DORA for Investment Firms

Proportionality is central

DORA explicitly scales obligations. Small and non-interconnected investment firms, and firms that qualify as microenterprises, may apply a simplified ICT risk-management framework and are generally out of scope for mandatory TLPT.

What still applies to everyone

• Governance and accountability for ICT risk at management-body level.
• Major-incident classification and reporting.
• A register of information on ICT third-party arrangements.

Trading-critical systems

Firms running order-management, execution or market-data systems should treat availability and integrity as first-order resilience risks and test accordingly.

Which firms actually qualify as "small and non-interconnected"

Article 16's relief is not self-declared: it applies only to firms that meet the "small and non-interconnected investment firm" definition in Article 12(1) of the Investment Firms Regulation ((EU) 2019/2033), the IFR/IFD "Class 3" category. That test looks at fixed thresholds across several metrics at once, including assets under management, client orders handled, assets safeguarded and administered, client money held, daily trading flow, net position risk, and balance-sheet size, all measured on a rolling basis, generally averaged over the preceding six months. A firm that trips even one threshold, or that otherwise falls outside the IFR's Class 3 criteria (for example because it deals on own account or underwrites on a firm-commitment basis), is a Class 2 firm and must apply DORA's full regime under Articles 5 to 15, not the simplified Article 16 framework. Firms near the boundary should re-check their classification whenever trading volumes, assets under management, or client money balances shift materially, since crossing a threshold changes which version of the ICT risk-management framework applies, not just how it is documented.

What "simplified" still means in practice

Article 16 relief narrows the ICT risk-management chapter itself (Articles 5-15); it does not touch the rest of DORA. A Class 3 firm using the simplified framework still has to run a major-incident classification and reporting process on the same timelines as a full-scope firm, keep its register of information current, and give its management body documented oversight of ICT risk, just with a lighter set of required policies and controls underneath. Groups that run an investment firm alongside other regulated entities should also note that Article 16 names several other categories beyond small and non-interconnected investment firms: certain exempted payment and e-money institutions, small institutions exempted under Directive 2013/36/EU, and small occupational pension institutions, each tested against its own, different qualifying criteria rather than a single group-wide size test. A group where the investment-firm entity qualifies for Article 16 can still have a bank or payment-institution entity squarely in the full-scope regime. For the complete entity list and a walkthrough of what stays in force, see our deep dive on Article 16.