🇩🇪Germany
DORA compliance in Germany
In Germany, BaFin enforces DORA for banking, insurance, and investment firms. German financial entities must reconcile DORA with existing BaFin requirements (MaRisk, BAIT, VAIT, KAIT).
Enforcement authority
BaFin (Federal Financial Supervisory Authority) + BSI for cybersecurity aspects
Maximum sanctions
BaFin can impose fines, require remediation measures, restrict business activities, or revoke licenses. Criminal liability possible under KWG (Banking Act).
Key obligations
What DORA requires from organizations operating in Germany.
Align BaFin BAIT/VAIT/KAIT requirements with DORA ICT risk management framework
Report ICT incidents to BaFin in accordance with DORA reporting timelines
Implement TLPT testing program coordinated with BSI (Federal Office for Information Security)
Maintain comprehensive ICT third-party provider register as required by BaFin
Local context in Germany
Germany's MaRisk and BAIT frameworks already impose strict IT risk requirements. BaFin has indicated it will align these with DORA rather than create parallel obligations. The BSI provides TLPT testing standards for the German market.
Frequently asked questions
How does DORA apply in Germany?
In Germany, BaFin enforces DORA for banking, insurance, and investment firms. German financial entities must reconcile DORA with existing BaFin requirements (MaRisk, BAIT, VAIT, KAIT).
Who enforces DORA in Germany?
BaFin (Federal Financial Supervisory Authority) + BSI for cybersecurity aspects
What are the penalties for DORA non-compliance?
BaFin can impose fines, require remediation measures, restrict business activities, or revoke licenses. Criminal liability possible under KWG (Banking Act).
DORA in other jurisdictions
Check your DORA compliance now
Start free scan to see your risk score and applicable obligations.