The DORA register of information is the record every EU financial entity must keep, under Article 28(3) of Regulation (EU) 2022/2554, of all its contractual arrangements for ICT services provided by ICT third-party service providers. It is kept at entity, sub-consolidated and consolidated level and separates arrangements that support critical or important functions from those that do not.
Supervisors use it to see each firm's ICT dependencies, and the European Supervisory Authorities (ESAs) use it to identify ICT providers critical to the sector. This post covers the legal basis, the templates, which subcontractors to include, reporting and data gathering.
What does DORA Article 28 require?
DORA has applied since 17 January 2025. Article 28(3) sets five obligations for the register. Financial entities must:
- maintain and update it at entity level and at sub-consolidated and consolidated levels, as part of their ICT risk management framework;
- document arrangements so that those covering ICT services supporting critical or important functions are distinguished from the rest;
- report at least yearly to their competent authority on the number of new arrangements, the categories of ICT third-party service providers, the types of arrangements and the ICT services and functions provided;
- make the full register, or requested sections, available to the competent authority on request; and
- inform the competent authority in a timely manner about any planned arrangement for ICT services supporting a critical or important function, and when a function has become critical or important.
The register covers all ICT arrangements; the critical or important distinction decides how much detail each entry needs.
Which rules set the register templates?
Article 28(9) asked the ESAs to draft standard templates. The result is Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024, published in the Official Journal on 2 December 2024. Its main rules:
- Templates in Annexes I to IV must be used, as open tables with fixed columns and as many rows as needed, linked by keys such as the contractual arrangement reference number.
- The register must include all ICT services from direct providers, plus every subcontractor that effectively underpins ICT services supporting critical or important functions or material parts of them.
- Data must meet six quality principles: accuracy, completeness, consistency, integrity, uniformity and validity.
- Providers that are legal persons are identified by a valid Legal Entity Identifier (LEI) or European Unique Identifier (EUID), and both where available.
- Every provider in a supply chain gets a rank: the direct provider is always 1, and subcontractors are 2 or higher.
- Groups may keep a single register that serves entity, sub-consolidated and consolidated levels.
What information goes in the register?
The templates fall into a few blocks. Annex I defines each column.
| Templates | Block | What it records |
|---|---|---|
| B_01.01 to B_01.03 | Entities | The entity maintaining the register, the entities in scope of consolidation, and branches outside the home country |
| B_02.01 to B_02.03 | Contractual arrangements | Each arrangement with a reference number; the ICT services and functions it covers, with details such as notice periods and governing law; links between intra-group and external contracts |
| B_03.01 to B_03.03 | Signing parties | Who signed each arrangement on both sides, including group entities providing services to others |
| B_04.01 | Service users | Which entities actually use each ICT service |
| B_05.01 and B_05.02 | Providers and supply chain | Direct providers, intra-group providers, ranked subcontractors and their ultimate parent undertakings |
| B_06.01 | Functions | Each function, whether it is critical or important and why, its recovery time and recovery point objectives, and the impact of discontinuing it |
| B_07.01 | Assessment of ICT services | For services supporting critical or important functions: substitutability, date of the last audit, exit plans, reintegration options, impact of discontinuing and alternative providers |
| B_99.01 | Definitions | What the entity means by the values it uses in closed lists, such as low, medium or high impact |
What counts as a critical or important function, and which subcontractors belong?
DORA Article 3(22) defines a critical or important function as one whose disruption would materially impair the entity's financial performance, the soundness or continuity of its services, or its continuing compliance with the conditions of its authorization or its other obligations under financial services law.
Function identification drives the rest of the register. Once a function is critical or important, every ICT service supporting it needs the B_07.01 assessment fields and its underpinning subcontractors.
You do not need every subcontractor in the chain. The implementing regulation asks only for those that effectively underpin ICT services supporting critical or important functions, including any whose disruption would impair the security or continuity of the service. In practice that is usually the hosting, data center and core software providers beneath a critical service, which is exactly the fourth-party view most programs lack.
When is the register reported to competent authorities?
Financial entities report to their national competent authority, which forwards the data to the ESAs. According to the ESAs' reporting FAQ:
- The first collection used a reference date of 31 March 2025, with competent authorities reporting to the ESAs by 30 April 2025.
- From 2026, competent authorities report to the ESAs by 31 March each year, using a reference date of 31 December of the previous year.
- Each competent authority sets its own, earlier deadline and submission channel for the entities it supervises.
The ESAs used the first registers to designate critical ICT third-party providers, publishing the first list on 18 November 2025. As of October 2026, check your authority's notice for the next cycle's dates, scope and file format, which vary by country.
How do you gather the data efficiently?
Most of the work is reconciliation, not form filling.
- Start from contracts, not the vendor list. A vendor with three contracts is three entries.
- Map functions first. Agree the function list and the critical or important assessment before collecting service data, since it decides which entries need supply chains and B_07.01 fields.
- Collect identifiers early. Missing or invalid LEIs and EUIDs can cause files to fail validation. Ask providers for theirs, and for their subcontractors', at onboarding.
- Ask for the subcontracting chain in the contract. Notification of material subcontractor changes keeps the supply chain current between cycles.
- Keep one record per provider. The same cloud or software company often appears under several vendors. Reconcile it to a single provider record so concentration shows up.
- Maintain it all year. Article 28(3) expects the register kept up to date, not rebuilt annually.
VendRisk360 holds the vendor inventory, the functions each ICT third party supports, criticality, contracts, subcontractors and fourth parties in one place, which is the information the register draws on. Nth-party intelligence builds the supply chain from subservice organizations in SOC reports, vendor disclosures and outside-in monitoring, reconciled to one record per provider. The platform maps to DORA as set out on our regulatory coverage page; your team remains responsible for the final register and its submission in the required format.
Frequently asked questions
What is the DORA register of information?
It is the record each EU financial entity keeps under DORA Article 28(3) of all contractual arrangements for ICT services provided by ICT third-party service providers. It is maintained at entity, sub-consolidated and consolidated level, separates arrangements supporting critical or important functions, and follows the templates in Implementing Regulation (EU) 2024/2956.
Do all ICT subcontractors have to be in the register?
No. The implementing regulation requires only subcontractors that effectively underpin ICT services supporting critical or important functions or material parts of them, including those whose disruption would impair the security or continuity of the service. Each is ranked in the supply chain, with the direct provider at rank 1.
When must the DORA register be reported?
From 2026, competent authorities forward registers to the ESAs by 31 March each year, using a reference date of 31 December of the previous year. Each national authority sets its own earlier deadline and submission process for financial entities, so as of October 2026 the authority's own notice is the reference for exact dates.
Which identifiers does the register use for ICT providers?
Providers that are legal persons are identified with a valid Legal Entity Identifier or European Unique Identifier, and both where available. The ESAs' FAQ notes that providers registered outside the EU can only use an LEI, and that empty identifiers can cause the whole reporting file to be rejected, so collect them early.
About VendRisk360
VendRisk360 is an AI-assisted third-party risk management (TPRM) SaaS platform for regulated organizations. It keeps one governed record per vendor from intake to exit, assesses each vendor on evidence scaled to its risk tier, monitors vendors continuously from the outside (attack surface, data breaches, financial distress and adverse news), maps fourth and nth parties, and produces board-ready reporting. Teams run their program on the platform themselves, or turn on managed assessments and monitoring, delivered on the platform by VendRisk360’s certified reviewers. People make every decision.
This post is general guidance, not legal advice. Confirm your obligations with counsel and your supervisors.
