{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2025-12-17","gaps":[],"covered":["ESMA Q&A 2292 — Q&A — Obligation to apply the ICT risk managment (Art. 5-15) [Answer Published] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the ESMA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-3/q-and-a/esma/esma-qa-2292-obligation-to-apply-the-ict-risk-managment-art-5-15-and-or","url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2292-obligation-to-apply-the-ict-risk-managment-art-5-15-and-or","title":"ESMA Q&A 2292 — Q&A — Obligation to apply the ICT risk managment (Art. 5-15) [Answer Published]","family":"l3","work_id":"spaces/dora/level-3/q-and-a/esma/esma-qa-2292-obligation-to-apply-the-ict-risk-managment-art-5-15-and-or","status":"answer published","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"ESMA Q&A register, 27 September 2024","check":{"against":"the ESMA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2292","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"3ac00ab86b19abd0","change_date":null,"nearest_versions":["2025-12-17"],"first_text_date":null,"correction_applies":false,"versions":["2025-12-17"],"version_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2292-obligation-to-apply-the-ict-risk-managment-art-5-15-and-or/versions/2025-12-17","revision_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2292-obligation-to-apply-the-ict-risk-managment-art-5-15-and-or/versions/2025-12-17/rev/3ac00ab86b19abd0","versions_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2292-obligation-to-apply-the-ict-risk-managment-art-5-15-and-or/versions","relations_url":"https://www.headlesslaw.com/dora/level-3/q-and-a/esma/esma-qa-2292-obligation-to-apply-the-ict-risk-managment-art-5-15-and-or/relations","source_line":"Answer prepared by the European Commission, published in the ESMA Q&A tool · not legislation · published 17 Dec 2025 [Answer Published]","attribution":{"prepared_by":"European Commission","published_by":"ESMA","published_in":"ESMA Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2025-12-17","question_submitted_on":"2024-09-27","locators":{"published_on":"ESMA Q&A Excel export ESMA_QA_2292, column 'Esma responses', date line","question_submitted_on":"ESMA Q&A Excel export ESMA_QA_2292, column 'Date of submission'"}},"adoption":null}},"provenance":{"official_url":"https://www.esma.europa.eu/publications-data/questions-answers/2292","check":{"result":"matched","checked_at":"2026-10-26","against":"the ESMA publication"},"repo_path":"spaces/dora/level-3/q-and-a/esma/esma-qa-2292-obligation-to-apply-the-ict-risk-managment-art-5-15-and-or.md","body_sha256":"323f52df857b06eb10bb5843d3bdbaa99d594d157d778c716399402e6a0de824"},"units":[],"markdown":"---\ntitle: \"ESMA Q&A 2292 — Q&A — Obligation to apply the ICT risk managment (Art. 5-15) [Answer Published]\"\nshortTitle: \"ESMA Q&A 2292 — Q&A — Obligation to apply the ICT risk managment (Art. 5-15) [Answer Published]\"\nanswer_id: ESMA_QA_2292\ntopic: \"ICT risk management\"\nstatus: \"Answer Published\"\ntype: qa\ninstrument_type: qa\nauthority: ESMA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"DORA\"\ndora_level3: true\nmica_level2: false\nlegal_basis: \"Art. 5-15, Art. 16 DORA; Art. 12 (1) IFR + Art. 12 ECSPR\"\ndate: 27 September 2024\nsource_link: https://www.esma.europa.eu/publications-data/questions-answers/2292\nlifecycle: \"Answer Published\"\ntext_version: \"ESMA Q&A register, 27 September 2024\"\nsource_url: \"https://www.esma.europa.eu/publications-data/questions-answers/2292\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the ESMA publication\"\nsource:\n  prepared_by: \"European Commission\"\n  published_by: \"ESMA\"\n  published_in: \"ESMA Q&A tool\"\n  evidence:\n    prepared_by: \"Answer provided by the European Commission\"\n    locator: \"ESMA Q&A entry ESMA_QA_2292, first line of the answer field\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2025-12-17\"\n  question_submitted_on: \"2024-09-27\"\n  locators:\n    published_on: \"ESMA Q&A Excel export ESMA_QA_2292, column 'Esma responses', date line\"\n    question_submitted_on: \"ESMA Q&A Excel export ESMA_QA_2292, column 'Date of submission'\"\nlifecycle_label: \"Answer Published\"\n---\n\n**Answer prepared by the European Commission, published in the ESMA Q&A tool · not legislation · published 17 Dec 2025 [Answer Published]**\n\n*Answer Published · ESMA Q&A register, 27 September 2024 · Checked against the ESMA publication on 26 Oct 2026 · [Official source](https://www.esma.europa.eu/publications-data/questions-answers/2292)*\n\n| | |\n|---|---|\n| **Full title** | ESMA Q&A 2292 — Q&A — Obligation to apply the ICT risk managment (Art. 5-15) \\[Answer Published\\] |\n| **Prepared by** | European Commission |\n| **Published by** | ESMA, in the ESMA Q&A tool |\n| **Reference** | ESMA_QA_2292 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 17 December 2025; question submitted 27 September 2024 |\n| **Legal basis** | Art. 5-15, Art. 16 DORA; Art. 12 (1) IFR + Art. 12 ECSPR |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the ESMA publication |\n\n**Obligation to apply the ICT risk managment (Art. 5-15) and/or the simplified ICT risk management framework for entities that hold two or more licences.**\n\n### Question\n\nIs a small and non-interconnected investment firm (Art. 12 (1) IFR (Regulation (EU) 2019/2033)) that also holds a licence as a crowdfunding service provider according to Art. 12 ECSPR (Regulation (EU) 2020/1503) obligated to apply [Art. 5](../../../articles/5.md)-15 DORA or is it allowed to use the simplified ICT risk management framework of [Art. 16](../../../articles/16.md) DORA?\n\n***\n\n### Answer\n\nAnswer provided by the European Commission:\n\n[Articles 5](../../../articles/5.md)-15 DORA establish obligations for financial entities to put in place an internal governance and control framework that ensures an effective and prudent management of ICT risk. [Article 16](../../../articles/16.md) DORA introduces an exemption from the obligations laid down in Articles 5-15 enabling the design of a simplified ICT risk framework for the following categories of entities: small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366; institutions exempted pursuant to Directive 2013/36/EU in respect of which Member States have decided not to apply the option referred to in [Article 2(4)](../../../articles/2.md) DORA; electronic money institutions exempted pursuant to Directive 2009/110/EC; and small institutions for occupational retirement provision. The reason for this exemption is to ensure that the obligations are proportionate to the nature of ICT risks in view of the size and or the service they provide (see in this respect recital 42 DORA). [Article 5](../../../articles/5.md)-15 DORA cannot be derogated from, except where a financial entity benefits from the exemption laid down in [Article 16](../../../articles/16.md) DORA (which only requests a simplified ICT risk framework). The assessment of whether an entity benefits from the simplified regime laid down in [Article 16](../../../articles/16.md) DORA is to be done in on a case-by-case basis. In that context, if the main activity of a financial entity does not fall within the scope of the entities benefiting from [Article 16](../../../articles/16.md) DORA, the entity must apply a full ICT risk management framework as laid down in Art 5-15. If it does, the simplified ICT risk management framework under [Article 16](../../../articles/16.md) DORA would apply.\n\nDisclaimer:\n\nThe answers clarify provisions already contained in the applicable legislation. They do not extend in any way the rights and obligations deriving from such legislation nor do they introduce any additional requirements for the concerned operators and competent authorities. The answers are merely intended to assist natural or legal persons, including competent authorities and Union institutions and bodies in clarifying the application or implementation of the relevant legal provisions. Only the Court of Justice of the European Union is competent to authoritatively interpret Union law. The views expressed in the internal Commission Decision cannot prejudge the position that the European Commission might take before the Union and national courts.\n\n***\n\n**Source:** [ESMA original document](https://www.esma.europa.eu/publications-data/questions-answers/2292)\n"}