DORA and customer documents
Account statements, contracts and payment reminders are the most visible part of your IT for your customers. Here you will find everything you need to make the production and dispatch of your customer documents DORA-ready: check, whitepaper and personal advice.
Why customer documents belong in your DORA programme
The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied to banks, insurers and other financial entities in the EU since 17 January 2025. It requires IT systems to be protected against disruptions and cyberattacks, and critical or important functions to be restorable within a defined time.
DORA generally also covers the ICT systems and service providers involved in document production. Yet many programmes focus on core banking, payments and the data centre, even though customers notice a failure here immediately: statements do not arrive, mandatory letters are delayed, payment reminders go out with errors.
Everything on DORA and customer documents
Whether you need an overview first or are already planning in detail: choose the starting point that suits you.
DORA Check
21 questions on your document processes. Instant result, detailed report by email on request.
Start the check → PDF – 8 pagesWhitepaper
What DORA requires for customer documents, seven common gaps and a five-step roadmap.
Download for free → SolutionsBanks and insurers
How INVARIS supports financial institutions with traceable, resilient customer communications.
Learn more → 30 minutesPersonal consultation
We go through your situation together and tell you what to tackle first.
Request a call →What DORA means for your document processes
In practice, the requirements can be grouped into five areas. If document production supports a critical or important function, additional obligations apply, such as annual testing and exit strategies.
Risk and contingency planning
DORA Art. 5–16Record systems and dependencies, set recovery times, back up templates.
Detecting and reporting incidents
DORA Art. 17–23Notice errors in document runs quickly and be able to classify and report them.
Testing for emergencies
DORA Art. 24–27Include document production in the testing programme, test template changes before approval.
Managing service providers
DORA Art. 28–44Review software, cloud and output providers, record them in the register of information, cover them by contract.
Incident communication
DORA Art. 14 and 19Define who informs customers about major incidents, and how.
DORA and customer documents
What banks and insurers need to consider when producing and sending their customer documents. 8 pages as PDF.
- DORA requirements translated into document processes
- Reporting deadlines for major incidents at a glance
- Seven common gaps from practice
- Five-step roadmap and questions for your software vendor
When it gets serious: deadlines for major incidents
To report, you need to know how many customers are affected. With customer documents, that is often the hardest question.
Based on Delegated Regulation (EU) 2025/301. If an incident is classified as major only after 24 hours, special rules apply.
Questions on DORA and customer documents
Since when has DORA applied?
Regulation (EU) 2022/2554 has applied since 17 January 2025. It is directly applicable in all EU member states and does not need to be transposed into national law.
Who is affected by DORA?
Banks, insurers, investment firms, payment and e-money institutions and other financial entities in the EU. A simplified framework applies to certain smaller institutions. ICT service providers are also indirectly affected, as financial entities must pass requirements on to them by contract.
Does DORA also apply to the production of customer documents?
Yes, DORA generally covers all ICT systems and service providers of a financial entity, including those used for document production. If they support a critical or important function, additional requirements apply, for example on testing, contracts and exit strategies.
What is the register of information?
Financial entities must record all contractual arrangements on the use of ICT services provided by third parties in a register (Art. 28(3) DORA). This can include software and output providers involved in document production if they provide ICT services.
Do customers have to be informed about an incident?
Yes, if a major ICT-related incident has an impact on the financial interests of clients. They must then be informed without undue delay about the incident and the measures taken (Art. 19(3) DORA).
Does DORA apply in Liechtenstein and Switzerland?
DORA applies in Liechtenstein through the EEA Agreement. It does not apply in Switzerland, where FINMA sets comparable requirements, mainly in Circular 2023/1 "Operational risks and resilience – banks".
This page is for information purposes only and does not replace legal or regulatory advice.
Let's talk about your document processes
30 minutes by video, free of charge and without obligation. INVARIS has supported banks, insurers and public authorities with traceable, resilient customer communications since 1986.