DORA for Asset & Fund Managers (UCITS / AIFMD)

Yes if you are an authorised UCITS management company or an authorised AIFM, as both are named financial entities in Article 2(1) of DORA. Sub-threshold AIFMs registered under Article 3(2) AIFMD are excluded by Article 2(3)(a), but opting into full authorisation or exceeding the AIFMD thresholds brings you in, so confirm your exact status. Self-managed funds and internally managed AIFs are treated as the relevant management entity for scoping.

No. Article 16 of DORA reserves the simplified framework to a closed list of entity types: small and non-interconnected investment firms, payment and e-money institutions benefiting from the PSD2 and EMD exemptions, certain exempted credit institutions and small IORPs. UCITS management companies and AIFMs are not on it, whatever their size. What a smaller manager can rely on is Article 4: the framework must be implemented in proportion to size, risk profile and the nature, scale and complexity of services, and several provisions expressly relieve microenterprises, for example on the independent internal-audit review of the framework. Document that calibration; do not claim a regime the Regulation does not offer.

DORA layers on top of, rather than replaces, the AIFMD and UCITS delegation and outsourcing requirements. Those regimes still govern substance, conduct and liability of delegation, while DORA governs the operational resilience of the ICT underpinning delegated and outsourced functions. In practice you should reconcile your existing outsourcing arrangements with the DORA Register of Information and contractual requirements so a single provider is governed consistently.

To the extent the administrator delivers ICT services supporting a critical or important function, such as NAV production, fund accounting or the investor register, the associated ICT services fall within DORA's third-party risk regime. You must include the arrangement in your Register of Information and ensure the contract contains DORA's mandatory provisions on access, audit, business continuity, sub-outsourcing and exit. Where the administrator subcontracts ICT, you also need visibility into that chain.

They can be. A NAV calculation error, valuation outage or dealing disruption is an ICT-related incident, and if it meets DORA's major-incident classification thresholds it must be reported to your competent authority within the prescribed timelines. The assessment turns on factors such as the number of clients/funds affected, duration, data loss and economic impact, so you should pre-define which fund operations would cross those thresholds.

DORA has applied since 17 January 2025, so the framework is already in force and supervisors expect demonstrable compliance now. Practical starting points are completing your Register of Information, mapping ICT dependencies behind NAV, dealing and reporting, remediating third-party contracts for the mandatory DORA clauses, and establishing incident classification and digital resilience testing. Prioritise the providers supporting critical or important fund functions.