title: Germany — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/germany/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure limited signal Confirmed confirmed 2026-06-23 DORA directly applicable since 17 Jan 2025 + FinmadiG; BaFin national ICT hub, 4-hour deadline; first DORA fine EUR 450k Q3 2025; 600+ incidents registered. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/germany/) Horizon · 2027-01 (± a year) National BAIT/VAIT/KAIT/ZAIT circulars phase-out into DORA standards_Adopted, not yet in force · Tier 3 source_ Standing sub-brief · as of 27 June 2026 165 words · last cycle 2026-07-07 #### Operational Resilience & Critical Infrastructure DORA (Reg (EU) 2022/2554) has been directly applicable since 17 Jan 2025, supplemented domestically by the Finanzmarktdigitalisierungsgesetz (FinmadiG) amending KWG/KAGB/WpHG/ZAG. BaFin is Germany's national ICT incident reporting hub with a four-hour initial notification deadline via the BaFin-MVP portal; over 600 serious ICT incidents have been registered since Jan 2025, 63% of them third-party-linked. BaFin issued its first DORA enforcement notice in Q3 2025 — a EUR 450,000 fine for inadequate ICT third-party risk documentation — and the 2026 information register window ran 9-30 March 2026. The four-hour reporting deadline and the now-landed first fine materially raise ICT-resilience compliance cost for German PSPs and their third-party providers, across both bank and non-bank institutions. #### Outlook Resilience is on an escalating trajectory. National BAIT/VAIT/KAIT/ZAIT circulars are expected to transition into DORA unified standards, some to 1 Jan 2027, consolidating the German ICT supervisory stack into the EU framework. With the first enforcement notice issued, the supervisory pattern is now established rather than prospective. no periodic updates on record for this sub-brief ** 1 earlier update recorded under a different module label** An early cycle filed this entry under this module code with a heading naming another subject. Kept for the record; not this module's latest position. Periodic update · new data 2026-07-08 #### Consumer Protection & Dispute Resolution No material signal was identified for Germany under W3 (Consumer Protection and Dispute Resolution) this cycle beyond the APP-fraud reimbursement obligations captured under W1b, which carry direct consumer-protection implications. The BaFin consumer fraud warning (7 April 2026) is noted as a dashboard-tier enforcement signal. #### Outlook The PSR's APP-fraud reimbursement framework will be the primary consumer-protection development to track for Germany upon transposition. This module will be updated when DE-specific consumer-protection or dispute-resolution material is available. **Sources and findings (4)** 1. T3 [https://www.dlapiper.com/en/insights/publications/2025/02/application-of-the-digital-operational-resilience-act---dora [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.dlapiper.com/en/insights/publications/2025/02/application-of-the-digital-operational-resilience-act---dora [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 2. T3 [https://www.pinsentmasons.com/out-law/news/bafin-provides-guidance-reporting-security-incidents [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.pinsentmasons.com/out-law/news/bafin-provides-guidance-reporting-security-incidents [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 3. T3 [https://www.advisori.de/en/blog/dora-information-register-2026-bafin-reporting-deadline-is-running-what-financial-companies-have [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.advisori.de/en/blog/dora-information-register-2026-bafin-reporting-deadline-is-running-what-financial-companies-have [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]) 4. T3 [https://matproof.com/blog/dora-ict-incident-reporting-bafin-mvp [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://matproof.com/blog/dora-ict-incident-reporting-bafin-mvp [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication])