IORPs and pension funds under DORA: what applies by size

The obligations that apply to all groups under the simplified framework, with an evidence matrix and a roadmap, are set out on the page on DORA Article 16. This page covers what only affects IORPs: how size is counted, what follows for each size band, and how BaFin’s Minimum Requirements for the System of Governance of IORPs (MaGo for IORPs) stand alongside DORA.

Which institutions are meant?

IORPs are financial entities under Article 2(1)(p) DORA. For the term, Article 3(52) DORA refers to Article 6(1) of the IORP Directive (EU) 2016/2341. In Germany these are Pensionskassen (Section 232 of the Insurance Supervision Act, VAG) and Pensionsfonds (Section 236 VAG). BaFin covers both in Circular 08/2020 (VA), the MaGo for IORPs, whose scope includes all Pensionskassen and Pensionsfonds under its supervision (margin no. 3).

How are members counted?

Across all pension schemes of the institution together: Article 2(3)(c) and Article 3(53) DORA both refer to schemes which together have a given number of members “in total”. DORA does not define the member itself. The IORP Directive defines a member in Article 6(5) as a person whose past or current occupational activities entitle or will entitle them to retirement benefits, expressly excluding beneficiaries (point 6) and prospective members (point 7). DORA uses the same term as the directive, “members” in English and “Versorgungsanwärter” in German. On our reading, active and deferred members therefore count, pensioners do not. Because DORA does not say so itself, an IORP close to a threshold should have this reading confirmed by a lawyer. The threshold of 100 matches the one in Article 5 of the IORP Directive, under which Member States may exempt small IORPs in whole or in part.

What applies up to 15, at 16-99 and from 100 members?

The bands follow from Article 2(3)(c), Article 3(53) and Article 16(1) DORA. In table 1 of its supervisory notice of 21 August 2025, BaFin assigns small IORPs to Article 16 under DORA itself.

The language versions differ at exactly 15 members: the English article text and recital 39 in both languages exclude IORPs with no more than 15 members, the German article text only those with fewer than 15. The reasoning is on the page on DORA applicability. An IORP with exactly 15 members should have the question clarified by a lawyer.

What does Article 16 mean for a small IORP?

The same as for the other Article 16 groups. Here too the RTS requires a policy, a list of functions with a business impact analysis, recovery objectives, logging and a business continuity plan, set out in detail on the page on DORA Article 16. For IORPs, two points follow from their legal basis:

• No transition period. Small IORPs fall under Article 16 directly under DORA, since 17 January 2025. The dates for the KWG group (1 January 2027) do not apply to them.
• Third parties without a microenterprise exemption. Articles 28 to 30 and the register of information also apply to an IORP that is a microenterprise under Article 3(60). The exemption in Section 1a(2a) sentence 2 no. 3 of the German Banking Act (KWG) concerns only the institutions under that provision (the KWG group). You can check whether an IORP is a microenterprise with headcount and balance sheet total as described on the page on DORA applicability.

Like all entities referred to in Article 16(1) DORA, small IORPs do not aggregate recurring minor incidents under Article 8(2) of Delegated Regulation 2024/1772. Classification and deadlines are covered on the page on reporting ICT-related incidents.

How do DORA and MaGo for IORPs relate?

They apply side by side. Pensionskassen and Pensionsfonds are subject to MaGo for IORPs, Circular 08/2020 (VA), in force since 1 June 2021. The MaGo for insurance undertakings under Solvency II, Circular 09/2025 (VA), expressly does not apply to Pensionskassen (margin no. 2). How that circular relates to DORA is described on the page on DORA for insurers. For IORPs, two chapters of MaGo for IORPs are particularly close to DORA:

None of these obligations replaces the other. If your emergency planning under MaGo for IORPs is already in good shape, keep it and add the ICT parts that the RTS requires.

Example: classification record of an IORP

Fictitious example, not a client. Pensionskasse der Muster-Werke VVaG is the company pension fund of a mechanical engineering company. It has three employees of its own. Administration and IT are provided by the sponsoring undertaking. The management board records the DORA classification as at the reference date:

The record shows why the counting method matters: including beneficiaries, the fund would count 226 persons and fall under the full framework. That is why the record states who was counted, on which reading, and who confirmed it. All figures and dates are invented, the warning threshold is our recommendation.

Three typical gaps at small IORPs

Gaps and remedies are our professional assessment based on the wording of DORA, RTS, MaGo for IORPs and the supervisory notice. The example is entirely fictitious. This assessment is general information and does not replace legal advice in an individual case.

How we support you

Small IORPs do not come from BAIT (BaFin’s supervisory requirements for IT in banks), so the Article 16 gap analysis is the right starting point for them: it checks the classification record, documents and evidence against the evidence matrix and delivers an action plan that takes existing MaGo documentation into account. Scope and price are on the page on DORA gap analysis.