DORA Managed Service:
— your end-to-end Information Registry.
An annual managed service to generate your DORA Information Register, validate it, and file it with the ACPR—without tying up your teams for more than a few hours. Not a tool you have to learn to use: a team that gets the job done.
What it is, and what it isn't.
Why now?
The Digital Operational Resilience Act (DORA) requires payment and electronic money institutions to submit detailed annual reports on their third-party ICT relationships, including mapping, contracts, dependencies, alternatives, and data processing locations.
The final deliverable—between 9 and 12 CSV files structured according to the EBA rule sets—requires a contract-by-contract analysis and internal interviews. The annual deadline is March 31.
For a typical EP/EMI project, this involves 20 to 30 highly specialized person-days, allocated once a year. It is costly to handle in-house, risky to improvise, and not highly valued internally.
How it works.
Four steps, one point of contact. You make the decisions on what’s critical; we handle the execution.
Inventory
Contracts, service providers, intra-group, previous ROI. 2-week scoping sprint.
AI Extraction
Forms filled out automatically. Each field linked to its data source.
Human Review
Field-by-field validation by a DORA auditor. Audit trail retained.
OneGate / ACPR
Export and upload to the ACPR portal. Follow up on any feedback from supervisors.
Here's what we actually deliver.
Data Model & Extraction
- Alignment with the ACPR/EBA regulatory framework
- Mapping of third-party ICT providers, including subcontractors
- Semantic Extraction from Contracts & SLAs
Governance & QA
- Criticality classification (client-side validation)
- Systematic quality and completeness checks
- Audit trail assigned to documentary sources
Architecture & Delivery
- RAG pipeline + deterministic rules + human oversight
- European sovereign hosting—no processing of your data
- Export and submission to the regulator (OneGate)
The economic equation.
Pricing.
- Defining the scope
- AI-powered extraction of contracts & SLAs
- A review by a DORA auditor
- Pre-submission validation
- OneGate Audit & Export Module
- Post-filing monitoring by the supervisor (up to 2 ACPR responses)
- Estimated delivery within 4 to 6 weeks
- All the Essentials
- Extended Contract & SLA Extraction
- Criticality classification support
- Two reviews by a DORA auditor
- Support for changes in regulatory requirements
- Support for supervisor responses and regulatory requests
- All Managed
- Deployment tailored to your security and sovereignty requirements
- Dedicated team of auditors
- Proactive monitoring of incidents and major changes affecting service providers
- Customized export regulations (multi-country)
- Dedicated, named ACPR link
Year N+1: Your foundation remains the same.
With each cycle, your repository of evidence grows: contracts that have already been mapped, critical issues that have already been resolved, and sources that have already been assigned. In practical terms, the next cycle requires less planning, fewer interviews, and less data extraction. You build on your work from one year to the next instead of starting from scratch.
Pricing logic: on par with or slightly below the recommended daily rate for the Essential tier (the AI pipeline saves 5 to 10 consultant-days). Recurring fees and value-added governance services are included in the Managed and Enterprise tiers. Rates exclude VAT and any ACPR fees.
Why Fintecture?
Regulated entity.
A payment institution supervised and authorized by the Banque de France and the ACPR. We have firsthand experience with operational compliance, and we already deliver software that is audited by regulators.
AI already in production.
Our RAG pipeline—combined with deterministic validation and human oversight—is not a prototype: it is already in use for our own ACPR reporting, including DORA. The tools have been thoroughly tested through our daily internal use before being offered to our clients.
Dedicated DORA expertise.
Our service is led by an experienced DORA auditor who is familiar with EBA models, the validation process, and ACPR rejection criteria.
The defensible advantage is not the tool.
It is the methodology, the repository of evidence that can be reused from one cycle to the next, the audit trail assigned to the sources, and a regulated name for the mission.
Let's plan your DORA cycle together.
It takes 30 minutes to determine your delivery area, confirm the applicable delivery zone, and schedule your delivery.
DORA Managed Service:
—your information registry, managed end-to-end.
An annual managed service to build, validate, and file your DORA Register of Information with the ACPR—without requiring more than a few hours of your teams’ time. Not just a tool to onboard: a team that delivers.
What it is, and what it isn't.
Why now?
The Digital Operational Resilience Act (DORA) requires payment institutions and e-money institutions to file a detailed annual report on their third-party ICT relationships, including mapping, contracts, dependencies, alternatives, and data processing locations.
The final deliverable— 9 to 12 CSV files formatted according to the EBA rulesets—requires a contract-by-contract analysis and internal interviews. The annual deadline is March 31.
For a typical PI/EMI, this amounts to 20 to 30 highly specialized person-days allocated once a year. It is costly to handle in-house, risky to improvise, and offers little internal visibility.
How it works.
Four steps, one point of contact. You retain control over critical decisions; we handle the execution.
Inventory
Contracts, vendors, intra-group transactions, prior filings. Two-week scoping sprint.
AI extraction
Templates are populated automatically. Each field is linked to its source document.
Human review
Field-by-field sign-off by a DORA auditor. Full audit trail retained.
OneGate / ACPR
Export and filing via the ACPR portal. Ongoing supervisory follow-ups.
What we deliver, in concrete terms.
Data model & extraction
- Alignment with the ACPR/EBA regulatory data model
- Third-party ICT mapping, including subcontractors
- Semantic extraction of contracts and SLAs
Governance & QA
- Criticality classification (client-owned)
- Systematic quality and completeness checks
- Source-attributed audit trail
Architecture & Delivery
- RAG + deterministic rules + human supervision pipeline
- EU-based hosting, no processing of your data
- Regulator-ready export and submission (OneGate)
The economic equation.
Pricing.
- Scoping of the perimeter
- AI-powered extraction of contracts and SLAs
- One DORA auditor review pass
- Pre-submission validation
- Audit Pack & OneGate Export
- Post-filing supervisory follow-up (up to 2 ACPR responses)
- Estimated delivery within 4 to 6 weeks
- Everything in Essential
- Extended contract & SLA extraction
- Criticality classification support
- Two DORA auditor reviews
- Support for evolving regulatory requirements
- Support for supervisory responses and regulatory inquiries
- Everything in Managed
- Deployment tailored to your security and sovereignty requirements
- Dedicated audit team
- Proactive monitoring of major provider incidents and changes
- Custom multi-jurisdiction regulator exports
- Designated ACPR liaison
Cycle N+1: Your foundation remains intact.
Each cycle adds to your evidence repository: contracts that have already been mapped, critical issues that have already been resolved, and sources that have already been attributed. In practice, the next cycle requires less scoping, fewer interviews, and less data extraction. You build on your previous work year after year instead of starting from scratch.
Pricing logic: rates at the Essential tier are set at or slightly below standard consulting day rates (the AI pipeline requires 5 to 10 consultant-days). Recurring revenue and governance value are captured at the Managed and Enterprise tiers. All prices exclude VAT; ACPR fees may apply.
Why Fintecture.
Regulated player.
A payment institution supervised and authorized by the Banque de France and the ACPR. We live and breathe operational compliance, and we already deliver software that is audited by regulators.
AI is already in production.
Our RAG + deterministic validation + human supervision pipeline is not a prototype: it is already being used to process our own ACPR filings, including DORA. The tools have been thoroughly tested through our own daily use before we offer them to clients.
Dedicated DORA expertise.
Our service is led by an experienced DORA auditor who is familiar with the EBA templates, the validation logic, and the ACPR rejection patterns.
The defensible edge is not the tool.
It's the methodology, the evidence repository that grows with each cycle, the source-attributed audit trail, and a licensed professional on the engagement.
Let's map out your DORA cycle together.
A 30-minute call to assess your site, confirm the applicable tier, and plan your deployment.