Resources / Guide
DORA register of information
Updated 24 October 2026
Article 28(3) of Regulation (EU) 2022/2554 (DORA) requires every financial entity to keep a register of information on all its contractual arrangements for information and communication technology (ICT) services provided by third parties[1]. Implementing Regulation (EU) 2024/2956 sets the register out in 15 templates[2].
What are the 15 templates?
- Entity maintaining the register of information
- List of entities within the scope of consolidation
- List of branches
- Contractual arrangements: general information
- Contractual arrangements: specific information
- List of intra-group contractual arrangements
- Entities signing the contractual arrangements for receiving ICT service(s) or on behalf of the entities making use of the ICT service(s)
- ICT third-party service providers signing the contractual arrangements for providing ICT service(s)
- Entities signing the contractual arrangements for providing ICT service(s) to other entities within the scope of consolidation
- Entities making use of the ICT services
- ICT third-party service providers
- ICT service supply chain
- Functions identification
- Assessments of the ICT services
- Definitions from entities making use of the ICT Services
How do you file the register?
The register goes to the entity's competent authority[1]. Submissions use the plain-csv report package of the European Banking Authority (EBA) for reporting framework 4.0: one CSV file per template, with a report description, parameters and filing indicators, in one zip file named after the entity's Legal Entity Identifier (LEI)[3].
Where do registers fall short?
- Arrangements that support a critical or important function need most of B_02.02 and all of B_07.01.
- Every LEI must pass the ISO 17442 check digits.
- A provider that belongs to the group must name its ultimate parent in B_05.01.
- Storage and processing countries are keys and are paired in every combination.
Build and file the register in Vardion
- Fill the register field by field, with the closed lists of Implementing Regulation (EU) 2024/2956 built in.
- See every missing mandatory field by its code before the authority does.
- Fill the functions from your business impact analysis instead of typing them twice.
- Download the filing package, checked before download, with a spreadsheet for review.
Sources
- Regulation (EU) 2022/2554 (DORA), Article 28(3), checked 14 October 2026
- Implementing Regulation (EU) 2024/2956, the register of information templates, checked 14 October 2026
- European Banking Authority, reporting framework 4.0, checked 24 October 2026
Get your DORA register ready to file
See the register and the filing package in a demo.