Defining business functions is a central requirement under the Digital Operational Resilience Act (DORA). As part of building your ICT risk management framework, you must identify the business functions your organization performs, determine their criticality, and map their dependencies. This exercise is essential because functions are the anchor point for risk assessment, impact analysis, and reporting.
To give you a head start, we have prepared an illustrative example of how the business functions of a venture capital (VC) fund manager could be defined, based on the functional requirements of the Alternative Investment Fund Managers Directive (AIFMD). Please note that this example is provided for illustration purposes only. Each organization must carefully define its own business functions according to its unique operating model, strategy, and regulatory perimeter.
01
i. core aifmd functions
- portfolio management Executing investment decisions in startups and growth companies, including sourcing, due diligence, structuring deals, monitoring portfolio performance, providing governance input, and planning exits.
- risk management Independently identifying, monitoring, and controlling risks such as startup failure, sector concentration, and liquidity exposure, setting limits, and performing stress tests to ensure compliance with fund mandates and AIFMD requirements.
02
ii. operational and administrative functions
- administration of the aif Managing the operational backbone of the fund, including fund accounting, legal administration, record-keeping, capital calls and distributions, investor registers, reporting, and audit coordination.
- valuation Establishing consistent and independent valuation procedures for illiquid equity holdings, performing periodic valuations, and ensuring independence from portfolio management or engaging an external valuer as required under AIFMD.
- depositary oversight Ensuring safekeeping of fund assets through an appointed depositary that monitors cash flows, verifies ownership, and supervises subscriptions, redemptions, and distributions.
04
iv. governance, compliance, and oversight functions
- regulatory compliance Ensuring adherence to AIFMD and related obligations, including Annex IV reporting, AML/KYC, GDPR compliance, conflict-of-interest management, and monitoring leverage and liquidity policies.
- delegation oversight Monitoring and controlling outsourced functions such as administration, valuation, or risk, conducting due diligence on providers, and ensuring the AIFM retains responsibility and is not reduced to a “letter-box entity.”
- organisational requirements and internal controls Maintaining robust governance structures, adequate human and technical resources, secure systems, accounting and record-keeping, and effective continuity and internal control measures.
05
Closing note
This example shows how business functions of a VC fund manager can be logically grouped and described under the AIFMD framework. In the DORA context, such definitions provide the blueprint for ICT risk management. Remember: this list is illustrative only. Every organization must carefully define its own business functions, aligned to its specific activities, operating model, and regulatory obligations.
Originally published on DORA Solutions Insights.