DORA applicability: full framework, Article 16 or out of scope

Classification answers two questions: does DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025) apply to your organisation, and if so, under which framework? Where national rules extend the scope, this page follows German law.

Which entities does Article 2 DORA list?

Article 2(1) lists 21 types of entity. Points (a) to (t) are collectively called “financial entities” (Article 2(2)), and only they carry the obligations of the regulation.

Point (u) covers ICT third-party service providers, which are not financial entities. “Credit institution” in point (a) means a CRR credit institution: according to BaFin, any firm taking deposits and granting loans has been directly in scope since 17 January 2025. German institutions without that combination, such as guarantee banks, come in through the national extension.

Which exemptions does Article 2(3) provide?

• (a) managers of alternative investment funds referred to in Article 3(2) AIFMD (small registered managers)
• (b) insurance and reinsurance undertakings referred to in Article 4 Solvency II, which are outside Solvency II because of their small size
• (c) IORPs whose pension schemes together have no more than 15 members (German article text: fewer than 15, see the note below)
• (d) persons exempted under Articles 2 and 3 MiFID II
• (e) insurance, reinsurance and ancillary insurance intermediaries that are micro, small or medium-sized enterprises
• (f) post office giro institutions referred to in the CRD

Note on point (c): the language versions differ. The English text reads “not more than 15 members”, and recital 39 of the German version also says “nicht mehr als 15” (not more than 15). Only the German article text reads “weniger als 15” (fewer than 15). Whether DORA applies to an IORP with exactly 15 members is therefore open. All language versions are equally authentic. Have this edge case reviewed by a lawyer.

According to BaFin, regulated firms outside DORA still have to manage ICT and cyber risks as part of proper business organisation.

Who is added by German law?

The German Financial Market Digitalisation Act (FinmadiG) extends the scope through the Banking Act (KWG), the KfW Regulation (KfWV) and the Insurance Supervision Act (VAG):

BaFin will repeal the BAIT, the German banking IT circular, in full with effect from the end of 2026. Financial holding companies are neither in scope today nor part of the KWG group, but the BAIT apply to them until the end of 2026. What applies to them from 2027 is open in the sources we reviewed.

Which framework applies?

Under DORA itself, only two groups fall under Article 16 in Germany: small and non-interconnected investment firms (Article 3(34)) and small IORPs (Article 3(53)). Germany did not use the exemptions in the Payment Services and E-Money Directives, so payment and e-money institutions apply the full framework, however small they are.

Work through the questions in order:

1. Does the entity, by its licence, belong to a type in Article 2(1)(a) to (t)? If not, go to 4.
2. Does an exemption under Article 2(3) apply? If yes: out of scope.
3. Is it a small and non-interconnected investment firm or an IORP with 16-99 members (German text: 15-99, see the note on point (c))? If yes: Article 16, otherwise the full framework.
4. Is it KfW or a regional development bank? Full framework. An institution under Section 1(1b) KWG? Article 16 from 2027, reporting since January 2025. An insurance holding company under Section 293 VAG? Article 16. Otherwise: out of scope.
5. For every in-scope result: check microenterprise status with documented figures (next section).

Where a firm holds several licences, assign each licence to a type. If one of them falls under Article 2(1), the firm as a whole is directly in scope, as a payment institution under the full framework, including its factoring business. Section 1a(2a) KWG then does not apply by its wording, because sentence 1 only covers institutions not already in scope under Article 2 DORA. This is our reading of the wording. Have it confirmed for your case by a lawyer.

Microenterprises: why the status must never be assumed

Under Article 3(60), a microenterprise is a financial entity (other than a trading venue, central counterparty, trade repository or central securities depository) that employs fewer than 10 persons and “has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million”. The German text (“bzw.”) is equally unclear on whether one figure suffices. For the KWG group, Articles 28-30 and therefore the register of information do not apply to microenterprises. Record headcount, turnover and balance sheet total with reference date and source. If one financial figure exceeds EUR 2 million, we advise planning without the relief and seeking legal clarification. In our assessment, firms with a sizeable receivables or leasing portfolio usually exceed EUR 2 million in total assets.

Are ICT service providers in scope?

Not as financial entities. According to BaFin, DORA affects ICT third-party service providers indirectly through the contractual requirements their financial clients must include, and they have no incident reporting obligation under DORA. Their own reporting obligations, for example under NIS2 or German telecoms law, may still apply. The exception is critical ICT third-party service providers designated by the European Supervisory Authorities under Article 31, which fall under the oversight framework.

Does NIS2 apply as well?

Whether a financial entity is also an NIS2 entity is a separate assessment under Section 28 of the German BSI Act (see NIS2-Readiness: NIS2 applicability (in German)). If it is, Section 28(6) BSIG disapplies Sections 30-32, 35, 36, 38 and 39, while registration under Section 33 may remain. For the KWG group this follows from the wording from 1 January 2027 and is not established for the period before.

Self-check

These questions give a first indication only. The result is not an assessment and not legal advice.

1. Which licences does the firm hold, and which Article 2(1) type does each correspond to?
2. Does it take deposits and grant loans?
3. Does one of the exemptions in Article 2(3)(a), (b), (d) or (f) apply?
4. Is it an insurance intermediary, and if so, is it micro, small or medium-sized under Article 3(60), (63), (64)?
5. Is it an IORP, and how many members do all its schemes have together?
6. Is it an investment firm meeting the conditions of Article 12(1) of Regulation (EU) 2019/2033?
7. Is it KfW, a regional development bank, an institution under Section 1(1b) KWG not covered by Article 2 (such as a factoring or leasing firm) or an insurance holding company under Section 293 VAG?
8. What were headcount, turnover and balance sheet total at the last reference date?

Example: classification record of a factoring firm

Fictitious example, not a client. Muster-Factoring GmbH buys receivables from mid-sized companies. It has 23 employees, total assets of EUR 61 million and revenue of EUR 9.6 million, takes no deposits, provides no payment services and currently applies the BAIT.

Three typical gaps

Gaps and remedies are our own assessment. Classification in an individual case remains a legal question. If Article 16 applies, our page on DORA Article 16 shows what it requires. Once the framework is clear, our DORA gap analysis shows where your firm stands.