Small investment firms under DORA: classification and obligations

The obligations that apply to all groups under the simplified framework, with an evidence matrix and a roadmap, are set out on the page on DORA Article 16. This page covers what affects investment firms differently: classification under the Investment Firms Regulation (IFR), monitoring the thresholds, and the differences from factoring, leasing and the other institutions that come under DORA only through the German Banking Act (KWG).

When is an investment firm “small and non-interconnected”?

When it meets all nine conditions of Article 12(1) IFR. DORA adopts this definition word for word: Article 3(34) DORA refers to Article 12(1) of Regulation (EU) 2019/2033, and Section 2(16) of the German Investment Firm Act (WpIG) defines the “small investment firm” with the same reference. In its supervisory notice of 21 August 2025, BaFin assigns these firms to Article 16 under DORA itself, not through the FinmadiG (the German Financial Market Digitalisation Act, which adapted German law to DORA). Medium-sized and large investment firms (Section 2(17) and (18) WpIG) do not meet the conditions and apply the full framework under Articles 5 to 15.

Four rules from Article 12 IFR matter most for the DORA classification. If the firm is part of a group, conditions (a), (b), (h) and (i) apply on a combined basis for all investment firms in the group, while (c) to (g) apply to each firm individually (paragraph 2). For (h) and (i), the values at the end of the last financial year count for which accounts were drawn up and approved by the management body. If these are still missing six months after the end of the financial year, provisional accounts are used. For (b), the wording links the values for cash trades and derivatives with “or”, in the German version as well (“oder”). We read this to mean that a firm active in both types of business must stay below both values. Recital 17 IFR supports this reading, as it gives the values separately for each type of business. In a borderline case this needs legal clarification. Losing and regaining the status follow their own time limits, see the questions below. A firm exempted under Articles 2 and 3 MiFID II is not an investment firm within the meaning of DORA (Article 2(3)(d) DORA). That concerns the authorisation, not the size.

What does Article 16 mean for a small investment firm?

The same as for any other Article 16 group: instead of Articles 5 to 15, the simplified framework under Article 16 with Title III (Articles 28 to 41) of RTS (EU) 2024/1774. Here too the RTS requires a policy, a list of functions with a business impact analysis, recovery objectives, logging and a business continuity plan. What applies in detail, what is no longer an express requirement and who takes on which role is set out in the evidence matrix on the page on DORA Article 16. For investment firms, five points follow from their legal basis:

• In full since 17 January 2025. Article 16 applies to them directly under DORA. There is no transition period like the one in Section 65a(3) KWG for the KWG group.
• Third parties without a microenterprise exemption. Articles 28 to 30 apply even if the firm is a microenterprise under Article 3(60) DORA. The exemption in Section 1a(2a) sentence 2 no. 3 KWG applies only to the KWG group, and BaFin stresses that there is no comparable exemption from Articles 28 to 30 otherwise. So the register of information applies as well.
• No aggregation of recurring incidents. The rule in Article 8(2) of Delegated Regulation 2024/1772, under which recurring minor incidents are assessed together each month, expressly does not apply to the entities referred to in Article 16(1) DORA. Small investment firms are among them. For the KWG group the question is open (reporting ICT-related incidents).
• No TLPT. Article 26(1) DORA exempts the entities referred to in the first subparagraph of Article 16(1) from threat-led penetration testing. Whether the testing programme under Articles 24 and 25 applies is answered as our reading on the page on DORA Article 16, together with the counter-argument.
• No MaRisk as a bridge. MaRisk (BaFin’s Minimum Requirements for Risk Management) names in AT 2.1 para. 2 only large investment firms under Section 2(18) WpIG. For small investment firms, Section 41 WpIG requires sound governance arrangements with effective procedures for managing risks. Unlike factoring and leasing firms, small investment firms therefore have no MaRisk counterpart, such as the emergency concept under AT 7.3, to which the DORA documents would have to be linked (our derivation from the scope).

What is different from the KWG group?

The legal basis, and with it the timeline and two exemptions. Factoring and leasing firms, guarantee banks and the other institutions under Section 1a(2a) KWG apply DORA “as if” they were CRR credit institutions, and only from 1 January 2027. Investment firms are financial entities under Article 2(1)(e) DORA.

An investment firm reading texts on the KWG group should therefore not adopt three statements: the 2027 deadline, the microenterprise exemption from Articles 28 to 30 and the open point on recurring incidents.

Example: classification record of an investment firm

Fictitious example, not a client. Muster-Portfolio GmbH provides portfolio management and investment brokerage, holds no client money and does not safeguard securities. It has 19 employees and, together with a second investment firm, Muster-Fondsberatung GmbH, belongs to a holding company. The management records the DORA classification for the auditor and for its own files:

The record makes the borderline case visible: at EUR 1.11 billion the group is just below the AUM threshold. If the assets managed by the sister firm grow, Muster-Portfolio GmbH can lose its status even though nothing changes at the firm itself. The switch to the full framework should be prepared for this case, for example with a list of the full-framework documents that would then be missing (ICT risk management under the full framework). The values and the frequency in the record are invented, the warning threshold is our recommendation.

Three typical gaps at small investment firms

Gaps and remedies are our professional assessment based on the wording of DORA, IFR and RTS. The example firm is entirely fictitious. This assessment is general information and does not replace legal advice in an individual case.

How we support you

Small investment firms do not come from BAIT (BaFin’s supervisory requirements for IT in banks), so the Article 16 gap analysis is the right starting point for them: it checks the classification record, documents and evidence against the evidence matrix and delivers an action plan. Scope and price are on the page on DORA gap analysis. How DORA and NIS2 interact if a firm also falls under the BSI Act through another activity is described on the page on DORA and NIS2.