DORA Certifications Bundle
399 € excl. VAT
DORA Sector Guide
DORA for Asset & Fund Managers (UCITS / AIFMD)
DORA for the firms that run Europe's funds: protecting NAV integrity, valuation and the delegation chain.
DORA for the firms that run Europe's funds: protecting NAV integrity, valuation and the delegation chain.
Which kind of fund manager are you?
Management companies are listed in Article 2(1)(l) and are not on the closed list of Article 16, whatever their size. Articles 5 to 15 apply, calibrated by the proportionality principle of Article 4, and that calibration should be documented.
Next step: DORA Gap AnalysisManagers of alternative investment funds are listed in Article 2(1)(k) and Article 16 is not open to them, so the full framework applies, calibrated by Article 4. This includes a manager that has opted into full authorisation under the AIFMD, and an internally managed AIF authorised as its own AIFM.
Next step: DORA Gap AnalysisDORA does not apply to managers of alternative investment funds referred to in Article 3(2) AIFMD. Keep the status under review: opting into full authorisation, or exceeding the AIFMD thresholds, brings you into scope under Article 2(1)(k).
Next step: DORA Scope DeterminationSize does not open Article 16 to a management company or an AIFM. Proportionality comes from Article 4, and a microenterprise (Article 3(60)) is relieved of specific requirements, such as the internal audit of the framework (Article 6(6)). Document the calibration rather than claim a simplified regime.
Next step: DORA Compliance ChecklistNot sure your entity is a financial entity at all? Run the free scope determination.
UCITS management companies and authorised AIFMs are explicitly named as financial entities under Article 2 of DORA, so the full digital operational resilience framework applies to the firms managing Europe's collective investment vehicles. For asset managers the regulation is less about retail-facing systems and more about the engines that price, trade and report on funds: portfolio and order management systems, fund accounting and NAV calculation, market-data feeds and the long chain of delegates and outsourcers that sit behind them.
DORA reframes ICT risk as a board-level resilience obligation rather than an IT housekeeping task. ManCos and AIFMs must build a documented ICT risk-management framework, classify and report major ICT-related incidents, test their digital resilience, and contractually govern every ICT third-party dependency. Because asset management runs on delegation, the hardest part for most firms is mapping and overseeing the providers who actually operate critical functions on their behalf.
DORA applies to authorised UCITS management companies and AIFMs as financial entities under Article 2(1). Sub-threshold AIFMs registered under Article 3(2) AIFMD are excluded by Article 2(3)(a) of DORA, but a manager that opts into full authorisation or breaches the AIFMD thresholds comes into scope, so the exact authorisation status must be confirmed and kept under review. The simplified framework of Article 16 is not available to management companies or AIFMs: Article 16(1) is a closed list (small and non-interconnected investment firms, exempted payment and e-money institutions, certain exempted credit institutions and small IORPs). In-scope managers therefore apply Articles 5 to 15 in full, calibrated through the proportionality principle of Article 4 and the specific reliefs DORA grants to microenterprises, and document that calibration.
National competent authorities (e.g. AMF, BaFin, CSSF, CBI) authorise UCITS management companies and AIFMs under the UCITS Directive and the AIFMD and supervise their compliance with DORA, with ESMA coordinating convergence and contributing to the joint ESA oversight of critical ICT third-party providers.
DORA sits on top of the AIFMD and UCITS delegation and outsourcing regimes rather than replacing them: where those directives govern the conduct, substance and liability of delegation, DORA governs the operational resilience of the ICT that underpins delegated and outsourced functions. This matters acutely for dependencies on depositaries, fund administrators, transfer agents and valuation/NAV providers, whose outages translate directly into delayed or mispriced NAVs. Firms should align their AIFMD/UCITS outsourcing inventories with the DORA Register of Information so a single dependency is not governed by two inconsistent contractual standards.
Six obligations that play out differently in your sector. Open a card for the detail.
NAV calculation and the valuation function are core ICT-dependent processes whose failure produces direct, quantifiable investor harm. DORA expects documented availability, integrity and continuity controls around the pricing and fund-accounting chain, plus tested fallbacks for when the primary engine or its inputs fail. A late or incorrect NAV is the asset-management equivalent of a critical service outage.
Most ManCos and AIFMs delegate fund accounting, NAV production and investor register/TA functions to third parties, making the ICT services those providers deliver critical dependencies under DORA. Each arrangement for ICT services must appear in the Register of Information (Article 28(3)) with appropriate contractual rights to information, audit, business continuity and exit. Concentration on a small number of large administrators is itself a resilience risk the firm must assess and document.
OMS/PMS, EMS and connectivity to brokers, trading venues and custodians are ICT systems supporting critical or important functions. Their unavailability can prevent dealing, settlement and rebalancing within required windows, so DORA requires resilience, monitoring and recovery objectives (RTO/RPO) calibrated to trading and settlement cutoffs rather than generic IT targets.
Pricing depends on continuous, accurate market-data and reference-data feeds from index, pricing and benchmark providers. DORA treats these data dependencies as ICT third-party services that must be inventoried, monitored for integrity and continuity, and backed by alternative sources or stale-data procedures so a feed outage does not silently corrupt valuations.
Asset managers operate against hard deadlines: NAV strike and publication, dealing cutoffs, and regulatory/investor reporting. DORA's continuity and incident-handling expectations should be mapped to these time-critical windows, because a resilience event that merely delays processing can still breach fund documentation, prospectus commitments and supervisory reporting obligations.
Delegation under AIFMD/UCITS frequently runs several layers deep, and subcontracted ICT (cloud, hosting, sub-administrators) can sit far from the manager's direct line of sight. DORA requires the firm to look through these chains, identify the ICT third-party services supporting critical or important functions, and retain accountability even where operation is delegated.
8 questions drawn from the requirements above. Each gap you declare comes back with the course that covers it and the tool that does the work. Your answers stay in this browser.
Has your management body approved an ICT risk management framework under Articles 5 to 15 that covers NAV calculation, valuation, dealing and reporting, with its Article 4 calibration documented?
Are the NAV engine, fund accounting and order management systems covered by a business impact analysis, with RTO and RPO set against NAV strike and dealing cut-offs?
If a market-data or reference-data feed fails, do you have a documented alternative source or stale-data procedure so that the outage cannot silently corrupt valuations?
Have you pre-defined which NAV, valuation and dealing failures would meet the major-incident criteria of Delegated Regulation (EU) 2024/1772, so the initial notification goes within 4 hours of classifying one as major?
Are the ICT services behind fund accounting, NAV production, the investor register and market data, subcontractors included, recorded in your Register of Information and reconciled with your AIFMD or UCITS outsourcing inventory?
Do your contracts with fund administrators and transfer agents for ICT services supporting critical or important functions contain the Article 30 clauses, and have you documented exit plans and your concentration on a few administrators?
Do you test the NAV, order management, market-data and reporting chains under a documented, risk-based programme, and have you recorded whether your competent authority has identified you for TLPT?
Does your management body follow specific ICT risk training on a regular basis, and do all staff, delegation-oversight teams included, complete digital operational resilience training?
You declared 0 areas to work on, gaps first. Each one names what to learn and what to use.
Indicative self-assessment based on your own answers, not a compliance opinion. Prices exclude VAT.
Three reports to your competent authority, each with its own clock. Enter two times to see your deadlines.
Within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
Enter the classification timeWithin 72 hours of submitting the initial notification, and updated when the situation changes.
Follows the initial notificationWithin one month of the latest intermediate report, once the root cause analysis is complete.
Follows the intermediate reportDelegated Regulation (EU) 2025/301, Article 5; classification under Delegated Regulation (EU) 2024/1772. The later deadlines assume each report goes in at its latest permissible time. A deadline falling on a weekend or bank holiday moves to noon of the next working day (Article 5(4)), except for the initial notification and intermediate report of credit institutions, central counterparties, operators of trading venues and essential or important entities under NIS2, or where your competent authority has decided otherwise (Article 5(5) and (6)); the dates shown do not apply that extension.
For asset managers the most material ICT incidents are NAV calculation errors, valuation outages and dealing/settlement disruptions, which can cause direct investor detriment, compensation, and breaches of fund documentation. Such events must be assessed against DORA's major-incident classification criteria (clients affected, duration, geographical spread, data losses, economic impact) and, where classified as major, reported to the competent authority within the RTS timelines for initial, intermediate and final reports. Firms should pre-map which fund operations would trigger classification so they can meet notification deadlines under pressure rather than reconstructing impact after the fact.
In a management company or an AIFM, a few roles carry the DORA decisions. Fund operations judge whether the ICT failure behind a NAV error or a dealing disruption is a major incident: the initial notification is due within 4 hours of classifying it as major. Whoever oversees delegation reconciles AIFMD or UCITS outsourcing with the Register of Information and negotiates Article 30 clauses with administrators you cannot replace overnight. The management body approves the framework and keeps its ICT risk knowledge current. Each needs to know what DORA expects of the role.
Members of the management body must “actively keep up to date with sufficient knowledge and skills” to understand and assess ICT risk, including by following specific training on a regular basis.
Regulation (EU) 2022/2554, on EUR-Lex Article 13(6) · All staffICT security awareness programmes and digital operational resilience training are “compulsory modules” of staff training, for all employees and senior management, at a level that matches each function.
Regulation (EU) 2022/2554, on EUR-LexOwns the DORA programme, the record that Article 16 is not available, the Article 4 calibration and the evidence file your competent authority will ask for.
The first lesson is open to read before you buy.
Classifies NAV errors, valuation outages and dealing disruptions caused by ICT failures against Delegated Regulation (EU) 2024/1772 and drafts the initial, intermediate and final reports.
The first lesson is open to read before you buy.
Monitors ICT third-party arrangements (Article 5(3)): administrators, transfer agents, market-data providers and their subcontractors, Article 30 clauses, concentration and exit plans.
The first lesson is open to read before you buy.
Sets RTO and RPO for the NAV engine, fund accounting and order management against dealing and NAV publication cut-offs, and runs the tests that evidence them.
The first lesson is open to read before you buy.
Bears ultimate responsibility for ICT risk, delegated operations included, approves the framework and must keep its ICT risk knowledge current through specific training (Article 5(4)).
The first lesson is open to read before you buy.
Several people to train? Team seats cost less per learner from 2 seats, on one invoice: see team pricing.
Starting out? DORA Fundamentals is free, certificate included.
The tools that matter most for your sector, and what each one does for you.
Enter administrators, transfer agents, market-data providers and their subcontractors in the ITS templates and run the validation rules before the annual collection.
Open FreeTest a past NAV error, valuation outage or dealing disruption against the major-incident criteria of Delegated Regulation (EU) 2024/1772.
Open €149Set MTPD, RTO and RPO for the NAV engine, fund accounting and order management against NAV strike and dealing cut-offs.
Open From €79The concentration toolkit maps dependency on a few large administrators and cloud platforms, sub-outsourcing chains and substitutability (Article 29).
Open FreeScore fund administrators, transfer agents and market-data providers and see which ones need an exit plan first.
Open Initial report free · full drafts €99Draft the initial notification for a NAV, valuation or dealing outage, with each reporting deadline computed.
OpenAll tools: browse the full list. Prices exclude VAT.
Everything tailored to your sector, ready to use on day one.
Yes if you are an authorised UCITS management company or an authorised AIFM, as both are named financial entities in Article 2(1) of DORA. Sub-threshold AIFMs registered under Article 3(2) AIFMD are excluded by Article 2(3)(a), but opting into full authorisation or exceeding the AIFMD thresholds brings you in, so confirm your exact status. An internally managed AIF is authorised as its own AIFM and is in scope on that basis. DORA lists UCITS management companies (Article 2(1)(l)), not self-managed UCITS investment companies: confirm the position of a self-managed UCITS with your competent authority.
No. Article 16 of DORA reserves the simplified framework to a closed list of entity types: small and non-interconnected investment firms, payment and e-money institutions benefiting from the PSD2 and EMD exemptions, certain exempted credit institutions and small IORPs. UCITS management companies and AIFMs are not on it, whatever their size. What a smaller manager can rely on is Article 4: the framework must be implemented in proportion to size, risk profile and the nature, scale and complexity of services, and several provisions expressly relieve microenterprises, for example on the independent internal-audit review of the framework. Document that calibration; do not claim a regime the Regulation does not offer.
DORA layers on top of, rather than replaces, the AIFMD and UCITS delegation and outsourcing requirements. Those regimes still govern substance, conduct and liability of delegation, while DORA governs the operational resilience of the ICT underpinning delegated and outsourced functions. In practice you should reconcile your existing outsourcing arrangements with the DORA Register of Information and contractual requirements so a single provider is governed consistently.
To the extent the administrator delivers ICT services supporting a critical or important function, such as NAV production, fund accounting or the investor register, the associated ICT services fall within DORA's third-party risk regime. You must include the arrangement in your Register of Information and ensure the contract contains DORA's mandatory provisions on access, audit, business continuity, sub-outsourcing and exit. Where the administrator subcontracts ICT, you also need visibility into that chain.
They can be. A NAV calculation error, valuation outage or dealing disruption caused by an ICT failure is an ICT-related incident, and if it meets DORA's major-incident classification thresholds it must be reported to your competent authority within the prescribed timelines. The assessment turns on factors such as the number of clients/funds affected, duration, data loss and economic impact, so you should pre-define which fund operations would cross those thresholds.
DORA has applied since 17 January 2025, so the framework is already in force and competent authorities expect demonstrable compliance now. Practical starting points are completing your Register of Information, mapping ICT dependencies behind NAV, dealing and reporting, remediating third-party contracts for the mandatory DORA clauses, and establishing incident classification and digital resilience testing. Prioritise the providers supporting critical or important fund functions.
Need the full risk view? See the Risk Assessment Toolkits or compare all kits. All prices exclude VAT; an EU VAT invoice is issued at checkout. Professional templates, not legal advice.
Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.
Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.