— Compliance · DORA Articles 5–17

Generate a DORA-ready bank
before the 17 January 2025 deadline.

Digital Operational Resilience Act (Regulation EU 2022/2554) hits every EU financial entity. Minctrl's pipeline produces a DORA-compliant design — ICT risk framework, third-party register, incident classification table, and resilience-test plan — alongside the working code. Compliance officer agent maps every control to its article. No retrofitting.

DORA Art. 5Art. 6Art. 9Art. 17Art. 24EBA GuidelinesNIS2ISO27001SOC2
Generate now →See pricing
— What you get

Generated automatically by the pipeline.

01

ICT risk framework (Art. 5–6)

Governance structure, risk register, control matrix, board reporting cadence — generated as docs/dora/ict-risk-framework.md.

02

Third-party concentration (Art. 28)

ICT third-party register with criticality scoring, exit strategy template, sub-outsourcing chain audit.

03

Incident classification (Art. 17)

Severity matrix (Major / Significant / Other), 4-hour notification runbook, ESMA/EBA reporting templates.

04

Resilience tests (Art. 24)

Threat-led penetration test plan, advanced testing scope, scenario library — kicked off as Jira tickets.

05

Cyber-resilience evidence pack

Auto-generated PDF bundle with logs, control-to-article mapping, architectural diagrams, and fix-plan.

06

DORA + NIS2 cross-mapping

If you're scoped for both — single pipeline, single artefact set. The compliance officer flags overlap and divergence.

— Best fits

Start with one of these product types.

Neobank

Most DORA-impacted: full Art. 5–17 mapping, IBAN ledger, AML6, PSD2 SCA in one run.

Open archetype →
BaaS

DORA + NIS2 + sub-outsourcing chain audit for sponsor-bank model.

Open archetype →
Neobroker

Investment firm scope: DORA + MiFID II + MAR surveillance.

Open archetype →
AI-Agent Bank β

DORA + EU AI Act high-risk classification for autonomous agents.

Open archetype →
— FAQ

Questions we hear often.

Will this make us audit-ready by 17 January 2025?

The pipeline produces every artefact a DORA auditor will ask for — risk register, register of information, incident classification, resilience-test plan, exit strategies. You still need internal sign-off and ongoing operations, but you skip the 6-month design-from-scratch phase.

We're already mid-build. Can we retrofit?

Yes. Run an existing-system import pipeline (planned Q3) or use the compliance_officer agent standalone to gap-analyse current artefacts against DORA. Output is a delta report with file paths to fix.

Does the audit pack hold up for ECB / BaFin / FCA?

The evidence pack generator emits SOC2 + ISO27001 + DORA matrices using the same upstream evidence (logs, configs, diagrams) so cross-referencing across regulators just works. We've not yet faced a real audit ourselves — pre-revenue product — so we recommend running it past your second-line risk team first.

Ready to generate yours?

Free tier. No credit card. Bring your own LLM key — pay only when AI ships actual code.

Launch dashboard →