The Digital Operational Resilience Act ("DORA") - Impact on Swedish and Norwegian AIFMs

October 11, 2024

The Digital Operational Resilience Act (Regulation (EU) 2022/2554), aims to address the increasing reliance on Information and Communication Technology (ICT) in the financial sector and its associated risks. The regulation will apply as of 17 January 2025 in the EU and is expected to be adopted in Norway where timeline is unclear. AIFMs and other affected financial entities should start their preparations.

Digitalization has deeply integrated ICT into financial services, making systems more vulnerable to cyber threats. Despite various international and national efforts to enhance digital resilience, ICT risk management remains inconsistent across the EU. The lack of harmonization creates regulatory gaps between member states and challenges for cross-border financial entities. DORA introduces a comprehensive EU-wide regulation to consolidate ICT risk management, ensuring a uniform approach that strengthens operational resilience, stability, and consumer protection in the financial sector. DORA will apply to financial entities, including authorised alternative investment fund managers (AIFMs), but excludes sub-threshold AIFMs as defined in Article 3(2) of Directive 2011/61/EU. Article 4 of DORA introduces a principle of proportionality, promoting a risk-based approach to implementing certain parts of the regulation. Permian recommends that AIFMs take the principle of proportionality into consideration when implementing all parts of DORA.

 

AIFMs and other affected financial entities in Sweden have just a few months left to ensure compliance with the regulation. Swedish AIFMs must comply with DORA requirements once the regulation applies in the EU.

The Norwegian Ministry of Finance has proposed to adopt DORA into Norwegian law however the exact timeline remains unclear.


Key substantial requirements

DORA introduces a comprehensive set of requirements for financial entities. The following key issues are central to the regulation.
 

ICT Risk Management

DORA chapter II, Articles 5 to 16 mandates that financial entities establish robust risk management tools, methods, processes, and policies. The chapter outlines several key requirements for financial entities, including but not limited to:

  • Structuring their organization and internal governance effectively.
  • Establishing an ICT risk management framework as a part of their overall risk management system.
  • Utilizing and maintaining ICT systems, protocols, and tools.
  • Identifying, classifying, and adequately documenting all ICT-supported business functions, roles, and responsibilities.
  • Adequately protecting ICT systems and organizing response measures.
  • Promptly detecting and responding to anomalous activities.
  • Implementing a comprehensive ICT business continuity policy.
  • Ensuring the restoration of ICT systems and data with minimal downtime, disruption, and loss.
  • Gathering information on vulnerabilities, cyber threats, and ICT-related incidents, particularly cyber-attacks, and analysing their potential impact on digital operational resilience.
  • Facilitating the responsible disclosure of major ICT-related incidents or vulnerabilities to clients, counterparts, and, where appropriate, the public.


ICT-related incident management and digital operational resilience testing

DORA chapter III, Article 17 to 23 and Chapter IV, Article 24 to 27 regulate issues such as ICT-related incident management and digital operational resilience testing. The chapters outline several key requirements for financial entities, including but not limited to:

  • Financial entities shall establish processes to detect, manage, and notify ICT-related incidents.
  • All ICT-related incidents and significant cyber threats must be recorded, and root causes must be identified and addressed.
  • Financial entities must report major ICT-related incidents to relevant competent authorities using standard templates. Financial entities must also inform clients affected by major incidents and provide appropriate guidance for significant cyber threats.
  • Financial entities must implement a comprehensive digital operational resilience testing program as part of their ICT risk management framework. This program helps assess preparedness for ICT-related incidents and identify weaknesses. Testing should be risk-based, considering the evolving ICT landscape.
  • The digital operational resilience testing program shall provide, in accordance with the risk-based approach, for the execution of appropriate tests, such as vulnerability assessments and scans, open-source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.


Managing ICT Third-Party Risk

DORA chapter V, Articles 28 to 44 elaborates on the key principles for a sound management of ICT third-party risk and oversight framework of critical ICT third-party service providers. The chapter outlines several key requirements for financial entities, including but not limited to:

  • Financial entities must adopt and regularly review an ICT third-party risk strategy, including a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers.
  • Maintain a detailed register of all contractual arrangements on the use of ICT services provided by ICT third-party service providers. Report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided. (In a consultation (Sw. remiss) published by the Swedish FSA 5 September 2024, the proposed date of first filing of the register of contractual arrangements is 28 February 2025. Since the template contractual arrangement register is not yet adopted by the EU Commission, it remains to be seen which date that will apply. Several respondents to the consultation have requested a delayed first reporting.)
  • Before entering into contracts, financial entities must: assess if the contractual arrangement covers the use of ICT services supporting a critical or important function, ensure compliance with supervisory conditions, identify and assess all relevant risks and conflicts of interest in relation to the contractual arrangement, perform due diligence on third-party providers and assess if the ICT third-party service provider is suitable.
  • Financial entities may only enter into contractual arrangements with providers that meet appropriate information security standards, especially for critical functions.
  • Establish a risk-based approach for audits and inspections of third-party providers, ensuring auditors have the necessary skills.
  • Contractual arrangements must include conditions for termination in case the ICT third-party service provider commits a significant breach of applicable laws or contractual terms, performance issues, or regulatory supervision challenges.
  • Develop exit strategies for contractual arrangements on the use of ICT services supporting critical or important functions to avoid disruption during transitions.


Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS)

The regulation has been specified and clarified by several Draft Regulatory Technical Standards (RTS) and Draft Implementing Technical Standards (ITS) that have been released in different tranches by European Supervisory Authorities. These draft technical standards have yet to be adopted by the European Commission. 


The proportionality principle in Article 4 and relevance for AIFMs

Article 1 of DORA establishes that the regulation's requirements primarily target financial entities. A more detailed definition of "financial entities" is provided in Article 2, which also specifies which entities are exempt from its scope. This definition includes, among others, AIFMs. However, DORA Article 2(3) explicitly exempts sub-thresholds AIFMs (i.e. managers that are only registered and not authorised are exempt).

Article 4 introduces a principle of proportionality. Article 4(1) addresses the proportionate implementation of Chapter II. According to Article 4(1), the implementation of Chapter II by financial entities must adhere to the principle of proportionality, taking into account their size, overall risk profile, and the nature, scale, and complexity of their services, activities, and operations.

Similarly, Article 4(2) states that the application of Chapters III, IV, and (V, Section I), must also be proportionate to the financial entities' size, overall risk profile, and the nature, scale, and complexity of their services, activities, and operations, as specifically provided for in the relevant rules of those Chapters. While this provision is similar to Article 4(1), it differs by requiring that proportionality considerations align with the specific rules outlined in those Chapters.

Financial entities classified as 'Microenterprises,' as defined in Article 3, remain within the scope of DORA but are exempt from certain requirements outlined in the regulation. In brief, a microenterprise is a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million.


The way forward for AIFMs in a DORA-regulated world

To ensure compliance with the DORA, it is essential to start by providing high-level training to the board and key staff. We recommend that a designated individual is appointed to oversee the implementation of DORA. Relevant personnel, including those in legal, compliance, risk management, IT, and the board, must be actively involved in the process.

As a next step a gap analysis could be prepared to identify areas needing improvement. Based on the analysis, a detailed action plan could be developed.

Key governance measures must be put in place, including the establishment of an internal ICT risk governance structure and the updating of relevant policies as required by Chapter II. Additionally, an ICT-related incident management process should be implemented in accordance with Chapter III. Digital operational resilience testing, as outlined in Chapter IV, needs to be introduced, along with the management of ICT third-party risk, as specified in Chapter V.


The DORA implementation in the internal control system of the manager could either be done by updating policies that are already in place (e.g. outsourcing policy, risk policy) or to prepare a new set of DORA policies.

It is crucial to report progress back to the board before DORA comes into force 17 January 2025 since DORA assigns the overall responsibility for ICT resilience on the board. The board should also adopt the updated policies.

One of the first steps after the DORA application date is the filing of the AIFM’s register of ICT contractual arrangements. The deadline for the filing is yet to be decided upon by the Swedish FSA, but as mentioned above under the section Managing ICT Third-Party Risk, the proposed deadline is 28 February 2025.

After the implementation of DORA, we also expect compliance officer, risk manager, or internal audit team to be tasked conducting a control assessment of the implementation to verify that all DORA requirements have been met.

 

Contact

Anna Berntson Petas, Head of Legal and Compliance anna.berntson@permian.se

Erik Elkan, Risk Manager erik.elkan@permian.se

Samuel Hörberg Delac, Legal Counsel samuel.delac@permian.se

March 4, 2026
London, Luxembourg 04 MARCH 2026 PANDOO, Highvern and Permian (the “Group”) are pleased to announce the signing of binding agreements to combine the businesses, with the continued backing from Jacobs Capital. This partnership represents a significant milestone in the Group’s strategy to expand into key strategic markets and further consolidates its position as a leading international provider of fund services and private capital solutions, following Jacobs Capital’s investment to combine Highvern and Permian in 2025. PANDOO’s senior management will reinvest alongside Jacobs Capital and existing Highvern and Permian shareholders. Founded in 2009 by Charles Meyer, PANDOO is a leading independent Luxembourg-based provider of administration and management services for investment vehicles, offering a fully integrated, end-to-end platform for alternative investment structures. It brings proven Luxembourg expertise, an established and growing client base, and a reputation for high-quality client service. The newly combined Group will operate in nine jurisdictions with over 400 employees. This provides clients with greater choice and immediate access to Luxembourg, Europe’s leading alternative investment fund market, complementing the Group’s existing footprint including the Cayman Islands, Guernsey, Ireland, Jersey, Norway, South Africa, Sweden and the UK, and supporting accelerated organic growth. Clients will also have access to broader asset class expertise, including PANDOO’s experience in high-growth sectors such as real estate, real asset structures and private debt, alongside private equity and venture capital. Together, the businesses share a strong client-centric approach and a commitment to service quality, underpinned by ongoing investment in people and technology. The combined Group increases scale and international reach, bringing together highly skilled and specialist teams with closely aligned cultures and shared values. This positions the Group to better address increasingly complex client needs, deliver consistent service excellence, and support long-term sustainable growth. Subject to regulatory approvals, the transaction is expected to close in the second half of 2026. Martine Grün, John Wantz, Sven Rein, Partners at PANDOO, said: "We are excited to join forces with Highvern and Permian. Jacobs Capital is the right partner for us – they understand our culture, invest for the long term and empower entrepreneurial teams. Together, we share a strong focus on client service, agility and ownership, which will enable seamless collaboration from day one. Our Luxembourg expertise will thrive within this broader international platform. We thank our dedicated team and valued clients for their trust and support as we embark on this exciting journey together." Caroline Connellan, Group CEO at Highvern & Permian, said: “We are delighted to welcome PANDOO to the Group. Our partnership brings together highly skilled people and complementary businesses with closely aligned cultures and shared values. As a Group, we have an exciting opportunity to offer clients greater choice across asset classes and jurisdictions, while continuing to deliver the service standards they expect. We are very much looking forward to working with the PANDOO team.” Johan Pettersson, Head of Business Services at Jacobs Capital, said:  “We see the combination of PANDOO with Highvern and Permian as an important step towards building a next-generation, truly international, differentiated platform for fund services and private capital solutions. We are grateful for the opportunity and trust given to us to support PANDOO in its future strategy and will continue to invest in its people, technology and service excellence.” Media contact 
February 25, 2026
For many fund managers, ESG data collection started as an afterthought rather than a structured operational process. How ESG data is collected is often a clear indicator of how seriously a fund approaches ESG. And under the Sustainable Finance Disclosure Regulation (SFDR), it is no longer a nice-to-have. In this article, Permian’s ESG Director Agata Bremer outlines the typical stages of ESG data maturity, the practical challenges funds face at each step, and what a more sustainable set-up looks like. "For many in the alternative investment industry, ESG reporting started as an afterthought: a spreadsheet here, an email there, a template dropped into SharePoint the week before an LP request landed. That approach worked when ESG was a nice-to-have. Under SFDR, it no longer does. The margin for error is much smaller, and manual processes break down quickly", says Agata. The four stages of ESG data maturity Most fund managers fall somewhere along a spectrum from fully manual to fully integrated, according to Agata. Understanding where you are positioned matters, because the risks and costs of staying put differ significantly at each stage. Stage 1: Spreadsheets and email Excel trackers, Google Sheets, and ESG data collected via email from portfolio companies. This is where most funds start. The setup is simple and flexible, but manual entry increases errors, audit trails are weak, and tracing data back to source quickly becomes painful. Stage 2: Standardised templates in cloud storage Structured questionnaires stored in SharePoint or OneDrive improve consistency and version control. Internal coordination improves, but the process remains manual. Each reporting cycle requires consolidation, follow-ups, and significant hands-on effort, which limits scalability. Stage 3: ESG software platforms Dedicated ESG tools centralise data collection, automate aggregation, and create an audit trail. For many mid-size PE and VC funds with SFDR Article 8 obligations, this is a logical next step. The limitation is that platforms only work well if roles, timing, and data ownership are already clearly defined. Stage 4: Integrated ESG data infrastructure ESG data collection is embedded into the broader fund administration and portfolio monitoring setup. Reporting is largely automated, and regulatory defensibility is stronger. This stage requires more upfront investment but delivers the highest level of control and efficiency. This is where we see large PE firms and multi-fund managers heading, but it requires mature internal processes and meaningful investment before the benefits land. Where problems usually arise According to Agata, ESG reporting issues are rarely caused by technology. “The real problems are almost always about process and ownership,” she says. Common failure points include collecting data only once a year under time pressure, unclear responsibility for chasing and validating data, and expanding reporting scope without a clear data structure to support it. A realistic way to improve Funds don’t need fully integrated infrastructure immediately. What matters is sequencing. “Start by defining exactly which ESG metrics are required and why. Then standardise how those metrics are collected, even if that still happens in spreadsheets. Only once the data flow is stable does it make sense to introduce software or broader system integration,” Agata explains. “The tool matters less than the discipline behind it,” she concludes. “A simple, well-run process will always outperform a sophisticated system that’s poorly implemented.” Need support? At Permian, we support alternative investment fund managers in building ESG data processes that stand up to SFDR requirements and scale with portfolio complexity. Get in touch to discuss how your current ESG data setup can be strengthened and scaled.
February 16, 2026
As regulatory pressure increases and non-financial risks become critical, fund managers face higher expectations on governance and resilience. Erik Elkan, Risk Manager at Permian in Sweden, discusses the changing role of risk and how Permian in Sweden supports managers through this shift. Erik, you work with risk management for Permian in Sweden. Can you tell us a bit more about your area? At Permian, we work with Swedish Alternative Investment Fund Managers (AIFMs) that have outsourced their risk management function to us. Our specialist team covers all risk requirements under laws such as AIFMD, AIFMR, and relevant local regulation, acting as designated risk managers. We work across different asset classes and fund structures, providing both strategic guidance and regular oversight. What are the main risk-related challenges fund managers face today? Fund managers operate in an environment where risks are more diverse and fast-moving than ever. Cybersecurity and third-party dependencies remain critical, while ESG and climate-related expectations are rapidly intensifying. At the same time, new frameworks such as the Digital Operational Resilience Act (DORA) and upcoming AI Act are reshaping operational risk requirements. How do your risk management services support clients? We help fund managers stay ahead by continuously updating risk frameworks, integrating risk awareness and operational resilience into their systems, and ensuring that both governance and reporting withstand regulatory scrutiny. Permian offers a complete, ready-to-implement risk management function that integrates directly into a fund manager’s governance framework. We follow an annual risk management plan, complemented by ad-hoc assessments as needed, to support regulatory compliance and operational resilience. Our services include risk policies and procedures reviews, regulatory monitoring, risk assessments for funds and manager, and stress testing, as well as regular board reporting. Our approach combines tailored models across key risk areas with structured reporting to senior management, making risk management efficient, transparent, and aligned with supervisory expectations. Why do fund managers choose Permian as their risk partner? Our clients partner with Permian for access to an established framework, specialised tools, and a multidisciplinary risk team that can scale with their business. This allows fund managers to focus on investment performance while maintaining strong regulatory control. Looking ahead, how do you see the risk landscape evolving? Technology such as AI, data analytics, and automation will increasingly shape how risks are identified and managed. Non-financial risks and geopolitical uncertainty affecting market risk are moving to the forefront alongside tighter regulatory expectations. In this environment, fund managers need a trusted, long-term risk partner who understands the full scope of risk management. At Permian, we are preparing for this shift by developing scalable, technology-supported risk frameworks grounded in regulatory expertise and backed by professionals with deep insight into both regulation and business reality. With a fully outsourced function, we act as a trusted professional with a clear understanding of the evolving risk landscape. Read more about our Risk Management Services here.
February 9, 2026
Permian is pleased to welcome Abiram Soma and Henrik Granheim-Sætre as new members of our Advisory team. Their combined experience will further strengthen Permian’s legal and compliance capabilities as we continue to grow and support our clients. Abiram Soma joins Permian as Legal Counsel, most recently from Infranode. He brings several years of experience working with investments, real estate transactions, lease matters, and regulatory matters, with a background from top-tier law firms. Abiram will be based in our Stockholm office. Henrik Granheim-Sætre joins Permian as Senior Legal Counsel. Before joining Permian, Henrik served as Senior Legal Counsel at Danske Invest Asset Management AS, and brings prior experience from the banking sector. He has ten years of experience within legal and regulatory advisory. Henrik will be based in our Oslo office. We are delighted to have Abiram and Henrik on board and look forward to working together.
February 2, 2026
Fam Dang, new Team Leader for Accounting in Norway shares reflections on why accounting is about more than “just” numbers.
By Adam Brodin January 12, 2026
Felix Edgren has joined Permian as Country Head Sweden and Head of Fund Administration & Accounting, effective 12 January. His appointment forms part of the combined Permian and Highvern Group . Felix brings extensive experience from asset servicing, capital markets and fund administration. He joins Permian from Apex Group, where he held several senior leadership roles, including Country Head Sweden and Regional Head Corporate Solutions Nordics. Prior to this, he held senior positions at Nordic Trustee, TMF Group and Intertrust Group. Felix has experience working across the Nordics and Luxembourg. Johanna Bjenne, Interim Country Head Sweden and Head of Fund Administration & Accounting, says: “We are very happy to welcome Felix to the team. His operational and strategic experience, deep understanding of the Swedish market, and client-focused leadership make him well equipped to support our continued growth in Sweden while further strengthening the quality and delivery of our fund services.” Commenting on his new role, Felix says: “Permian holds a leading position in the Nordics, and I’m excited to be joining Permian and Highvern as we continue to expand in capacity and scale. I look forward to contributing to the team and continuing delivering best-in-class services to our clients in Sweden.” Johanna Bjenne will transition back to her role as Head of Fund Operations, Onshore.
December 10, 2025
Permian and Highvern, together with Jacobs Capital, announce the appointment of Caroline Connellan as Group Chief Executive Officer.
Permian's new office at Jakobsbergsgatan 17.
December 9, 2025
To support Permian’s continued growth, its expanding Nordic client base, and its long-term commitment to providing best-in-class fund services, the company has relocated from Vasagatan 36 to new offices at Jakobsbergsgatan 17 in the Mood District. The new premises at Jakobsbergsgatan offer a modern and flexible workplace that accommodates Permian’s nearly 70 employees in Sweden. The office features expanded meeting facilities, improved collaboration areas, and increased workstation capacity to support the company’s continuously growing team and cross-border operations. “Alongside our mission to deliver high-quality services to our clients, our new office gives us room to scale and welcomes focused work as well as innovative and meaningful conversations with partners, clients, and colleagues. A huge thank you to everyone who has been part of this journey so far,” says Johanna Bjenne , Country Head, Sweden. The new office is fully operational. Updated contact details are available on Permian's website under "Contact".
November 19, 2025
As the global fund landscape evolves, cross-jurisdiction collaboration is becoming essential. For the newly combined Highvern and Permian group, that momentum begins with Ireland and the Nordics, where teams are already working together to strengthen onshore fund services and deliver seamless, client-focused solutions across eight jurisdictions: Ireland, Sweden, Norway, Jersey, Guernsey, the UK, South Africa, and the Cayman Islands. Country Heads Emma Keane (Ireland), Johanna Bjenne (Sweden), and Susanne Berge-Hansen (Norway) share insights on how the unified group – now over 300 colleagues with $45bn in assets under administration – is creating value for clients through integrated expertise and a connected, multi-jurisdictional platform. Strength across borders Emma Keane (EK): What makes clients look outside Sweden or Norway when setting up structures in other jurisdictions? Johanna Bjenne (JB): For Swedish managers, it’s a mix of access to capital, tax considerations and investor comfort. Many institutional investors are used to Ireland or Luxembourg structures, so being able to offer that option through the same group helps facilitate a seamless solution. It’s not just a tax discussion anymore - it’s about investor confidence, reputation, and long-term visibility. Susanne Berge Hansen (SBH): It’s similar in Norway. Managers want stability and regulatory consistency. By working closely with our Irish colleagues, we can compare and combine options to find the best fit for each client. The fact that this can now happen within the same organisation makes a big difference - it’s faster, simpler, and built on shared trust. EK: Clients increasingly expect that continuity. Having Ireland, Sweden, and Norway as well as our offshore offering in Jersey, Guernsey and Cayman under one group allows us to offer local presence and international reach in a single connected network of expertise. Enhancing expertise & innovation EK: We’ve already seen teams working more closely together since the integration. How is that translating into client opportunities right now? SBH: It’s already changing how we think. For example, Highvern’s Irish team has deep experience in areas like debt and private credit, while our Nordic clients are exploring those same asset classes. We can now bring that knowledge straight into client discussions, rather than learning from scratch. JB: Yes and on our side, we’re supporting more clients who want digital access and data visibility. As part of a larger group with shared technology development, we’re now able to offer those tools faster. It’s a real, practical benefit that’s happening today. EK: And it’s two-way. We’re learning from the Nordic teams’ approach to client engagement -that mix of precision and partnership. You can already feel that shared energy across our teams. Having recently been successful on a pitch, referred from our Permian colleagues, for a Swedish manager looking to launch an Irish ICAV for their royalties’ fund, demonstrating not only the further jurisdictional reach but also the depth of expertise between both teams, the client was able to feel the benefit from the outset of the relationship. JB: At Permian, our values - caring, precise, and challenging - are really lived day to day. Joining a bigger group always raises questions about culture. How do you see that playing out? SBH: The key is that our values align. Highvern’s focus on quality, integrity, and client service mirrors what we’ve built at Permian. That means collaboration feels natural, you could see how quickly people connected - same mindset, just different accents! EK: That’s so true. The offsite really confirmed how strong that alignment is. Everyone’s ambitious but grounded, and that balance is what will help us scale without losing who we are. Impact for clients EK: Looking at the market today, what are the biggest topics your clients are focused on? JB: There’s a lot of attention on AIFMD II and ESG reporting. Clients want administrators who can not only comply but also help interpret what’s coming. Having a bigger, connected group means we can share insights and act faster when new regulation lands. SBH: Governance and data transparency are also high on the agenda. Clients expect partners who can combine strong regulatory understanding with modern digital delivery - and that’s exactly where we’re investing together as a group. EK: We’ve become one group with a shared purpose, and clients are already seeing the benefits - broader expertise, deeper resources, and a network that connects Ireland, the Nordics, and beyond. Not only does this extend to our Highvern and Permian colleagues, but also our strong network of intermediary relationships in each jurisdiction to help meet our clients needs. JB: It’s an exciting time. We’re not talking about a distant future - the collaboration is happening now, and it’s energising our teams and clients alike. You can feel the momentum. With a shared purpose and connected teams, we are already delivering enhanced onshore fund expertise, deeper resources, and seamless solutions for our clients – today and into the future.
November 6, 2025
As ESG regulation becomes a central part of the investment ecosystem, fund administrators take on a broader role. Agata Bremer, ESG Director at Permian, reflects on how this development builds on the existing strengths of fund administration — why administrators are uniquely positioned to deliver ESG services, and what it takes to adapt.
More Posts