Account statements, contracts and payment reminders are often the most direct contact with your customers. If producing or sending them fails, your DORA programme is directly affected. The free DORA Check shows you in about five minutes where your document processes are well set up and where gaps remain.
Since 17 January 2025, the Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied to banks, insurers and other financial entities in the EU. It requires critical or important functions to remain manageable during IT disruptions and cyberattacks, and to be restored within defined timeframes.
Many DORA programmes focus on core banking, payments and the data centre. The production and dispatch of customer documents is easily overlooked, even though customers notice a failure here immediately: account statements do not arrive, mandatory letters are delayed, payment reminders go out with errors.
The 21 questions are based on the requirements of the DORA regulation, grouped into five areas, and are tailored to the production, dispatch and archiving of customer documents.
Are document processes covered in your risk assessment, system inventory and contingency planning?
Are errors in document runs detected in time, and can they be classified and reported?
Is document production tested regularly, including when templates change?
Are software, cloud and output providers recorded, covered by contract and replaceable?
Is it defined who informs customers and other parties about major incidents, and how?
For 40 years, INVARIS has developed software that banks, insurers and public authorities in Austria, Germany and Switzerland use to produce and send their customer documents. This helps financial entities implement many DORA requirements for document processes. Learn more about our solutions for banks and insurers.
30 minutes by video, free of charge. We will go through your open points together.
The Digital Operational Resilience Act is an EU regulation (2022/2554) on digital operational resilience in the financial sector. It has applied since 17 January 2025 and covers ICT risk management, the handling of ICT-related incidents, resilience testing, the management of ICT third-party providers and information sharing.
DORA generally covers the ICT systems and service providers involved in document production. If they support a critical or important function, additional requirements apply, for example on testing, contracts and exit strategies. Each financial entity assesses whether this is the case. The check helps you with this assessment.
For heads of IT, compliance and information security, output and document management, and DORA programme leads at banks, savings banks and insurers.
No. The check provides guidance and is not proof of DORA compliance. Which obligations apply to you depends on the type, size and risk profile of your organisation.
You see your result without signing up. Only if you request the detailed report do we use your name, company and email address to send it to you. We will only contact you if you have agreed to this.
DORA also applies in Liechtenstein through the EEA Agreement. Switzerland is not covered by DORA; there, FINMA sets comparable requirements, mainly in Circular 2023/1 “Operational risks and resilience – banks”. The questions in the check also provide good guidance in Switzerland.
Basis: Regulation (EU) 2022/2554 (DORA). This page is for information only and does not replace legal or regulatory advice.