DORA for Pension Funds: Which IORPs Must Comply

Yes, most are: institutions for occupational retirement provision (IORPs) are named financial entities under DORA Article 2(1)(p), and the only full exclusion is for schemes with 15 members or fewer in total. IORPs with more than 15 but fewer than 100 members can typically use the lighter Article 16 framework; everything above that sits in DORA's full Articles 5-15 regime.

Which pension institutions DORA actually covers

DORA's scope article lists around 20 categories of financial entity, and institutions for occupational retirement provision sit at Article 2(1)(p). The regulation borrows its definition of an IORP from Article 6(1) of the IORP II Directive (Directive (EU) 2016/2341): an institution, regardless of its legal form, that operates on a funded basis and provides retirement benefits in connection with an occupational activity, separate from any statutory social security scheme.

That sweeps in most occupational pension funds and pension schemes established through an employer, trustee board, or industry-wide pension fund across the EU. It does not reach purely statutory, pay-as-you-go state pension systems, which fall outside DORA because they are not funded, financial-sector institutions in the Article 2 sense.

The 15-member exclusion

Article 2(3)(c) carves out "institutions for occupational retirement provision which operate pension schemes which together do not have more than 15 members in total." A micro-scheme run for a single company's small workforce, or a handful of connected schemes that collectively stay at or below that headcount, sits outside DORA entirely: no ICT risk framework, no incident reporting, no register of ICT third-party arrangements.

The threshold counts members across all the schemes an institution operates, not per scheme. An administrator running three small schemes that add up to 20 members in total loses the exclusion even though no single scheme crosses 15 on its own.

The Article 16 "small IORP" simplified framework

Crossing the 15-member line does not mean the full framework applies immediately. The IORP II Directive's own Article 5 lets a Member State choose not to apply most of that directive to institutions operating schemes with fewer than 100 members in total; where a Member State has exercised that option, the resulting "small IORP" is one of the five categories named in DORA Article 16(1), alongside small investment firms and certain exempted payment and e-money institutions (see our guide to the Article 16 simplified framework for how the other four categories work).

A small IORP that qualifies swaps the detailed eight-domain ICT risk management framework in Articles 5-15 for the shorter list in Article 16(2): a documented ICT risk framework, continuous monitoring, proportionate business continuity and disaster recovery arrangements, identification of ICT third-party dependencies, and a mechanism for feeding lessons learned back into the framework. Nothing else is simplified. Incident reporting, resilience testing, and third-party risk obligations apply in full regardless of member count, subject only to the general proportionality principle in Article 4 that scales how, not whether, a smaller institution meets them.

Three member bands follow from this, and they matter for how a pension scheme should plan:

1. 15 members or fewer: excluded from DORA entirely under Article 2(3)(c).
2. More than 15, fewer than 100 members: in scope, but eligible for the Article 16 simplified ICT risk management framework where the Member State has applied the IORP II Article 5 derogation.
3. 100 members or more: the full Articles 5-15 framework applies, with no size-based relief beyond ordinary proportionality.

Because the small-IORP route under Article 16 depends on a Member State having exercised a derogation option in IORP II, not on an automatic EU-wide rule, a scheme in the 16-99 member band should confirm its own regulator's position rather than assume the lighter framework applies by default.

Who actually carries the obligation

DORA attaches its obligations to the institution, which in practice usually means the IORP's trustees or its equivalent governing body, not to an outsourced administrator acting on the scheme's behalf. That mirrors Article 5's management-body accountability rules, which apply to IORPs the same way they apply to banks and insurers: ICT risk oversight is a governing-body duty that cannot be delegated away by outsourcing the underlying IT.

Most occupational pension schemes outsource the bulk of their ICT estate: pension administration platforms, member portals, actuarial and investment-accounting systems, and increasingly cloud-hosted data warehouses all tend to sit with third-party providers rather than in-house infrastructure. Each of those arrangements belongs in the scheme's register of information under Articles 28-30, and the trustees remain accountable for the provider's performance even though they did not build or run the system themselves.

EIOPA cleared its own rulebook to avoid duplication

The European Insurance and Occupational Pensions Authority (EIOPA), which supervises IORPs alongside national regulators, amended its 2019 opinion on operational risk at IORPs in December 2024, removing the cyber-risk section and related annexes so its guidance would not duplicate DORA once DORA started applying on 17 January 2025. EIOPA withdrew two further Solvency II-era guidelines on ICT security and cloud outsourcing for the same reason. For an IORP, that means the relevant rulebook for ICT risk is DORA itself, read alongside the IORP II Directive's governance requirements, not the older EIOPA guidance that previously filled the gap.

EIOPA's broader 2026 supervisory work continues to treat ICT and third-party risk as a priority area across the entities it oversees; see our guide to EIOPA's 2026 supervisory priorities for how that plays out for insurers, which face the same DORA chapters as IORPs.

A checklist for pension scheme trustees and administrators

1. Count members across every scheme the institution operates. The 15-member exclusion and the IORP II 100-member derogation both run on total membership, not per scheme.
2. Confirm whether your Member State applied the IORP II Article 5 option. The Article 16 simplified framework for schemes in the 16-99 member band only exists where that national derogation is in place.
3. Assign governing-body ownership. Trustees, not the outsourced administrator, hold the DORA obligation; document who on the board signs off the ICT risk framework.
4. Build the register of information from existing outsourcing contracts. Pension administrators, member-portal vendors, and actuarial software providers all belong in it.
5. Do not assume the simplified framework covers incident reporting or testing. Both apply in full to every in-scope IORP, large or small.
6. Run a gap check. The DORA Readiness Score gives a pillar-by-pillar view once scope and framework (full or simplified) are confirmed.

Sources

• Regulation (EU) 2022/2554 (DORA), Articles 2 and 16, EUR-Lex.
• Directive (EU) 2016/2341 (IORP II), Articles 5 and 6, EUR-Lex.
• European Insurance and Occupational Pensions Authority, EIOPA revokes previous guidelines to avoid duplications and overlaps with DORA (19 December 2024).

Last updated: 2 November 2026.