DORA for Asset Managers: Are AIFMs and UCITS Firms In Scope?

Yes: UCITS management companies and full-scope managers of alternative investment funds (AIFMs) are named financial entities under DORA Article 2, and neither gets the simplified framework. Only AIFMs below the AIFMD's own sub-threshold registration limits, and that have not voluntarily opted into full authorisation, sit outside DORA entirely.

Which asset managers are in scope

DORA's scope article lists roughly 20 categories of financial entity, and two of them cover fund management directly. Article 2(1)(k) brings in managers of alternative investment funds, defined by reference to Article 3(44) of the AIFMD (Directive 2011/61/EU). Article 2(1)(l) brings in management companies as defined under the UCITS Directive (Directive 2009/65/EC), including self-managed UCITS investment companies that act as their own manager rather than appointing a separate one.

DORA regulates the manager, not the fund as a separate legal vehicle. A UCITS or an alternative investment fund has no ICT risk management obligations of its own; the obligations sit with whichever entity manages it. That matters for group structures where a management company runs several fund ranges through one ICT platform: the DORA obligations attach to the manager and its ICT estate, not to each fund individually.

The sub-threshold AIFM carve-out

Article 2(3)(a) excludes AIFMs referred to in Article 3(2) of the AIFMD, the registration-only regime for managers below the AIFMD's own size thresholds (broadly, EUR 100 million in assets under management, or EUR 500 million for unleveraged funds with no redemption rights for five years). A manager that only registers under this sub-threshold regime, rather than seeking full AIFMD authorisation, is not a DORA financial entity at all.

That exclusion does not survive an opt-in. ESMA's Q&A confirms that a sub-threshold manager that voluntarily opts into full authorisation under Article 3(4) of the AIFMD becomes subject to the complete set of AIFMD manager obligations, and because Article 18 of the AIFMD (as amended by Directive (EU) 2022/2556) now points to DORA, the opted-in manager is brought into DORA's scope too, even though its assets under management never crossed the threshold. A firm cannot keep the lighter AIFMD authorisation route for marketing purposes while assuming it has also kept the DORA exclusion; the two choices move together.

No simplified framework for fund managers

Article 16 lets four named categories, small and non-interconnected investment firms, certain exempted payment and e-money institutions, specific Directive 2013/36/EU-exempted institutions, and small occupational pension institutions, replace the full Articles 5-15 framework with a lighter one. AIFMs and UCITS management companies are not on that list, in any form and at any size.

That is the detail most asset managers researching DORA get wrong. A boutique AIFM just above the AIFMD authorisation threshold, with a handful of staff and an outsourced IT stack, faces the same Articles 5-15 obligations as a major bank: a documented ICT risk management framework, an asset inventory, a dedicated risk control function where proportionate, and board-level accountability under Article 5. The only relief available is the general proportionality principle in Article 4, which lets a smaller entity scale how it meets each obligation, not which obligations apply.

What the five pillars mean for a fund manager

• ICT risk management (Articles 5-15): a documented framework covering identification, protection, detection, response, and recovery for every ICT system supporting portfolio management, risk management, order execution, and fund administration.
• Incident reporting (Articles 17-23): classifying and reporting major ICT-related incidents to the competent authority, the national regulator that authorised the manager, such as the AMF, BaFin, or CSSF, on DORA's harmonised timelines.
• Resilience testing (Articles 24-27): a proportionate testing programme; threat-led penetration testing applies only to the subset of entities a competent authority designates.
• Third-party risk (Articles 28-30): the pillar that bites hardest for most fund managers, covered below.
• Information sharing (Article 45): voluntary participation in cyber threat intelligence arrangements.

The practical risk area: delegation and ICT third parties

Fund managers delegate more of their operations than most other DORA entities. Portfolio management systems, risk and compliance monitoring, fund accounting and administration, trading and order management platforms, and increasingly cloud-hosted data and analytics all tend to sit with outside vendors rather than in-house infrastructure. Each of those dependencies is an ICT third-party arrangement under Articles 28-30, and each one needs to be captured in the manager's register of information: the provider, the function it supports, whether that function is critical or important, and the contractual terms Article 30 requires.

Concentration risk is a specific concern here. Many mid-sized managers rely on the same handful of fund administration and trading-technology vendors, and a manager that cannot show it assessed that concentration risk under Article 29 before renewing or expanding a contract has a gap a supervisor will ask about directly.

A starting checklist

1. Check your AIFMD status first. Confirm whether your assets under management sit above or below the Article 3(2) thresholds, and whether you have opted into full authorisation despite being below them. This determines DORA applicability before anything else does.
2. Assume the full framework, not the simplified one. If you are an AIFM or UCITS management company in scope, plan for Articles 5-15 in full, scaled by proportionality, not for Article 16.
3. Map every ICT third party feeding the fund range. Build the register of information from the delegation agreements you already have: administrators, custodial-technology links, trading platforms, data and analytics providers, and cloud infrastructure.
4. Assign management body accountability. Article 5 puts approval and oversight duties on the manager's board or equivalent governing body, not on IT alone.
5. Build an incident classification process. Map the thresholds in the incident-reporting regulatory technical standards against your own client and AUM figures so you can tell a reportable incident from a routine outage before one happens.
6. Run the numbers with a tool. Use the DORA Readiness Score to get a pillar-by-pillar gap view once you've confirmed scope.

Sources

• Regulation (EU) 2022/2554 (DORA), Article 2, EUR-Lex.
• Directive 2011/61/EU (AIFMD), Article 3, EUR-Lex.
• European Securities and Markets Authority, Q&A on DORA's application to AIFMs that opt into full AIFMD authorisation.

Last updated: 26 October 2026.