BaFin has repealed VAIT, KAIT and ZAIT and is repealing BAIT in stages, so German banks, insurers, fund managers and payment firms whose IT control frameworks still cite these circulars need to re-anchor them on DORA. For most firms the switch happened on 17 January 2025, but the last step is close: BaFin says BAIT is fully repealed with effect from the end of 31 December 2026, and a further group of institutions must apply DORA from 1 January 2027 under the amended German Banking Act. This guide sets out the official timeline as BaFin published it, who is affected, how to find controls, policies and identities still tied to the old circulars, the migration options and the risks of leaving the BAIT references in place. It is written for IT risk, information security, compliance and internal audit teams in German financial firms. It does not repeat DORA itself: for the regulation's pillars and technical standards, see the DORA Guide.
Key takeaways
- VAIT, KAIT and ZAIT are gone. BaFin repealed the IT circulars for insurers, capital management companies and payment and e-money institutions with effect from the end of 16 January 2025.
- BAIT ends on 31 December 2026. Institutions applying DORA's ICT risk management (Articles 5 to 15, or the simplified Article 16) left the BAIT scope at the end of 16 January 2025; the circular is fully repealed with effect from the end of 31 December 2026.
- More institutions join DORA on 1 January 2027. BaFin states that the Financial Market Digitalisation Act (FinmadiG) reworded § 1a KWG so that further institutions must apply DORA from that date.
- BaFin's comparison is a help, not a rulebook. Its October 2024 DORA implementation notes compare DORA with BAIT and VAIT, and BaFin calls them a non-binding aid.
- The work is re-mapping, not rebuilding. Many BAIT and VAIT controls carry over; the gaps sit where DORA asks for more, such as incident classification and reporting, resilience testing and the register of information.
What is changing and why
BaFin's circulars on supervisory requirements for IT (collectively xAIT) interpreted the German organisational duties for each sector: BAIT for banks (Circular 10/2017 (BA), based on § 25a(1) KWG), VAIT for insurers, KAIT for capital management companies and ZAIT for payment and e-money institutions. DORA, Regulation (EU) 2022/2554, now sets EU-wide digital operational resilience requirements for the financial sector and has applied since 17 January 2025. In its January 2025 announcement BaFin gave the reason plainly: to avoid double regulation, it is repealing its circulars.
Two points are easy to miss. First, the repeal does not lower the bar: DORA is directly applicable law with its own technical standards, while the circulars were BaFin's interpretation of national requirements. Second, the circulars remain readable on BaFin's website as reference, which is why policies, audit programmes and contracts still cite them. A reference that remains in place is not a requirement that still applies.
Official timeline and current status
Status as published by BaFin and on the official law portals, checked 8 November 2026. Dates move; confirm against BaFin's current publications before relying on them.
| Date | Event | Source |
|---|---|---|
| 14 December 2022 | DORA, Regulation (EU) 2022/2554, adopted (published 27 December 2022) | EUR-Lex |
| 9 October 2024 | BaFin publishes non-binding implementation notes comparing DORA with BAIT and VAIT, for ICT risk management and ICT third-party risk management | BaFin Aufsichtsmitteilung |
| 16 December 2024 | Updated BAIT (Circular 10/2017 (BA)) issued, effective 17 January 2025 | BaFin, BAIT text |
| 27 December 2024 | FinmadiG published (BGBl. 2024 I No. 438), amending § 1a KWG | recht.bund.de |
| End of 16 January 2025 | KAIT, VAIT and ZAIT repealed; institutions subject to DORA Articles 5 to 15 or Article 16 removed from BAIT scope; BAIT chapter 11 repealed | BaFin announcement, 10 January 2025 |
| 17 January 2025 | DORA applies to financial entities in its scope | EUR-Lex; BaFin |
| 21 August 2025 | BaFin publishes implementation notes for firms using the simplified ICT risk management framework (Article 16) and ICT third-party risk management | BaFin Aufsichtsmitteilung |
| June 2026 | BaFin reports on the 9th MaRisk amendment after consultation 02/2026 | BaFin article |
| End of 31 December 2026 | BAIT fully repealed | BaFin announcement |
| 1 January 2027 | Further institutions must apply DORA under the reworded § 1a KWG | BaFin announcement |
Who and what is affected
| Sector | Former circular | Status | Now anchor on |
|---|---|---|---|
| Banks and other institutions in DORA scope from 2025 | BAIT | Outside BAIT scope since end of 16 January 2025 | DORA and its RTS; MaRisk for general risk management |
| Institutions brought into DORA by § 1a KWG | BAIT | BAIT applies until its full repeal at the end of 31 December 2026 | DORA from 1 January 2027, as set out in § 1a KWG |
| Insurers | VAIT | Repealed end of 16 January 2025 | DORA |
| Capital management companies | KAIT | Repealed end of 16 January 2025 | DORA |
| Payment and e-money institutions | ZAIT | Repealed end of 16 January 2025 | DORA |
The § 1a KWG group: under § 1a(2a) KWG, institutions not in DORA's scope under its Article 2 are made subject to DORA as if they were CRR credit institutions, but with the simplified ICT risk management framework of Article 16 in place of Articles 5 to 15; threat-led penetration testing under Articles 26 and 27 does not apply, and ICT third-party risk requirements under Articles 28 to 30 do not apply to microenterprises. § 1a(2) KWG separately applies DORA to entities named in Article 2(5) No. 5 of Directive 2013/36/EU. These institutions are the ones still working under BAIT now and the ones with the least time left. Check with your legal team which paragraph applies to your entity.
MaRisk: the Minimum Requirements for Risk Management remain a separate BaFin circular for banks, and BaFin reported in June 2026 on its 9th amendment, which reorganises proportionality into three size classes and shortens the text. Check the current MaRisk text for how its IT, emergency management and outsourcing provisions sit beside DORA for your institution rather than assuming either way.
What is affected inside a firm: the information security policy framework, the written IT strategy, internal audit programmes, outsourcing contracts and IT service contracts that reference xAIT clauses, control libraries in GRC tools, board reporting templates, and third-party questionnaires.
Finding affected systems and identities
The inventory is mostly documentary. Search, list and assign owners before you rewrite anything.
- Search the policy estate: search document management and GRC tools for "BAIT", "VAIT", "KAIT", "ZAIT", "10/2017" and xAIT section numbers. Record each hit with owner and document type.
- Control library: export controls whose authority field cites an xAIT requirement; each needs a new DORA or RTS reference, or retirement.
- Contracts: list ICT contracts whose audit, information or termination rights are justified by BAIT outsourcing text. These map to DORA's contractual requirements (Article 30) and the register of information. See the DORA ICT Third-Party Risk and Register of Information Guide.
- Audit plans: internal audit test scripts written against xAIT need rebasing so findings cite applicable law.
- Identities and access: BAIT's identity and rights management requirements drove recertification cycles, privileged access controls and joiner, mover and leaver processes. Re-map these to RTS 2024/1774, whose Articles 20 and 21 cover identity management and access control, and include service accounts, API keys and other non-human identities in the scope. See the Access Reviews Guide and Privileged Access Management Guide.
Migration options
A theme level mapping helps plan the work. It reflects the BAIT and VAIT subject areas and the DORA pillars; use BaFin's implementation notes for the detailed comparison.
| xAIT theme | DORA anchor | Typical change |
|---|---|---|
| IT strategy and IT governance | Article 5 governance; management body bears ultimate responsibility for ICT risk | Board approval of the ICT risk framework, digital operational resilience strategy and ICT budget |
| Information risk and information security management | ICT risk management framework (Articles 5 to 15, or Article 16) and RTS 2024/1774 | Re-reference policies; add DORA-specific elements |
| Operational information security; identity and rights management | RTS 2024/1774 identity and access articles | Extend recertification and privileged access controls to non-human identities |
| IT projects, development, IT operations | ICT risk management framework and RTS | Change and patch management evidence re-labelled |
| Outsourcing and other external IT services | Articles 28 to 30; register of information | Contract remediation and register upkeep |
| IT emergency management | ICT business continuity and response and recovery within the framework | Scenario testing and recovery objectives |
| No direct xAIT equivalent | Major ICT incident classification and reporting; resilience testing; TLPT where designated | New processes (see the DORA Major ICT Incident Reporting Guide) |
- Option 1, re-reference in place: keep the existing control set and swap authorities. Fast and low disruption; fits firms whose xAIT implementation was mature. Risk: controls written for the circulars miss DORA-only requirements.
- Option 2, rebuild on DORA: derive the control set from DORA and the RTS, then map legacy evidence in. Slower but cleaner; fits firms that also need ISO 27001 or NIS2 mappings. See the ISO 27001 to NIS2 and DORA Mapping Guide.
- Option 3, hybrid: re-reference the controls that map cleanly and rebuild the weak areas (incident reporting, testing, third-party register). The common choice.
Small versus large: firms on the Article 16 simplified framework, including the § 1a KWG group, should start from BaFin's August 2025 notes on the simplified framework and avoid over-engineering; larger institutions with TLPT exposure need the full framework and a testing programme.
Testing and rollback
- Dual mapping period: for institutions still under BAIT, map each control to both BAIT and DORA until the end of 31 December 2026, so audit can test either way.
- Walkthroughs: have internal audit or the second line walk through the re-mapped framework on a sample of controls per theme before year end.
- Evidence test: for each DORA requirement, confirm that the evidence a supervisor would ask for exists and is current, not just that a control is mapped.
- Rollback: keep the archived xAIT mapping version-controlled. If a mapping is challenged, you can show the previous basis and the date of change.
Measures that show progress: the number of live documents still citing xAIT (target zero by year end), the share of controls carrying a DORA or RTS reference, the share of ICT contracts reviewed against Article 30, the completeness of the register of information, and the share of identity controls (human and non-human) mapped to the RTS access articles.
Risks of doing nothing
- Citing a repealed basis: policies and audit findings that rest on repealed circulars weaken the governance record and confuse supervisory dialogue.
- Missing DORA-only duties: incident classification and reporting, the register of information and resilience testing had no full xAIT equivalent.
- The 2027 cliff: institutions in the § 1a KWG group lose their BAIT basis at the end of 2026 and must apply DORA from 1 January 2027, with no gap in between.
- Identity drift: access controls tied to BAIT wording may never be extended to service accounts and API keys that DORA's ICT asset view captures.
Practitioner checklist
- Confirm which group your entity belongs to: DORA since 17 January 2025, or DORA from 1 January 2027 under § 1a KWG.
- Search all policies, contracts, control libraries and audit plans for xAIT references and assign owners.
- Download BaFin's October 2024 implementation notes (and the August 2025 notes for Article 16 firms) and use them as the gap list.
- Choose re-reference, rebuild or hybrid per theme and record the decision.
- Re-map identity and access controls to RTS 2024/1774, including non-human identities.
- Stand up or confirm major ICT incident reporting and the register of information.
- Run a pre year end walkthrough so the BAIT repeal on 31 December 2026 is a non-event.
- Check the current MaRisk text after the 9th amendment for provisions that still apply beside DORA.
Standards and references
- EUR-Lex: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)
- BaFin: DORA kommt, Änderungen bei den aufsichtlichen Anforderungen an die IT
- BaFin: Umsetzungshinweise zu DORA (Aufsichtsmitteilung)
- BaFin: Hinweise zur Umsetzung von DORA mit vereinfachtem IKT-Risikomanagementrahmen (Artikel 16)
- Gesetze im Internet: § 1a Kreditwesengesetz
- Bundesgesetzblatt: Finanzmarktdigitalisierungsgesetz (FinmadiG)
- BaFin: Circular 10/2017 (BA), Supervisory Requirements for IT in Financial Institutions (BAIT)
- BaFin: MaRisk schaffen mehr Spielraum für Banken
Related NHI Mgmt Group resources: DORA Guide · DORA Readiness Checklist · EBA ICT and Security Risk Guidelines Guide · DORA and NIS2 Overlap Mapping Guide. This guide summarises the BaFin repeal of BAIT, VAIT, KAIT and ZAIT and the move to DORA and is not legal advice.