DORA for Investment Firms
Investment firmsauthorised under MiFID are within DORA's scope under Article 2. DORA applies proportionately: small and non-interconnected investment firms may use a simplified ICT risk-management framework, while larger firms face the full regime. DORA has applied since 17 January 2025.
Proportionality is central
DORA explicitly scales obligations. Small and non-interconnected investment firms, and firms that qualify as microenterprises, may apply a simplified ICT risk-management framework and are generally out of scope for mandatory TLPT.
What still applies to everyone
- Governance and accountability for ICT risk at management-body level.
- Major-incident classification and reporting.
- A register of information on ICT third-party arrangements.
Trading-critical systems
Firms running order-management, execution or market-data systems should treat availability and integrity as first-order resilience risks and test accordingly.
Which firms actually qualify as "small and non-interconnected"
Article 16's relief is not self-declared: it applies only to firms that meet the "small and non-interconnected investment firm" definition in Article 12(1) of the Investment Firms Regulation ((EU) 2019/2033), the IFR/IFD "Class 3" category. That test looks at fixed thresholds across several metrics at once, including assets under management, client orders handled, assets safeguarded and administered, client money held, daily trading flow, net position risk, and balance-sheet size, all measured on a rolling basis, generally averaged over the preceding six months. A firm that trips even one threshold, or that otherwise falls outside the IFR's Class 3 criteria (for example because it deals on own account or underwrites on a firm-commitment basis), is a Class 2 firm and must apply DORA's full regime under Articles 5 to 15, not the simplified Article 16 framework. Firms near the boundary should re-check their classification whenever trading volumes, assets under management, or client money balances shift materially, since crossing a threshold changes which version of the ICT risk-management framework applies, not just how it is documented.
Frequently asked questions
Do small investment firms get relief under DORA?
Yes. Small and non-interconnected investment firms may use a simplified ICT risk-management framework and are generally outside mandatory TLPT.
Are investment firms named in DORA?
Yes, investment firms are among the financial entities listed in Article 2.
Does the simplified framework mean no incident reporting?
No. Major-incident reporting still applies; the simplification concerns the depth of the risk-management framework, not the reporting duty.
How is "small and non-interconnected" defined for DORA purposes?
By reference to Article 12(1) of the Investment Firms Regulation (IFR, (EU) 2019/2033), the IFR/IFD Class 3 test, which checks thresholds across metrics like assets under management, client orders, client money, and balance-sheet size.