Transition to DORA · full framework
Moving from ZAIT to DORA: full framework for payment and e-money institutions
Payment and e-money institutions have applied the full DORA framework of Articles 5-15 since 17 January 2025. BaFin repealed the ZAIT, its IT requirements for these institutions, at the end of 16 January 2025. Many documents are still structured along the ZAIT. With the package "Moving from ZAIT" we convert this legacy set to DORA and the RTS 2024/1774, settle roles, exercise recovery and reporting and hand over the evidence. The basic scope described below costs from €29,400 net plus VAT. Larger scope is priced after the scoping call.
What applies to payment and e-money institutions?
This page covers the full framework of Articles 5-15 DORA, which has applied since 17 January 2025. DORA expressly covers payment institutions and e-money institutions, including those exempted under the Payment Services Directive (PSD2) and the E-Money Directive. According to BaFin there will be no further transitional period.
Payment and e-money institutions in Germany cannot use the simplified framework of Article 16 DORA. Article 16 does refer to exempted payment and e-money institutions, but Germany has not used these exemptions, and BaFin states expressly that former ZAIT addressees are not covered by Article 16. The principle of proportionality applies to ICT risk management under Chapter II, and DORA grants microenterprises a few specific reliefs.
We have found no separate BaFin replacement circular for ZAIT (as of 6 November 2026), the yardstick is DORA itself. Alongside DORA, section 3.8 of the EBA Guidelines on ICT and security risk management (EBA/GL/2019/04 as amended by EBA/GL/2025/02) continues to apply to payment service providers. It covers the relationship with payment service users. BaFin has applied this version since 20 May 2025.
The package therefore starts from what you already have: documents, roles and evidence that still follow the ZAIT structure are mapped to DORA and the RTS and reworked. Arrangements and safeguards that work stay in place. They get the right legal reference and, where needed, the missing parts.
What does the "Moving from ZAIT" package include?
Seven building blocks that build on each other. References without a source refer to DORA, "RTS" means Delegated Regulation (EU) 2024/1774, Title II.
What do we already have?
Review of your ZAIT documents
We map every existing document to the duties of the full framework and the chapters of RTS Title II and decide with you: keep, rework or merge. References to the repealed ZAIT are replaced by the DORA reference.
ZAIT and DORAWhich documents does the full framework require?
Framework, policies and procedures
The ICT risk management framework under Article 6 with the digital operational resilience strategy (DOR strategy, Article 6(8)), plus the RTS policies and procedures on security, access, detection and response, and business continuity. Where an IT or security strategy exists, we align it.
ICT risk managementWho does what?
Roles and ICT risk control function
The management body defines, approves and is responsible for the framework (Article 5(2)). Entities that are not microenterprises assign ICT risk management to a control function with an appropriate level of independence (Article 6(4)) and monitor their contracts with ICT providers (Article 5(3)). We clarify how your current roles cover these tasks and prepare the board resolution.
What is critical?
Function list, BIA and recovery objectives
Critical or important functions with reasons, supporting systems and providers, a business impact analysis as part of the business continuity policy (Article 11(5)) and recovery time and recovery point per function (Article 12(6)). The classification is not the same as the materiality of an outsourcing arrangement.
Classify functionsDoes it work when it matters?
Recovery and reporting exercise
A recovery exercise for one critical or important function and a tabletop reporting exercise up to the initial notification: within 4 hours of classifying the incident as major, at the latest 24 hours after becoming aware of it. We do not plan the exercise around the relief for weekends and public holidays. Deficiencies go to the management body in a report.
DORA incident reportingAre the contracts in order?
Contract check against Article 30
DORA defines ICT services much more broadly than outsourcing. We check your contracts, from a subject-matter perspective, against the mandatory content of Article 30(2) and, for critical or important functions, the additional content of Article 30(3). Sector outsourcing rules continue to apply alongside.
Managing ICT providersWhere is the evidence, what recurs each year?
Evidence matrix and annual calendar
Each duty with evidence, owner and storage location. Plus a calendar of recurring duties, for example annual tests of the business continuity and recovery plans (Article 11(6)), annual tests of the systems supporting critical or important functions (Article 24(6)) and the annual risk assessment of legacy systems (Article 8(7)).
What you have at the end
We hand over the results as drafts for your institution to adopt and as an organised evidence file.
01
Mapping of your ZAIT documents
All documents with a decision (keep, rework, merge) and the reference in DORA and the RTS.
02
Framework, DOR strategy, policies and procedures
As drafts, reworked from your existing texts wherever possible.
03
Role model with draft resolution
Management body, ICT risk control function, contract monitoring and internal audit with clear responsibilities.
04
Function list, BIA and recovery objectives
Critical or important functions with reasons, business impact analysis, recovery time and recovery point per function.
05
Exercise records
Record of the recovery exercise and evaluation of the reporting exercise, each with deficiencies, actions and a report to the management body.
06
Evidence matrix and annual calendar
Each duty with evidence and storage location, calendar of recurring duties with owners.
Example: document review at a payment institution
This is how the decision per document can look after the review. A fictitious example, no commitment and no statement about your documents.
| Existing document | Reference in the full framework | Finding | Decision |
|---|---|---|---|
| IT strategy | Article 6(8) DORA (DOR strategy) | describes IT goals, not how the ICT risk management framework is implemented | rework, add a section on implementing the framework |
| Information security role description | Article 6(4) DORA | independence of the control function not described | rework, prepare management body resolution |
| IT contingency manual | Articles 11 and 12 DORA, RTS Title II | no business impact analysis, no recovery objectives per function | keep, add BIA and objectives |
| List of outsourcing arrangements | Articles 28-30 DORA | material outsourcing only, other ICT providers missing | merge with the function list |
Fictitious example by Blackfort Technology, no commitment to results.
What does moving from ZAIT cost, and where are the limits?
From €29,400 net for the basic scope below: 21 person-days at €1,400. More legal entities, documents, workshops or providers are priced after the scoping call.
| Building block | Included | Person-days |
|---|---|---|
| Review and mapping | one legal entity, up to 60 ZAIT documents | 3 |
| Rework of framework, policies and procedures | up to 12 drafts, including a draft DOR strategy or alignment of an existing one | 6 |
| Roles and governance | role model with ICT risk control function under Article 6(4) DORA, draft resolutions | 1.5 |
| Function list, BIA and recovery objectives | up to 10 ICT providers in the function list, check against Article 30 | 3 |
| Alignment with requirements that continue to apply | section 3.8 of the EBA Guidelines on ICT and security risk management (payment service user relationship), which continues to apply alongside DORA, and your other supervisory requirements | 1.5 |
| Recovery and reporting exercise | one each. Recovery for one critical or important function, planned, supported and recorded by us and run by your IT or your provider. Reporting exercise as a tabletop of up to 3 hours | 2 |
| Evidence matrix, annual calendar and handover | evidence matrix with storage locations, calendar of recurring duties | 1.5 |
| Project management and workshops | up to 8 workshops of up to 3 hours each, video or on site, of which 2 with the management body | 2.5 |
| Total | day rate €1,400 net | 21 |
| Price | from €29,400 net plus VAT for this basic scope |
Offer for businesses only (B2B). More legal entities, documents, workshops or providers are priced after the scoping call and stated in the offer. A full framework gap analysis commissioned beforehand is credited, details in the offer.
How does the transition work?
Four phases. The duration depends mainly on how quickly documents, meetings and resolutions come together.
1
Review and classification
Map the ZAIT documents, record headcount, turnover and balance sheet total, draft the function list and business impact analysis.
2
Framework, roles and strategy
Role model with control function, framework and DOR strategy, management body resolution, check the reporting process.
3
Policies, procedures and contracts
Rework policies and procedures, set recovery objectives, check contracts against Article 30.
4
Exercises and handover
Recovery and reporting exercise, evidence matrix, annual calendar.
The duties have applied since 17 January 2025, regardless of how far the project has progressed. What is needed in an incident therefore comes first: clear roles and a working reporting process.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Moving from ZAIT, topic page or gap analysis?
The topic page ZAIT and DORA explains what applies after the repeal of the ZAIT and how the old requirements map to DORA. The page on ICT risk management explains the duties of the full framework in detail. This package is the implementation with handover of results.
The full framework gap analysis shows where you stand and what to do in which order, and leaves open who implements it. You can start with it and commission the package afterwards, in which case it is credited, details in the offer. You can also start directly with the package, the document review is included.
If your institution is a microenterprise
A microenterprise employs fewer than ten persons and has an annual turnover and/or annual balance sheet total of no more than EUR 2 million. The German version reads "bzw.", so whether one of the two figures is enough is linguistically open. We therefore record your figures at the start and do not assume the status.
If your institution is a microenterprise, some duties of the full framework do not apply, for example the independent control function under Article 6(4) and the crisis management function under Article 11(7). We then adjust the scope in the offer.
Who is responsible for the package
The responsible consultant is Christian Gebhardt, founder and managing director of Blackfort Technology. We have been owner-managed since 2017.
What does your institution contribute?
One contact person
For example information security or the head of IT, with about half a day to one day per week for meetings, documents and reviewing drafts.
The management body
Two meetings and the resolutions on roles, framework, DOR strategy and business impact analysis. Responsibility for the framework stays with the management body.
IT and providers
Information on systems and contracts, running the recovery exercise and taking part in the reporting exercise.
What is not part of the package?
So that expectations match:
- No technical implementation. Your IT or your provider sets up strong authentication, logging or vulnerability scanning. We describe the requirement and review the evidence.
- No contract negotiation and no legal contract review. The check against Article 30 DORA is a subject-matter check. Drafting and reviewing clauses is for your legal counsel. Building and submitting the register of information is not part of the package.
- No assumption of roles. We take on the ICT risk control function, an external CISO role or internal audit only under a separate mandate.
- No commitment as to how supervisors or auditors will assess the result. No certificate, no legal advice.
The information on this page is general information on DORA and RTS 2024/1774 as of 6 November 2026. Whether and how it applies to your institution must be assessed case by case.
Frequently asked questions
Does the simplified framework of Article 16 apply to us?+
No. Payment and e-money institutions in Germany apply the full framework of Articles 5-15, because Germany has not used the exemptions of the Payment Services Directive and the E-Money Directive. BaFin states that former ZAIT addressees are not covered by Article 16.
Since when does DORA apply to us?+
Since 17 January 2025. BaFin repealed the ZAIT at the end of 16 January 2025. According to BaFin there will be no further transitional period.
Do we have to rewrite everything?+
No. What works stays. The review decides for each document whether it is kept, reworked or merged. New items are mainly parts that DORA requires expressly and that many existing document sets lack, such as the digital operational resilience strategy under Article 6(8) and the ICT risk control function under Article 6(4).
Is the gap analysis credited?+
Yes. A full framework gap analysis commissioned beforehand is credited against the package. Details are in the offer.
What happens after the handover?+
You run the framework yourself, with the annual calendar as a guide. On request we support the first review of the framework or the next exercise, agreed separately.
Read more
- ZAIT and DORA: mapping and checklist for payment institutions
- ICT risk management under DORA: framework and DOR strategy
- DORA gap analysis: quick check, Article 16 and full framework
- Classifying critical or important functions under DORA
- DORA incident reporting: classifying and reporting ICT-related incidents
- ICT third-party risk under DORA: managing providers and Article 30 contracts
- DORA register of information: structure, mandatory fields, submission
- DORA scope: who does DORA apply to, and which framework?
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 2, 5, 6, 8, 11, 12, 16, 24, 30, 64 (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2024/1774 (ICT risk management), Title II (retrieved 2026-11-06)
- Commission Delegated Regulation (EU) 2025/301 (content and time limits of incident reports), Article 5 (retrieved 2026-11-06)
- BaFin news of 9 January 2025 on changes to IT requirements under DORA, in German (retrieved 2026-11-06)
- BaFin supervisory notice of 21 August 2025 on the simplified framework under Article 16 DORA, foreword and footnote 6 (PDF, German) (retrieved 2026-11-06)
- BaFin FAQ on DORA: will there be transitional periods? (German) (retrieved 2026-11-06)
- EBA Guidelines on ICT and security risk management EBA/GL/2019/04, consolidated version after EBA/GL/2025/02 (PDF) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Discuss the transition
Tell us briefly whether you are a payment or e-money institution, how many employees you have, which documents exist and who runs your IT. In the initial call, by phone or video, we clarify whether the package fits. In the following scoping call we agree scope, price and start date.