Do we qualify for the simplified ICT risk management framework or the microenterprise relief?

Start

We want to know if we qualify for simplified or micro relief

Two separate tests give two separate reliefs. The Article 16 test decides whether you follow the simplified framework instead of Articles 5 to 15. The microenterprise test decides which of the remaining duties lighten or fall away. An entity can pass one, both or neither, and the facts decide it.

• Then: Gather the licence, exemption letter, accounts and headcount

Step

Gather the licence, exemption letter, accounts and headcount

You need the document that shows your kind of authorisation or exemption, your Member State's decision on Article 2(4) if you are a bank-type exempted institution, the latest approved accounts and your headcount. Record each fact with its source. Counsel will confirm the result and the management body will approve it, so the record has to stand on its own.

• Then: Are we a financial entity in scope, with no Article 2(3) exclusion?

Decision

Are we a financial entity in scope, with no Article 2(3) exclusion?

Relief only means something for a financial entity that DORA binds. If you have not completed the scope assessment, or you are not sure of the answer, take No and settle scope first. A supplier to financial entities is not a financial entity and meets neither relief (DR-22).

• Yes: Which of the Article 16(1) kinds could we be?
• No, or not known: Settle scope first, then return here

Outcome

Settle scope first, then return here

Run the scope assessment before asking about relief. If you supply ICT services to a financial entity, DORA reaches you through your customers' contracts and the supplier flow-down list instead (DR-22). If you are neither, neither relief is relevant.

Decision

Which of the Article 16(1) kinds could we be?

Only five groups can follow the simplified framework: small and non-interconnected investment firms, exempted payment institutions, exempted electronic money institutions, certain institutions exempted under Directive 2013/36/EU, and small pension institutions. A kind is necessary but not enough, because each has a condition, tested next. Pick the kind your authorisation names. If none fits, take the last branch.

• Investment firm: Do we meet the Article 12(1) conditions of Regulation 2019/2033?
• Payment institution: Are we exempted under Article 32(1) of Directive (EU) 2015/2366?
• Electronic money institution: Are we exempted under Article 9(1) of Directive 2009/110/EC?
• Institution exempted under Directive 2013/36/EU: Has our Member State excluded such institutions (Article 2(4))?
• Pension institution: How many members do our pension schemes have in total?
• None of these: Under 10 staff, and turnover or balance sheet at most EUR 2m?

Decision

Do we meet the Article 12(1) conditions of Regulation 2019/2033?

A small and non-interconnected investment firm is one that meets the conditions of Article 12(1) of Regulation (EU) 2019/2033 (DORA Article 3(34)). The pack points to those conditions without restating them, so read them with counsel against your latest figures. Being small does not qualify a firm on its own: TC-04 shows an investment firm with 8 staff that stays on the full framework, and TC-07 the one that meets the conditions.

• Yes: Under 10 staff, and turnover or balance sheet at most EUR 2m?
• No, or not known: Under 10 staff, and turnover or balance sheet at most EUR 2m?

Decision

Are we exempted under Article 32(1) of Directive (EU) 2015/2366?

Only a payment institution with that exemption follows the simplified framework. A fully authorised payment institution follows the full framework, as the worked example does (TC-01), and TC-08 shows an exempted one with 4 staff on the simplified framework. Check your authorisation or exemption letter, not your size.

• Yes: Under 10 staff, and turnover or balance sheet at most EUR 2m?
• No, or not known: Under 10 staff, and turnover or balance sheet at most EUR 2m?

Decision

Are we exempted under Article 9(1) of Directive 2009/110/EC?

Only an electronic money institution with that exemption follows the simplified framework. One that is fully authorised follows the full framework. TC-09 shows an exempted institution with 40 staff on the simplified framework. Check the exemption letter.

• Yes: Under 10 staff, and turnover or balance sheet at most EUR 2m?
• No, or not known: Under 10 staff, and turnover or balance sheet at most EUR 2m?

Decision

Has our Member State excluded such institutions (Article 2(4))?

Certain institutions exempted under Directive 2013/36/EU follow the simplified framework where the Member State has decided not to use the Article 2(4) option to exclude them. If the Member State did exclude them, DORA does not bind them at all (TC-15, TC-16). Read the Member State's decision, and ask your authority if it is unclear.

• Yes, it excludes them: Out of scope: record the exclusion and who confirmed it
• No, it does not: Under 10 staff, and turnover or balance sheet at most EUR 2m?
• Not known: Get the Member State's decision confirmed in writing

Decision

How many members do our pension schemes have in total?

A pension institution with no more than 15 members in total is excluded by Article 2(3). One with fewer than 100 follows the simplified framework (TC-13, TC-14). One with 100 or more follows the full framework. Count members across all the schemes the institution operates, and take the last branch if you have no reliable count.

• 15 or fewer: Out of scope: record the exclusion and who confirmed it
• 16 to 99: Under 10 staff, and turnover or balance sheet at most EUR 2m?
• 100 or more, or not known: Under 10 staff, and turnover or balance sheet at most EUR 2m?

Outcome

Out of scope: record the exclusion and who confirmed it

DORA does not bind you (regime: out of scope). Write down the exclusion or the Member State's decision, the fact it rests on and counsel's confirmation, and have the management body approve it. Review it at least every 12 months, the pack's default, and when a figure, a licence or the Member State's decision changes.

Outcome

Get the Member State's decision confirmed in writing

You cannot answer the relief question until you know whether your Member State excluded your kind. Ask your competent authority or counsel for the decision. Judgement: until you have it, work to the full framework, because it carries more duties than the simplified one. Your authority's view stands where it differs from this reading.

Decision

Under 10 staff, and turnover or balance sheet at most EUR 2m?

Microenterprise status still matters under the simplified framework, because it changes which testing duties apply. A microenterprise has fewer than 10 staff and an annual turnover or balance sheet total of at most EUR 2 million. A missing figure counts against being one (TC-18), so take No until the record is complete.

• Yes: Simplified framework, with the microenterprise relief
• No, or a figure is missing: Simplified framework applies: Article 16, plus the other pillars

Outcome

Simplified framework applies: Article 16, plus the other pillars

Articles 5 to 15 do not apply. You keep the simplified framework of Article 16 and Title III of Delegated Regulation (EU) 2024/1774: RQ-03, RQ-23 to RQ-26 and RQ-40. Incident, register, contract and information-sharing duties still apply, and TLPT is excluded. The test cases give 24 to 26 of 52 requirements (TC-07, TC-09, TC-14, TC-16). Counsel confirms, the management body approves, and you review at least every 12 months, the pack's default.

Outcome

Simplified framework, with the microenterprise relief

The simplified framework applies, and as a microenterprise you do not carry the testing programme or the yearly test of critical systems (RQ-32, RQ-33). A risk-based testing plan applies instead (RQ-35), and audit and inspection rights in critical contracts may be delegated (RQ-48). TC-08 gives 25 of 52 for an exempted payment institution and TC-14 gives 24 for a small pension institution. Counsel confirms, and you review at least every 12 months, the pack's default.

Decision

Under 10 staff, and turnover or balance sheet at most EUR 2m?

A microenterprise has fewer than 10 staff and an annual turnover or balance sheet total of at most EUR 2 million. A central securities depository, central counterparty, trading venue or trade repository is never one (TC-10, TC-11). A missing figure counts against being one (TC-18), so take No until the record is complete.

• Yes: Microenterprise relief applies on top of the full framework
• No, or a figure is missing: No relief: follow the full framework and record why

Outcome

Microenterprise relief applies on top of the full framework

These fall away: a control function, three lines and ICT audit (RQ-08), legacy-system assessments (RQ-13), a crisis management function (RQ-18), and the testing programme and strategy for third parties (RQ-32, RQ-33, RQ-44, RQ-45). Others lighten (RQ-09, RQ-16, RQ-17, RQ-19, RQ-20, RQ-48), a risk-based testing plan applies (RQ-35), and TLPT does not. Reassess when staff or figures near the line.

Outcome

No relief: follow the full framework and record why

Neither relief applies. Write down the figures and their source so the answer can be defended, and apply Articles 5 to 15 in proportion to your size and risk profile (Article 4). A duty is never marked Not applicable because it is hard or costly (DR-03). Reassess when staff, turnover or the balance sheet total changes in a way that could cross the line.