Thursday, 29 October 2026
Ten investment management companies in Germany have established a new association to coordinate the assessment of cybersecurity risks involving external technology providers. The organisation, Digital Operational Resilience and Cyber Risk Association (DORCA), brings together financial institutions, including several active in European real estate investment, to address regulatory requirements and reduce the duplication of technology-related compliance work.
The association was formed during the summer of 2026 following the introduction of the European Union’s Digital Operational Resilience Act, which has applied since January 2025. The legislation establishes requirements for financial institutions to manage risks arising from information technology, including system failures, cyberattacks and disruptions affecting companies that provide essential digital services. Investment fund managers falling within the regulation’s scope must demonstrate that appropriate arrangements are in place to identify, assess and respond to these risks.
One area covered by the legislation concerns the supervision of external technology suppliers. Financial institutions frequently use third-party systems for accounting, investor reporting, transaction processing, document management and other administrative activities. Where several companies rely on the same supplier, separate assessments can involve examining similar systems, procedures and security arrangements. The new association intends to coordinate certain reviews and allow participating organisations to use the resulting information.
The arrangement makes use of provisions within the European regulatory framework that permit financial institutions to cooperate when examining external technology providers. Members will be able to share findings from jointly organised assessments while maintaining their own responsibility for evaluating the risks associated with the services they use. The association also intends to facilitate exchanges of information concerning cybersecurity threats and operational vulnerabilities.
The founding members are Aachener Grundvermögen Kapitalverwaltungsgesellschaft, Allianz Global Investors, Catella Real Estate, Art-Invest Real Estate Funds, BNP Paribas REIM Germany, Helaba Invest, mondial Kapitalverwaltungsgesellschaft, Monega Kapitalverwaltungsgesellschaft, Universal-Investment-Gesellschaft and Warburg Invest Kapitalverwaltungsgesellschaft. The association’s board comprises representatives of Aachener Grundvermögen, Allianz Global Investors and Catella Real Estate.
Several participating companies are involved in managing property investment funds and institutional real estate portfolios. Their activities depend on technology systems supporting financial administration, property valuations, investor communications and regulatory reporting. Interruptions to these services can affect the management of investment vehicles even when the underlying properties continue operating normally.
For property fund managers, the regulatory requirements introduce additional considerations when selecting and supervising technology suppliers. External providers may handle financial records, confidential investor information and operational data relating to property portfolios. Assessing their security arrangements is therefore relevant to both regulatory compliance and the continuity of fund management activities. Cooperation between investment managers may reduce repeated assessments, although each institution remains responsible for determining whether its own arrangements meet regulatory requirements.
The financial implications of the initiative have not been quantified. The association has not disclosed its operating budget, membership contributions or the number of supplier assessments expected to be conducted. It has also not published evidence of cost reductions resulting from joint examinations. Any financial benefits will depend on how the cooperation is organised, the number of participating institutions and the extent to which members use common technology providers.
Although all ten founding companies are based in Germany, membership is available to investment management organisations elsewhere in Europe. This could allow the initiative to extend beyond the German market, particularly where financial institutions operating in different countries rely on the same external service providers. No additional European members have been announced.
The establishment of the association reflects the growing regulatory attention given to technology risks within investment management. For European real estate funds, cybersecurity and the reliability of external systems are becoming part of the broader framework governing financial operations and investor protection. The effectiveness of the new arrangement will depend on the assessments undertaken, the information shared between members and how individual companies incorporate the findings into their own risk management procedures.
