Financial regulation · DORA
DORA for small financial entities
DORA has applied since January 2025, including to firms with no CISO and no dedicated compliance team. I measure your gap, set up an ICT risk management framework at your scale, help you produce the register of information and build your testing plan.
Who it is for
- Asset management companies
- Crypto-asset service providers
- Fintechs: payment and e-money institutions
- Advisers and other firms that first need to check whether DORA applies to them
Typical situation
A question from the regulator, a review by your depositary or shareholders, or the realisation that DORA applies and nothing is formalised.
The texts are long and written mainly for large institutions; what applies to a small firm has to be extracted from them.
What I do
A proportionate approach that builds on what you already do.
Scope and gap assessment
Confirming that DORA applies and which regime (including the simplified framework under Article 16 where you are eligible), then the gap on governance, ICT risk management, incidents and testing.
ICT risk management framework
Policies, roles, management body responsibilities, business continuity and incident management, scaled to your size.
Register of information
Building the register of information DORA requires, in the format set by the technical standards, ready to submit to your competent authority.
Testing plan
A digital operational resilience testing programme suited to your profile: which tests, how often, with what evidence.
Deliverables
- A DORA gap assessment
- A documented ICT risk management framework (policies, roles, procedures)
- The register of information in the regulatory format
- A resilience testing plan
- A prioritised action plan and a briefing for the management body
Format and duration
- Format
- Fixed-fee engagement, fully remote
- Indicative duration
- Depends on your starting point; set at scoping
- Fees
- Fixed fee, quoted on requestEstimate the budget for this service
Frequently asked questions
Does DORA apply to my firm?
DORA covers a defined list of financial entities, including asset managers, payment and e-money institutions, authorised crypto-asset service providers and investment firms. Some statuses need checking case by case; that is the first thing I look at.
What is the simplified framework?
DORA provides a lighter ICT risk management framework for certain small entities (Article 16). Eligibility depends on your status and size; I check it at the outset.
What exactly does the register of information cover?
The register lists the contractual arrangements for ICT services, in the format required by the technical standards. My work is limited to producing this regulatory register.
First call
In 30 minutes we can check how DORA applies to your firm and review what is already in place.