DE v13.3.0

Germany (DE) · Module Detail

Germany: Operational Resilience & Critical Infrastructure

← Full Germany overview Build report with Germany Request deeper dive

#

DORA directly applicable since 17 Jan 2025 + FinmadiG; BaFin national ICT hub, 4-hour deadline; first DORA fine EUR 450k Q3 2025; 600+ incidents registered.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Horizon · 2027-01 (± a year)National BAIT/VAIT/KAIT/ZAIT circulars phase-out into DORA standardsAdopted, not yet in force · Tier 3 source
Standing sub-brief · as of 27 June 2026165 words · last cycle 2026-07-07

Operational Resilience & Critical Infrastructure

DORA (Reg (EU) 2022/2554) has been directly applicable since 17 Jan 2025, supplemented domestically by the Finanzmarktdigitalisierungsgesetz (FinmadiG) amending KWG/KAGB/WpHG/ZAG. BaFin is Germany's national ICT incident reporting hub with a four-hour initial notification deadline via the BaFin-MVP portal; over 600 serious ICT incidents have been registered since Jan 2025, 63% of them third-party-linked. BaFin issued its first DORA enforcement notice in Q3 2025 — a EUR 450,000 fine for inadequate ICT third-party risk documentation — and the 2026 information register window ran 9-30 March 2026. The four-hour reporting deadline and the now-landed first fine materially raise ICT-resilience compliance cost for German PSPs and their third-party providers, across both bank and non-bank institutions.

no periodic updates on record for this sub-brief

1 earlier update recorded under a different module label

An early cycle filed this entry under this module code with a heading naming another subject. Kept for the record; not this module's latest position.

Periodic update · new data 2026-07-08

Consumer Protection & Dispute Resolution

No material signal was identified for Germany under W3 (Consumer Protection and Dispute Resolution) this cycle beyond the APP-fraud reimbursement obligations captured under W1b, which carry direct consumer-protection implications. The BaFin consumer fraud warning (7 April 2026) is noted as a dashboard-tier enforcement signal.

Outlook

The PSR's APP-fraud reimbursement framework will be the primary consumer-protection development to track for Germany upon transposition. This module will be updated when DE-specific consumer-protection or dispute-resolution material is available.

Sources and findings (4)
  1. T3https://www.dlapiper.com/en/insights/publications/2025/02/application-of-the-digital-operational-resilience-act---dora [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  2. T3https://www.pinsentmasons.com/out-law/news/bafin-provides-guidance-reporting-security-incidents [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  3. T3https://www.advisori.de/en/blog/dora-information-register-2026-bafin-reporting-deadline-is-running-what-financial-companies-have [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  4. T3https://matproof.com/blog/dora-ict-incident-reporting-bafin-mvp [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]