DORA and LSI Banks

This study examines the digital operational resilience of small and medium-sized credit institutions in light of the EU's Digital Operational Resilience Act (DORA). At its core is the question of how a uniformly calibrated European ICT regulatory framework can be reconciled with the limited resources and business models of German Less Significant Institutions (LSI banks), and where tensions arise between regulatory expectations and practical implementation.

Based on a systematic analysis of the existing supervisory framework and an empirical survey of German LSI institutions, the study identifies the key areas of regulatory burden in ICT risk management, incident reporting, digital resilience testing, and the management of ICT third-party providers. The findings reveal where DORA effectively places disproportionate demands on smaller institutions and how the principle of proportionality would need to be further specified in order to achieve a sustainable balance between digital stability, operational efficiency, and competitiveness in the European banking sector.