Efficient DORA Implementation: Simplifications for Leasing and Factoring Companies

The DORA Regulation (Digital Operational Resilience Act) aims to strengthen the digital resilience of the European financial sector. While initially primarily targeting large financial institutions such as banks and insurers, Germany has integrated leasing and factoring companies into the scope through the Financial Market Digitalization Act (FinmaDiG). However, these companies benefit from specific simplifications that enable them to implement the requirements proportionally.

The DORA Regulation emphasizes the principle of proportionality in Article 4. This is to ensure that smaller and less complex institutions can fulfill their obligations in an appropriate framework. For leasing and factoring companies, this means:

• Facilitated requirements: Less stringent requirements compared to large financial institutions.
• Risk-based adaptation: Measures must be adapted to the size, scope, and complexity of the companies.

2. Simplifications for Leasing and Factoring Companies

Simplified ICT Risk Management Framework (Article 16 DORA)

Leasing and factoring companies do not have to implement a comprehensive ICT risk management framework as provided for in Articles 5-15 of DORA. Instead, a simplified framework applies:

• Basic mechanisms: Simple processes for identifying, assessing, and controlling ICT risks.
• Documentation and monitoring: Proportionally reduced requirements for documentation and monitoring.

Exemption from TLPT Tests (Articles 26 and 27 DORA)

• Threat-Led Penetration Tests (TLPT) are not mandatory for these companies.
• This eliminates significant technical and financial burdens.

Longer Transition Periods

• The simplified ICT risk management framework must be applied only from January 1, 2027 onwards.
• This gives companies time to prepare for the requirements and adjust internal processes.

3. Practical Implementation Strategies

1. Prioritization of Core Requirements

• Companies should initially focus on reporting obligations and the principles of the simplified ICT risk management framework.
• An information register for documenting incidents and third-party relationships can help cover multiple requirements efficiently.

2. Use of External Expertise

• Especially smaller companies can meet the requirements faster and more cost-effectively by collaborating with specialized service providers.
• External consultancy can also help automate the reporting obligations according to Chapter III DORA.

3. Focus on Training and Awareness

• Involving employees is essential for early risk detection and effective process implementation.
• Training programs on ICT risks and reporting procedures can help integrate regulatory requirements into daily practice.

4. Advantages of Proportional Implementation

The proportional application of DORA offers the following advantages to leasing and factoring companies:

• Cost savings: Significant costs can be avoided through the simplified framework and TLPT exemption.
• Focus on essentials: Companies can concentrate on relevant risks and reporting obligations without being burdened by unnecessary requirements.
• Temporal flexibility: The transition periods allow for a gradual implementation that can be better coordinated internally.

Conclusion

Thanks to FinmaDiG, the DORA implementation offers leasing and factoring companies the opportunity to meet their requirements proportionally and cost-effectively. With a simplified ICT risk management framework, clear priorities, and a strategic approach, even smaller companies can enhance their digital resilience and comply with regulatory requirements. The long transition period until 2027 provides additional room to develop sustainable and effective solutions.