes or no: The regulation defines “critical or important function” as a single term without levels, and the same obligations attach to it. A scale such as “high, medium, low” from a protection needs assessment or a BIA therefore does not replace the classification (our own reading of the wording). You can keep internal gradings in addition, for example for recovery objectives.
• Function, not system: What is classified is an activity or a process. The ICT services, applications and providers that support it are then mapped to the function.
• More than availability: According to BaFin, the definition resembles the protection goal of availability but is not identical to it. A function can also be critical or important because of confidentiality. The second alternative also covers functions whose disruption could be absorbed for days, such as regulatory reporting.

Who classifies, and is there a BaFin list?

The financial entity classifies its functions itself (Article 28(4)(a) DORA). In its supervisory notice of 21 August 2025 (section 7.1), BaFin states that the assessment is based on the impact a disruption or reduced performance would have, and that this requires developing suitable criteria and assessing all the circumstances. We have not found a list of typical critical or important functions in BaFin’s FAQ and supervisory notices (as of 6 November 2026, some FAQ pages on the topic cannot currently be retrieved). Any list, including the example list further down, is therefore your own determination, and you have to justify it.

The classification must be in place no later than before a contract for ICT services is concluded: at that point the financial entity assesses whether the contract supports a critical or important function (Article 28(4)(a) DORA). Under the full framework (except microenterprises), the policy on ICT services sets the method and timing of this assessment (Commission Delegated Regulation (EU) 2024/1773, Article 3(2)). Under the Article 16 framework the policy is not mandatory, because Article 28(2) DORA does not apply there. We still recommend a written method, so that it remains traceable why a function is on the list or missing from it.

This is not to be confused with the critical ICT third-party service provider under Article 3(23) and Article 31 DORA, which the supervisory authorities designate (see FAQ below).

Is this the same as a material outsourcing?

No. According to BaFin, the assessment as “critical or important” is not identical in method or content to determining materiality for outsourcing (supervisory notice of 21 August 2025, section 7.1). Both assessments run side by side.

A special rule applies to microenterprises in the KWG group: under Section 1a(2a) sentence 2 no. 3 KWG, Articles 28 to 30 DORA do not apply to them. In our reading, their external ICT procurement therefore stays within the scope of AT 9, insofar as MaRisk (BaFin’s Minimum Requirements for Risk Management) applies to them. When an institution counts as a microenterprise is explained on the page on DORA applicability.

How do you go about the classification?

The following approach is a recommendation by Blackfort Technology, not a supervisory requirement. It turns BaFin’s guidance into fixed steps and makes every decision verifiable.

1. Collect functions: from the process map or the business model, not from the application inventory. A function is an activity with its own result, such as “purchasing receivables”.
2. Check alternative 2 with a presumption: treat functions through which the firm meets licensing conditions or obligations under financial services law as critical or important at first. The presumption is rebutted only with written reasons. In our reading of the wording, obligations outside financial services law, for example under employment law, do not belong in this alternative.
3. Check alternative 1: assess the consequences of a disruption and of defective performance for earnings, liquidity, customers and continuity, including for confidentiality and integrity. The basis is the business impact analysis (Article 11(5) DORA under the full framework, RTS Article 28(2)(d) under the Article 16 framework).
4. Record the result: for each function yes or no, which alternative applies, reasons in two or three sentences, date and approval. Under the Article 16 framework, the management body approves the classification under RTS Article 30(1) (RTS Article 28(2)(d)).
5. Map the ICT: map to each critical or important function the supporting information and ICT assets, their dependencies and the ICT third-party service providers (Article 8(1) and (5) DORA under the full framework, RTS Article 30(1) and (2) under the Article 16 framework).
6. Review: under the full framework the classification must be reviewed for adequacy at least once a year (Article 8(1)), under the Article 16 framework as needed (RTS Article 30(1)). Triggers are new products, new providers, major ICT changes and incidents. If a function becomes critical or important, the authority must be informed in a timely manner under Article 28(3), fifth subparagraph, DORA.

What follows from the classification?

The attribute runs through the whole regulation. The overview shows the main consequences per framework. The consequences from Articles 28 to 30 apply equally under the Article 16 framework, except for microenterprises in the KWG group:

For institutions that apply MaRisk, including on a partial basis such as factoring and leasing firms, AT 7.3 adds a requirement: an emergency concept must be maintained for critical or important functions and reviewed annually. The consequences under DORA attach to the ICT services that support a function. A list that is too generous therefore brings the additional content under Article 30(3) into every related contract.

For the KWG group, Articles 28 to 30 apply from 1 January 2027, but incident reporting under Chapter III has applied since 17 January 2025. Anyone who has to classify an ICT-related incident today therefore needs the function list now. How the classification works is set out on the page on DORA incident reporting.

Example: function list of a factoring firm

Fictitious example, not a client. Muster-Factoring GmbH buys receivables from mid-sized client companies. It has 23 staff and total assets of EUR 61 million, so it is not a microenterprise (for the test, see DORA applicability). As a financial services institution in the KWG group, it applies the simplified framework under Article 16 and Articles 28 to 30 DORA from 1 January 2027. It obtains its factoring core system as software as a service and processes payments through banking software. In October 2026 the management approves this function list:

What the list triggers in the example: the contracts with the core system provider, the banking software provider, the credit agency (its interface supports the purchase of receivables), the data centre provider and the cloud archive are kept in the register of information as “supports a critical or important function” and are checked against the content of Article 30(3) from 2027. For the core system, which carries two of the five critical or important functions, the institution assesses concentration risk under Article 29 and sets an exit strategy. Web hosting and the payroll bureau stay in the register if they provide ICT services, but without the flag. And already today, an incident in the core system counts as affecting the criterion “criticality of services affected” in incident classification.

Three typical gaps

What Article 16 otherwise requires and where the function list appears in the other evidence is set out on the page on DORA Article 16. The register of information is explained on the page on the DORA register of information, managing ICT providers on the page on managing ICT third-party service providers.

How we support you

For institutions moving from BAIT (BaFin’s supervisory requirements for IT in banks) on 1 January 2027, the function list with business impact analysis and recovery objectives is part of the service for the transition from BAIT to Article 16. Everyone else, including entities under the full framework, starts with the DORA gap analysis. It shows where the existing classification has gaps.