Factoring and leasing under DORA: seven questions before 2027

The obligations that apply to all groups under the simplified framework, with an evidence matrix for each article, are set out on our page on DORA Article 16. This page covers what factoring and finance leasing firms, as part of the institutions under Section 1a(2a) of the German Banking Act (KWG) (here: KWG group), actually have to decide. All examples refer to the fictitious “Muster-Factoring GmbH”, whose classification record is on the page on DORA applicability. For a leasing firm the same pattern applies, with functions such as contract conclusion, contract administration and collection of lease payments.

1. Why does DORA affect factoring and leasing firms, and which framework applies?

Because the German Financial Market Digitalisation Act (FinmadiG) extended the scope nationally: under Section 1a(2a) KWG, DORA and the Level 2 acts apply to all institutions not already covered by Article 2 DORA as if they were CRR credit institutions. BaFin expressly names factoring and finance leasing firms. The legal position of the group in detail is set out on the page on DORA Article 16.

We classify the testing programme under Articles 24 and 25 as our reading and recommend planning for it as a precaution. The reasoning and the counter-argument are on the page on DORA Article 16. In addition, MaRisk (BaFin’s Minimum Requirements for Risk Management) applies, to financial services institutions only as far as warranted by their size and business, in particular AT 3, AT 5, AT 7 (with emergency management under AT 7.3) and AT 9. A firm that also takes deposits and grants loans is a CRR credit institution and has been under the full framework since 2025.

2. Are we a microenterprise, and do Articles 28 to 30 apply then?

For most factoring and leasing firms, no, and Articles 28 to 30 then apply in principle in full. Under Section 1a(2a) sentence 2 no. 3 KWG they do not apply only to microenterprises of the group. A microenterprise employs fewer than ten persons and has an annual turnover and/or annual balance sheet total not exceeding EUR 2 million. In our assessment, a firm with a sizeable receivables or leasing portfolio is as a rule well above that in total assets. Never assume the status: how to check it with figures, and what remains open in the borderline case of “and/or” (German text: “bzw.”), is shown on the page on DORA applicability.

If you are a microenterprise, DORA no longer requires the register, the assessment before entering into a contract, exit strategies, concentration risk and mandatory contract terms. You still have to identify dependencies on providers and cushion them in business continuity (Article 16(1)(e), RTS Article 30(2), Article 39(2)), and for ICT third-party sourcing AT 9 MaRisk remains applicable, as we derive from the wording.

If you are not a microenterprise, Articles 28 to 30 apply without the strategy under Article 28(2) and without the policy under RTS 2024/1773. Do not plan on being exempt from aggregating recurring incidents under Article 8(2) of RTS 2024/1772. Whether the KWG group, which is covered only under national law, falls under the exemption there is not settled in any source we have read.

Sample case: from function to evidence

Fictitious example, not a client. Muster-Factoring GmbH buys receivables from mid-sized clients, pays advances on them and handles debtor management. It has 23 employees and total assets of EUR 61 million, so it is not a microenterprise. It uses its core system as software as a service from a software vendor that runs it in a subcontractor’s data centre. Payments are processed through banking software. A managed service provider (MSP) looks after workstations, user administration and file servers. In October 2026 the management classified five functions as critical or important. The full list of functions with reasons is on the page on classifying critical or important functions. For two of these functions, and for the building blocks that support all functions, the table shows the full chain that the simplified framework requires.

The classification “critical or important” follows Article 3(22) DORA and is not the same as the materiality of an outsourcing arrangement. The method is on the page on classifying critical or important functions. The recovery objectives are sample values: the RTS requires defined recovery levels and timeframes and a BIA approved by the management body, but sets no figures.

3. What happens to our BAIT documents?

Hardly any document disappears without replacement: most of the content moves into the structure of the RTS. The main documents replaced are the protection needs assessment and the backup concept, whose content goes into the classification and the business continuity plan. The authorisation concept is rebuilt as the access control procedure, the IT emergency concept as the business continuity plan, and MaRisk AT 7.3 still requires an emergency concept. Document by document this is shown in the list for rebuilding BAIT documents, BAIT paragraph by paragraph in the mapping on the same page. The BAIT continue to apply until 31 December 2026, so do not repeal any BAIT rule early.

4. Who takes on security, control and internal audit tasks?

The management holds overall responsibility and allocates the other tasks itself, but control and internal audit must be segregated and independent. The simplified framework does not prescribe an information security officer or an ICT risk control function. The tasks remain. The rules in detail are on the page on DORA Article 16. In the sample case the allocation looks like this:

5. What must software vendors, MSPs and data centres deliver?

Contracts with the mandatory terms under Article 30 DORA and, in day-to-day operation, the evidence you cannot produce yourself. DORA affects the providers only indirectly through these contracts. They have no reporting obligation under DORA (their own obligations, for example under NIS2 or German telecoms law, may apply), and only the ICT third-party service providers designated as critical by the European Supervisory Authorities are directly overseen. If an incident at the provider causes a major incident at your firm, you report it.

The European Supervisory Authorities have not published standard contractual clauses so far, and there is no extended transition period for existing contracts either. Plan the renegotiations early. Microenterprises of the group need the deliveries listed under “In operation” even without Article 30, because the measures under RTS Article 29(2) include those implemented by the provider.

6. What has to be in place and evidenced by 1 January 2027?

Everything the simplified framework and Articles 28 to 30 require applies from that day without any further transition period, and incident reporting already applies. The list shows which evidence should be available on the reference date:

Whether the weekend relief for initial and intermediate reports applies to factoring and leasing firms is open, so we plan without it. Deadlines and reasoning are on the page on deadlines and procedure of the DORA reporting obligation. When the group first submits a register of information is not settled in any source we have read. Keep it ready for submission from January 2027.

Short record of a recovery exercise (example)

Fictitious example for Muster-Factoring GmbH. The firm tested its new plan in October 2026, still under BAIT, so that deficiencies are fixed before the switch.

Result of a reporting exercise (example)

Fictitious example for Muster-Factoring GmbH. Tabletop exercise on Friday, 30 October 2026: the core system fails at the vendor, awareness at 15:10, classified as major at 17:40, so the initial notification is due by 21:40 (the thresholds are on the classification sheet for the reporting obligation). The main finding concerned the core system vendor: it reported the outage as a disruption without details of cause, expected duration and affected clients, and supplied them only after a second request at 20:15. Only then could the details of the affected factoring clients be added to the form. The form was ready at 21:05, so the deadline would just have been met. The actions:

• contract annex with report content and delivery times for the vendor, for example cause, expected duration and affected clients within one hour (Head of Operations, by 31 December 2026),
• contact person at the vendor with a deputy in the emergency manual, a second person for the MVP (management, by 30 November 2026),
• add the number of clients per service to the classification sheet (information security officer, by 15 November 2026).

7. How much effort is it, and how much of our own time do we need?

That depends less on the size of the firm than on the state of the BAIT documents and the number of ICT providers. If many contracts need renegotiating, what you need most is time that is not in your own hands. Our assessment:

Most of the management’s time goes into the decisions under RTS Article 28(2), so these dates should be in the calendar now. A reliable picture of your effort comes from the DORA gap analysis with action plan. Our transition from BAIT to Article 16 carries out the rebuild with a fixed base scope, and the Article 16 gap analysis is credited against it, with details in the proposal. Scope and prices are on these two pages.

Three typical gaps at factoring and leasing firms

Gaps and remedies are our professional assessment based on the wording of DORA, the RTS and the supervisory notice. The sample case on this page is entirely fictitious. This assessment is general information and is not legal advice for an individual case. Whether you are a microenterprise you can check with the figures on the page on DORA applicability.