Licensed by the Estonian FIU · FIU000117Registry code 12233761Operating since 2014Punane 6, Tallinn 13619

info@micaconsult.com+372 5089565

EN · ET · RU · DE · PL · FI · UA · FR · NL · SV · PT · DA · NO · CS

LexorCorp Global

Ordered and paid online

Regulatory infrastructure and compliance: DORA, banking partners and audits

The infrastructure a regulated company needs after — and alongside — its authorisation: ICT risk management under DORA, introductions to banking and payment partners, and internal compliance audits.

In short

Compliance for regulated firms: DORA ICT risk framework, banking and payment introductions, and compliance audits. The price is from €1,800, excluding VAT. How long it takes: DORA framework 8–12 weeks; introductions 2–6 weeks depending on the partners; audits 3–8 weeks.

The documents that are prepared

A DORA project delivers:

  • a gap analysis
  • the ICT risk management framework and policies
  • the incident classification and reporting procedure
  • the testing programme
  • the third-party risk policy with a contract clause checklist
  • the first register of information

What LexorCorp does

  • analyse where your firm stands against the requirement
  • draft the documents listed above
  • deliver them with the evidence of what was checked
  • for banking and payment partners: prepare your introduction file — the partner alone decides

What you do

  • name the owner of each control in your firm — we do not replace your compliance officer or management board
  • give us the information on your ICT systems, providers and contracts that the documents describe
  • decide on banks and payment partners yourself; their decisions and fees are theirs

What the authority does

The authority is your own supervisory authority — these services are delivered to your firm; there is no application to an authority.

  • under DORA every financial entity keeps a register of all contractual arrangements for ICT services provided by third parties, makes it available to the authority on request and reports at least yearly on new arrangements
  • your supervisor assesses your firm, not our documents: we do not guarantee any supervisory outcome

Timeline

These are projects for your firm, not applications, so no authority's period applies. We confirm the delivery time for the scope you choose in writing before the work starts.

Our fee

Usual time: DORA framework 8–12 weeks; introductions 2–6 weeks depending on the partners; audits 3–8 weeks. This is what it usually takes, not a promised date.

ServicePrice
ICT and operational resilience
DORA ICT risk management framework and tooling (Regulation (EU) 2022/2554)Fee for the standard scope — ordered and paid onlinefrom €39,500
DORA register of information — annual updateFee for the standard scope — ordered and paid onlinefrom €2,400 / year
Banking and payment accounts
Extended banking onboarding — introductions to 6 banking and payment partnersFee for the standard scope — ordered and paid onlinefrom €3,900
Premium banking onboardingFee for the standard scope — ordered and paid onlinefrom €5,600
Introduction to a crypto-friendly e-money institutionFee for the standard scope — ordered and paid onlinefrom €2,200
Multi-currency IBAN account set-upFee for the standard scope — ordered and paid onlinefrom €2,800
Card issuing / BIN sponsor introductionFee for the standard scope — ordered and paid onlinefrom €4,500
Compliance audits
Compliance audit — Class 1 scope (internal compliance review, not a statutory financial audit)Fee for the standard scope — ordered and paid onlinefrom €8,500
Compliance audit — Class 2 scope (internal compliance review, not a statutory financial audit)Fee for the standard scope — ordered and paid onlinefrom €15,500
Compliance audit — Class 3 scope (internal compliance review, not a statutory financial audit)Fee for the standard scope — ordered and paid onlinefrom €27,000
Remediation plan after a compliance auditFee for the standard scope — ordered and paid onlinePrepared for your company: usually delivered within 7 working days after we have received the necessary information.from €1,700
GDPR compliance documentation for an Estonian companyFee for the standard scope — ordered and paid onlinefrom €1,800
AML and KYC procedures and documentation for an Estonian companyFee for the standard scope — ordered and paid onlinefrom €2,500

This price is our professional fee for the corporate and regulatory work described. It is not the price of a licence and does not include state or supervisory fees, regulatory capital, or third-party costs. The authorisation is granted by the competent supervisory authority.

Order

State fees

No state fee is charged for these services. Fees of banks, payment institutions, software and data providers are third-party costs and are charged by them.

What is not included in our fee

We do not guarantee any account, partner decision or supervisory outcome, and we do not replace your compliance officer or management board.

This price is our professional fee for the corporate and regulatory work described. It is not the price of a licence and does not include state or supervisory fees, regulatory capital, or third-party costs. The authorisation is granted by the competent supervisory authority.

Our own licence FIU000117, issued by the Estonian Financial Intelligence Unit, covers LexorCorp Global's activity as a company service provider. It is not an authorisation for your business and gives us no right to grant one: the final decision on every licence, authorisation and registration is made by the competent supervisory authority alone.

DORA — digital operational resilience

Regulation (EU) 2022/2554 (DORA) applies from 17 January 2025 (Article 64) to financial entities including payment institutions, e-money institutions, crypto-asset service providers authorised under MiCA, investment firms and managers of alternative investment funds (Article 2). We set up the ICT risk management framework, the incident classification and reporting process, the register of ICT third-party arrangements and the testing plan, with the tooling to run them.

Banking and payment partners

A licensed company still needs accounts. We introduce you to banks, e-money institutions (including institutions that work with crypto-asset businesses), IBAN providers and card issuing or BIN sponsor partners, and prepare the onboarding file. Bank and payment accounts are granted solely at the discretion of the financial institution: an introduction is not an account, and no partner is obliged to accept you.

Compliance audits

Our compliance audit is an internal review of your compliance framework — policies, procedures, records and controls — against the rules that apply to your authorisation. The scope follows the class of the business (Class 1, 2 or 3; for crypto-asset service providers the MiCA classes). It is not a statutory audit of financial statements, which only an auditor can carry out.

What goes with each service: required and recommended add-ons

Required add-ons are added to the order with the service. Strongly recommended add-ons arrive ticked and can be removed. Each line names the provision it rests on, read in the official text. General information about our services, not legal advice. The same list for every licence is in the guide required and recommended documents for licence applications.

DORA ICT risk management framework and tooling (Regulation (EU) 2022/2554)

Strongly recommended

Add-ons and upgrades

What you can add to regulatory infrastructure and compliance

Each add-on states what you receive and what is not included. Prices come from our price list; every add-on is ordered and paid in the order form on this page.

DORA register of information — annual update

from €2,400 / yearRecommended Strongly recommended

Full description

Annual update of the register of information on ICT third-party arrangements (Article 28(3) of Regulation (EU) 2022/2554) and its submission support.

Ordered together with: DORA ICT risk management framework and tooling (Regulation (EU) 2022/2554).

What you receive

  • Update of the register from your contracts
  • Consistency check before submission

Not included

  • Negotiating contracts with ICT providers
  • Supervisory fees

No state fee or notary fee applies to this service; banks, payment institutions and software providers charge their own fees directly.

Order Read the guide

Remediation plan after a compliance audit

from €1,700Recommended

Full description

A prioritised plan to close the findings of our compliance audit, with owners and deadlines, and the updated documents where needed.

Ordered together with: Compliance audit — Class 1 scope (internal compliance review, not a statutory financial audit); Compliance audit — Class 2 scope (internal compliance review, not a statutory financial audit); Compliance audit — Class 3 scope (internal compliance review, not a statutory financial audit).

What you receive

  • Remediation plan with priorities and deadlines
  • Updated policies for the findings in scope

Not included

  • Implementing IT changes
  • Statutory audit

No state fee or notary fee applies to this service; banks, payment institutions and software providers charge their own fees directly.

Order Read the guide

All prices are in euros and exclude VAT. VAT is added where it applies under the Estonian Value Added Tax Act.

All add-ons and upgrades · Price list

Each service in detail

General information, not legal advice. Prices are in the table above.

DORA ICT risk management framework and tooling (Regulation (EU) 2022/2554)

DORA ICT risk management framework and tooling, and the annual update of the register of information on ICT third-party providers.

For whom: Financial entities under DORA.

What you receive

  • ICT risk management framework documents
  • Register of information

Conditions

The entity remains responsible for implementation. FIU licence FIU000117 is LexorCorp's own licence for its trust and company services; it does not authorise the client.

Law and requirements

  • Regulation (EU) 2022/2554 (DORA)

Not included in the price

  • ICT systems and testing

Who does what

LexorCorp
Prepare the application and its documents and manage the procedure until the decision.
You
Provide information, capital and people that meet the legal requirements; sign and answer the authority's questions.
Authority
The competent supervisor.

DORA ICT risk management framework and tooling (Regulation (EU) 2022/2554): price, requirements, process and deadline on its own page

DORA register of information — annual update: see DORA ICT risk management framework and tooling (Regulation (EU) 2022/2554).

Extended banking onboarding — introductions to 6 banking and payment partners

Introductions to banking, payment, crypto-friendly e-money, IBAN and card issuing (BIN sponsor) partners, and support with their onboarding.

For whom: Regulated and fintech companies looking for accounts and partners.

What you receive

  • Introductions and onboarding support

Conditions

Each partner decides on onboarding; we cannot promise an account or partnership. We prepare you for each partner's onboarding requirements — business model, compliance framework, ownership and source of funds — and coordinate the process.

Law and requirements

  • The partners' own due diligence obligations

Not included in the price

  • The partners' fees

Who does what

LexorCorp
Prepare the application and its documents and manage the procedure until the decision.
You
Provide information, capital and people that meet the legal requirements; sign and answer the authority's questions.
Authority
The partners decide.

Extended banking onboarding — introductions to 6 banking and payment partners: price, requirements, process and deadline on its own page

Premium banking onboarding: see Extended banking onboarding — introductions to 6 banking and payment partners.

Introduction to a crypto-friendly e-money institution: see Extended banking onboarding — introductions to 6 banking and payment partners.

Multi-currency IBAN account set-up: see Extended banking onboarding — introductions to 6 banking and payment partners.

Card issuing / BIN sponsor introduction: see Extended banking onboarding — introductions to 6 banking and payment partners.

Compliance audit — Class 1 scope (internal compliance review, not a statutory financial audit)

An internal compliance review of a regulated firm in the chosen scope, and a remediation plan after it. It is not a statutory financial audit and not an auditor's service.

For whom: Licensed firms preparing for supervision or after findings.

What you receive

  • Review report
  • Remediation plan (if ordered)

Conditions

Scope agreed in writing.

Law and requirements

  • The firm's regulatory framework

Not included in the price

  • Statutory audit
  • Legal opinion

Who does what

LexorCorp
Prepare the application and its documents and manage the procedure until the decision.
You
Provide information, capital and people that meet the legal requirements; sign and answer the authority's questions.
Authority
None; the supervisor may review the firm separately.

Compliance audit — Class 1 scope (internal compliance review, not a statutory financial audit): price, requirements, process and deadline on its own page

Compliance audit — Class 2 scope (internal compliance review, not a statutory financial audit): see Compliance audit — Class 1 scope (internal compliance review, not a statutory financial audit).

Compliance audit — Class 3 scope (internal compliance review, not a statutory financial audit): see Compliance audit — Class 1 scope (internal compliance review, not a statutory financial audit).

Remediation plan after a compliance audit: see Compliance audit — Class 1 scope (internal compliance review, not a statutory financial audit).

GDPR compliance documentation for an Estonian company

Preparation of the documents an Estonian company needs under the General Data Protection Regulation: the record of processing activities, the privacy notice, data processing agreement templates and the internal rules for requests and data breaches.

For whom: Estonian companies that process personal data of clients, employees or users.

What you receive

  • The record of processing activities
  • The privacy notice for the website or the clients
  • Templates of the data processing agreement
  • Internal rules for data subject requests and personal data breaches

Conditions

Document preparation from the company's description of its processing, not legal advice; the company is responsible for applying the documents, and the Data Protection Inspectorate supervises. The starting price is for one company with ordinary processing; more work is agreed in writing before it starts.

Law and requirements

  • Regulation (EU) 2016/679 (General Data Protection Regulation)
  • Personal Data Protection Act

Not included in the price

  • Legal advice or a legal opinion
  • Acting as the data protection officer
  • Representation before the Data Protection Inspectorate

Who does what

LexorCorp
Prepare the documents from your description.
You
Describe what personal data the company processes, why and with whom.
Authority
The Data Protection Inspectorate supervises; it does not approve the documents.

GDPR compliance documentation for an Estonian company: price, requirements, process and deadline on its own page

AML and KYC procedures and documentation for an Estonian company

Preparation of the procedures and documents an Estonian company needs as an obliged person under the Money Laundering and Terrorist Financing Prevention Act: the risk assessment, the rules of procedure, customer due diligence (KYC) forms and the internal control rules.

For whom: Estonian companies that are obliged persons under the Act without holding an activity licence of the Financial Supervision Authority — for example traders, accountants or advisers in the cases the Act names. Licensed companies have the AML/CFT pack of the licensed services.

What you receive

  • The risk assessment of the company's activity
  • The rules of procedure and the internal control rules
  • Customer due diligence (KYC) forms and checklists
  • A register of the documents for the company's records

Conditions

Document preparation from the company's description of its activity, not legal advice; the company applies the procedures, and the Financial Intelligence Unit supervises. Whether the company is an obliged person is checked from its facts. The starting price is for one company; more work is agreed in writing before it starts.

Law and requirements

  • Money Laundering and Terrorist Financing Prevention Act

Not included in the price

  • Legal advice or a legal opinion
  • Acting as the compliance officer
  • Checks of the company's clients
  • Representation before the Financial Intelligence Unit

Who does what

LexorCorp
Prepare the procedures and the documents.
You
Describe the activity, the clients and the payment flows.
Authority
The Financial Intelligence Unit supervises; it does not approve the documents.

AML and KYC procedures and documentation for an Estonian company: price, requirements, process and deadline on its own page

How a compliance project works

  1. Scoping by questionnaire

    You: You describe your firm and what it needs: a DORA framework, partner introductions or a compliance audit.

    We: We reply in writing with the scope we propose for that need.

  2. You give us the material

    You: You hand over your current policies, the inventory of ICT assets and third parties, or the corporate and KYC documents.

    We: We tell you which of these the chosen work needs and what is missing.

  3. Gap analysis or introduction file

    You: You name the person in your firm who owns each control.

    We: We analyse where your firm stands against the requirement, or prepare your introduction file for banking and payment partners.

  4. Drafts and review

    You: You review the drafts and correct anything that does not match how your firm works.

    We: We draft the framework, policies, registers or audit report from the information you gave us.

  5. Delivery

    You: You put the documents to use in your own compliance function, which we do not replace.

    We: We deliver the documents with the evidence of what was checked; a DORA framework takes 8–12 weeks and an audit 3–8 weeks.

  6. Partners decide for themselves

    You: You choose the banks and payment partners yourself and deal with their decisions and fees.

    We: We make the introductions over 2–6 weeks depending on the partners; each bank or institution decides on onboarding under its own policies.

Order a compliance service

What we need from you and why

From youWhy
Description of your firm and what it needsThe scope is set from your answers: a DORA framework, partner introductions or a compliance audit.
Your current policiesThe gap analysis starts from what your firm already has in writing.
Inventory of ICT assets and third partiesWe need it for the DORA ICT risk framework.
Corporate and KYC documentsThey are needed for partner onboarding, and each bank or EMI decides under its own policies.
Name of the person who owns each controlThe documents are put to use in your own compliance function, which we do not replace.

When this service is not for you

  • You expect an introduction to end in an opened account. Introductions are not a guarantee of onboarding; each bank or EMI decides under its own policies.
  • You need penetration testing. Penetration testing is not included in this work.
  • You need a statutory audit. A statutory audit is not included; our compliance audits are a different piece of work.
  • You need the licence application itself prepared. Applications are prepared under licensed and regulated companies and the other licensing pages.
  • You want us to act as your firm's compliance function. We deliver the documents and you use them in your own compliance function, which we do not replace.

Frequently asked questions

Does DORA apply to my company?

DORA applies to the financial entities listed in its Article 2, including payment and e-money institutions, crypto-asset service providers authorised under MiCA, investment firms and managers of alternative investment funds. We confirm the scope for your company in writing before the work starts.

Do you guarantee a bank account?

No. Bank and payment accounts are granted solely at the discretion of the financial institution. We introduce you and prepare the onboarding file; the institution decides.

Is your compliance audit a statutory audit?

No. It is an internal compliance review. A statutory audit of annual accounts is carried out by an auditor and is not part of this service.

Can I order these services without a licence project?

Yes. Each service is ordered and paid on its own on this page; you describe your company and its authorisation in the order form.

What is the DORA register of information?

Under Article 28(3) of Regulation (EU) 2022/2554 every financial entity keeps a register of all contractual arrangements for ICT services provided by third parties, makes it available to the authority on request and reports at least yearly on new arrangements.

Why does the DORA register need an annual update?

Because it changes whenever an ICT contract changes, and the authority expects it to be complete and consistent when it asks. Our annual service updates it from your contracts and checks it before submission.

What happens after your compliance audit finds issues?

The remediation plan lists each finding with its priority, the person responsible and a deadline, and we update the policies in scope. The authority, a bank or an auditor who later asks about a finding will expect to see both the plan and the evidence that it was carried out.

Can the remediation plan be ordered without your audit?

It is designed to follow our compliance audit, whose findings it closes. For findings of another reviewer, describe them in the order form and we tell you in writing before the work starts whether the plan can be built on them.

Can you guarantee a bank account?

No. Each bank or payment partner decides on onboarding; we prepare you and introduce you.

Is the compliance audit a statutory audit?

No. It is an internal compliance review; it is not a statutory financial audit and not an auditor's service.

What are the risks of DORA non-compliance?

Supervisory findings and measures by the competent authority; the entity remains responsible for its ICT risk framework.

All our prices on one page. Compare this service with every other service in our price list.

See these prices in the price list

Guides

Read the guides

All guides

  • Seven companies join the fourth Cyber Accelerator at Tehnopol — Tehnopol has selected seven companies for the fourth cohort of its Cyber Accelerator, run together with the Estonian Information System Authority and the European Cybersecurity Competence Centre. The programme lasts seven months and each company can receive up to EUR 60,000 in grant funding. The products range from phishing checks to supplier risk management.

More news: Startups in Estonia.

Order

Choose the service and its add-ons, enter your details and pay by card. The total is shown before you pay and changes as you tick or untick an add-on.

1. Service and add-ons
from €1,800

Other services you can add

€490
€990
from €1,590
€450
€180
from €600
€350 / year
€250 / year
from €150 / month
from €450
€350
€550
€300
€150 / document
€180 / page
from €3,900
from €5,600

Rows marked as needed or strongly recommended arrive ticked. You decide: untick what you do not need, tick what you do. Every row shows its own price; the total below changes at once.

2. Your project
3. Contact details (all required)

Address

Your order

  • GDPR compliance documentation for an Estonian company€1,800

Total, excluding VAT€1,800

The amount you pay now is our fee for the standard scope described on this page. If your project needs work beyond that scope, we tell you the additional fee in writing before that work starts, and it is done only with your written agreement. Before the work has started you may cancel by email and receive a full refund (Terms of service, section 10).

Our service is the preparation of documents and the organisation of the work described. It is not legal advice, an advocate's service or a statutory audit; your supervisor assesses your firm, not our documents.

Total, excluding VAT €1,800

After you submit, Revolut's secure card payment page opens. All communication about your order takes place by email.

Not ready yet? Email me this selection

We send you one email with a link that opens this selection again.