From ZAIT to DORA: cleaning up legacy documents at payment institutions

This page applies to the full framework: payment institutions, account information service providers and e-money institutions apply Articles 5 to 15 DORA, proportionately under Article 4 and with relief if they are microenterprises. The simplified framework under Article 16 is not available to them in Germany. Whether your institution is a microenterprise can be checked on the page DORA applicability.

DORA has applied to these institutions since 17 January 2025. This page is therefore about cleaning up existing documents: which documents from the ZAIT era have a new basis, which are still built on the old structure, and where is something missing that DORA requires in addition?

Why does Article 16 not apply to payment institutions?

Because Germany has not used the exemptions in the Payment Services Directive and the E-Money Directive. Article 16(1) names, among others, payment and e-money institutions exempted under these directives. There are no such institutions in Germany, so this group is empty here (BaFin supervisory notice of 21 August 2025, footnote 6). In the foreword, BaFin, the German financial supervisor, expressly names former ZAIT addressees as not covered. Article 16 is therefore not a size discount: even a payment institution with 14 employees, as in the example below, applies the full framework.

The special rule under which Articles 28 to 30 do not apply to microenterprises is found in Section 1a(2a) of the German Banking Act (KWG) and only covers the group of institutions named there, the KWG group (DORA Article 16). It does not exist for payment and e-money institutions: even a small institution keeps a register of information and agrees the contract contents under Article 30.

What does full framework with proportionality mean?

You implement the same obligations as a larger bank, but to an extent that fits your size and risk. Article 4(1) requires Chapter II to be applied in line with size, overall risk profile and the nature, scale and complexity of the services, and RTS 2024/1774 specifies this in Article 1. Proportionality therefore changes how extensively an obligation is met, not whether it applies. DORA expressly requires less only from microenterprises, at these points:

The table gives four examples. Further relief concerns, for example, the review of the framework, legacy systems and the crisis management function. Who counts as a microenterprise is set out on the page DORA applicability. The obligations matrix on the page DORA requirements marks the relief for microenterprises with (M).

What has become of the ZAIT?

It no longer applies. BaFin repealed the ZAIT (Circular 11/2021 (BA) as amended on 16 August 2021) together with the KAIT and VAIT at the end of 16 January 2025. In the sources we read, BaFin names no replacement document. According to its information letter of 19 December 2024, DORA essentially covers the previous IT requirements.

“Repealed” means: no express ZAIT requirement any more. DORA mostly still requires the tasks behind it, often in more detail.

The ZAIT had incorporated the EBA Guidelines on ICT and security risk management (BaFin names the predecessor version GL/2017/17). Their current version, EBA/GL/2019/04, has not been repealed. With EBA/GL/2025/02 the EBA narrowed them to the relationship with payment service users: for payment service providers within the scope of DORA, only section 3.8 remains alongside DORA, the other sections have been deleted. This version applies from 20 May 2025 at the latest, and according to the EBA compliance table BaFin applies it. For the ICT risk management framework itself, DORA is therefore the yardstick.

Where do the ZAIT chapters go?

Chapters 1 to 10 move into the full framework, RTS 2024/1774 and Articles 28 to 30, chapters 11 and 12 do not. BaFin has published a chapter-by-chapter comparison only for BAIT and VAIT. That it can “generally be transferred” to the ZAIT is stated in the foreword of the same supervisory notice of 8 July 2024 (our translation). The table applies it to the twelve ZAIT chapters. The mapping is ours, the numbered paragraphs (Tz.) come from the ZAIT. A mapping paragraph by paragraph is available as an Excel file for the BAIT on the page BAIT and DORA.

Chapter 11 deserves attention: section 3.8 of the EBA guidelines on the relationship with payment service users continues to apply to payment service providers and supplements DORA (see the questions below). If you filed customer awareness as done together with the ZAIT, take it up again.

What do the ZAG and the MaRisk require alongside?

The ZAG continues to apply, in some places expressly with a view to DORA. The table lists the provisions with an IT link, read on 6 November 2026.

The MaRisk (BaFin’s minimum requirements for risk management) do not name payment and e-money institutions under the ZAG (AT 2.1), their organisation is governed by Section 27 ZAG. Institutions that also hold a banking licence find the interfaces on the page MaRisk and DORA. How major incidents are classified and reported is explained on the page Incident reporting.

Example: checklist for a small payment institution

Fictitious example, not a client. Muster-Zahlungsdienste GmbH is a payment institution with 14 employees that processes card payments for online merchants. With 14 employees, it is not a microenterprise, so the relief above does not apply to it. Since January 2025, it has reported incidents under DORA and has submitted its register of information. Many policies, however, still carry the ZAIT chapter numbers in their titles. It obtains its payment platform as a cloud service from a processor and its fraud detection from a specialist provider. In November 2026, it uses a checklist to find out what is still missing from the ZAIT era.

Checklist “What is still missing from the ZAIT era” (template, filled in for a fictitious institution, as of 6 November 2026):

No row removes a safeguard or a role: each document gets a new basis, an addition or a new shape. The information security officer stays in the example and only hands over the management of IT operations.

Three typical gaps

Example, checklist and gaps are our professional assessment based on the wording of DORA, the ZAG, the EBA guidelines and BaFin’s publications. The assessment is general information and must be checked for your institution in the individual case.

How we help

For payment and e-money institutions, we start with the DORA gap analysis. The document quick check suits a first look at the documents, the full framework gap analysis with action plan suits the whole framework. We flag borderline cases, such as whether a contract is material outsourcing under Section 26 ZAG, for your legal counsel. If you want to rework your documentation straight away, see scope and price in our Transition from ZAIT package.