NexGenio
Home Academy Insights Contact

DORA has a simplified regime. You may be in it.

DORA Article 16 creates a simplified ICT risk management framework for smaller financial entities. Firms that qualify carry materially fewer obligations than the ones they are usually quoted for.

Investment firms Payment institutions E-money institutions IORPs Microenterprises
Book a scoping call
What changes

Four obligations fall away entirely

Article 16 is not a discount on the full regime. It is a different, narrower set of obligations written into the regulation itself, and confirmed in supervisory guidance.

Not required

Internal audit of the ICT framework

No requirement for regular internal audit of the ICT risk management framework.

Not required

Cyber-attack scenario testing

No mandatory inclusion of cyber-attack scenarios in business continuity and recovery testing.

Not required

Legacy system risk analysis

No requirement for regular risk analysis on legacy ICT systems.

Not required

Dedicated third-party role

No requirement to staff a dedicated role monitoring ICT third-party arrangements.

Who it covers

Article 16 applies to

Six categories of financial entity fall under the simplified framework. If your firm is one of them, the obligations above do not apply to you.

The difficulty

Nobody will tell you which side of the line you are on

The tests that decide Article 16 eligibility are not published in any register. They sit in figures only your firm holds, and in which permissions you actually exercise rather than merely hold on your licence.

The thresholds are internal

Assets under management, assets held and administered, client money held, daily trading flow, balance sheet total and annual revenue. Several of the tests are not a question of being small — they require the figure to be zero. None of this appears on a public register, so no list can tell you the answer.

Group structure complicates it further

Belonging to a group does not remove Article 16 on its own. It changes how the tests are calculated, because several of them must be assessed on a combined basis across the group. A subsidiary can still qualify. It simply takes a closer look to establish.

The market

What you are currently being offered

Everything available today is priced for the full Article 5 to 15 regime, or leaves you to interpret the regulation yourself.

OptionModelTypical cost
Large advisory firms Project engagement scoped to the full regime, delivered over several months €200,000 upwards
Compliance software Annual licence. The tooling is provided, the interpretation and operation stay with you €500 – €8,000 per year
Boutique DORA retainers Monthly retainer, priced at general advisory level regardless of your firm's size from around €2,500 per month

None of them price for Article 16. The quote you receive is built for the full regime, and the work of arguing your way down to a proportionate scope is left to you.

How we start

A scoping call, not a research project

Establishing whether you fall under Article 16 takes about half an hour, because the questions are specific and you already hold the answers.

1

Classification

Which DORA entity category your firm sits in, and which of the Article 16 routes could apply to you.

2

The tests

We work through the thresholds against your actual figures and the permissions you exercise.

3

What it removes

If you qualify, exactly which obligations drop away, and what a proportionate framework looks like instead.

4

A straight answer

If you do not qualify, you will know that too, and why. That is a useful outcome on its own.

Questions

Frequently asked

How do I know if my firm is small and non-interconnected?
The test comes from the Investment Firms Regulation and combines several measures: assets under management, client money held, assets safeguarded and administered, daily trading flow, net position risk, clearing margin, trading counterparty default exposure, balance sheet total and annual gross revenue. Some of these must fall below a threshold; others must be zero, which means holding certain permissions can decide the question on its own. Because the inputs are internal figures, the assessment has to be done with you rather than from a register.
Does Article 16 mean DORA does not apply to us?
No. DORA still applies. Article 16 replaces the detailed ICT risk management requirements of Articles 5 to 15 with a simplified framework. You still need a documented framework, a register of ICT third-party arrangements, incident classification and reporting, and business continuity arrangements. What falls away is the heavier machinery around them.
We are part of a group. Does that rule us out?
Not automatically. Group membership changes how the thresholds are calculated, because several must be assessed on a combined basis across the group rather than for your entity alone. That makes qualification harder to reach, not impossible. A subsidiary of a larger group can still meet the tests. It is worth establishing rather than assuming.
Do we need threat-led penetration testing?
Most entities in the Article 16 bracket are outside the scope of threat-led penetration testing. Advanced testing under DORA is directed at entities identified by their competent authority on the basis of their risk profile and systemic importance. Where it does apply, it is a distinct exercise rather than part of a simplified framework.
Who is accountable for this inside our firm?
The management body. DORA places accountability for the ICT risk management framework with the management body directly, and that accountability cannot be delegated to a service provider. Advisers can build the framework and operate the documentation with you. The responsibility to the regulator stays with the firm.
What does the scoping call cost?
Nothing. It exists to establish whether Article 16 applies to you, which is the question that determines everything that follows. If it turns out we are not the right fit for the work, the classification is still yours to keep.

Find out whether you are an Article 16 entity

Half an hour, against your own figures, with a straight answer at the end of it.

Book a scoping call