DORA Register of Information: [Financial entity or group name]

Working file and design record for the register of information on ICT third-party contractual arrangements that Article 28(3) of the Digital Operational Resilience Act (Regulation (EU) 2022/2554, DORA) requires, built on the standard templates of Commission Implementing Regulation (EU) 2024/2956 (templates B_01.01 to B_07.01 and B_99.01). It covers the entities in scope, contractual arrangements, providers and identifiers, ICT service supply chains and ranking, functions and their criticality, the assessment of services that support critical or important functions, concentration and exit, the Article 30 contract check, data quality controls and the yearly submission. DORA applies from 17 January 2025; check the consolidated texts on EUR-Lex and your competent authority's reporting instructions. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and legal basis
2. Register governance and operating model
3. Template map
4. Entities in scope
5. Contractual arrangements
6. ICT third-party service providers
7. ICT service supply chains and ranking
8. Functions and criticality
9. Assessment of ICT services supporting critical or important functions
10. Concentration risk and exit
11. Key contractual provisions check
12. Definitions template
13. Data quality controls
14. Reporting, notifications and critical providers
15. Glossary and references

1. Purpose, scope and legal basis

1.1 Purpose

The register records every contractual arrangement under which [Entity] uses ICT services from an ICT third-party service provider. It serves three users: the entity's own ICT third-party risk management, the competent authority's supervision, and the European Supervisory Authorities (ESAs) for oversight of critical ICT third-party service providers. The register distinguishes arrangements that cover ICT services supporting critical or important functions from those that do not.

1.2 Legal basis

Implementing Regulation (EU) 2024/2956 was adopted on 29 November 2024, published in the Official Journal on 2 December 2024 and entered into force on the twentieth day after publication. DORA has applied since 17 January 2025 without a transitional period. Check the consolidated texts for amendments.

2. Register governance and operating model

2.1 Roles

R responsible, A accountable, C consulted, I informed.

2.2 Sources of truth and update triggers

Set a rule that no contract for ICT services is signed until a register entry with a contractual arrangement reference number exists.

3. Template map

The EBA data point model and reporting taxonomy use the same template codes. Check the current reporting framework release on the EBA website before each submission.

4. Entities in scope

4.1 Entity maintaining the register (B_01.01)

4.2 Entities in scope of consolidation (B_01.02)

4.3 Branches (B_01.03)

5. Contractual arrangements

5.1 General information (B_02.01)

5.2 Specific information (B_02.02)

Data locations and provision countries are shown combined for readability; in the live register add one row per country of storage, processing or provision. Report only the service type code (for example S19); labels are shown here for readers. One row exists for each combination of entity, function and service type. CA-0002 therefore needs two rows (F1 and F2) in the live register.

5.3 Intra-group links (B_02.03)

The intra-group IT company (LEI-3) signs the cloud contract CA-0002 and provides operations to the bank under CA-0003, so both arrangements belong to the same chain.

5.4 Signing and using entities (B_03.01, B_03.02, B_03.03, B_04.01)

6. ICT third-party service providers

Total annual expense for PRV-004 sums CA-0004 and CA-0005 (300,000 plus 120,000). Check LEI status against the GLEIF database at each update; a lapsed LEI fails validation.

7. ICT service supply chains and ranking

7.1 Chain diagram

The diagram shows the worked example chain for the core banking service (CA-0001) and the cloud service (CA-0002).

7.2 Supply chain register (B_05.02)

7.3 Subcontracting assessment

For each subcontractor that supports a critical or important function, record the due diligence and conditions that Delegated Regulation (EU) 2025/532 asks the entity to determine: whether subcontracting is permitted and on what conditions, how the direct provider monitors the subcontractor, the entity's audit and information rights along the chain, the notice for material changes and the right to object or terminate.

8. Functions and criticality

8.1 Criticality criteria

8.2 Function register (B_06.01)

RTO and RPO are reported in whole hours: report 1 where the objective is below one hour and 0 where it is not defined. F1 has an internal RPO of 15 minutes, which is reported as 1; keep the precise value in the business impact analysis. The same function performed under two licensed activities needs two identifiers. Align recovery objectives with the Business Continuity (compliance/business-continuity) plan and the Disaster Recovery Plan (ops/disaster-recovery-plan).

9. Assessment of ICT services supporting critical or important functions

The reason column is a closed list of three values (1 lack of real alternatives, 2 difficulties in migration or reintegration, 3 both) and is mandatory when the service is marked not substitutable or highly complex to substitute. Keep the narrative in the assessment record, not in the register. Every arrangement that supports a critical or important function needs a row here, including intra-group ones such as CA-0003.

9.1 Assessment checklist before contracting (Article 28(4))

1. Confirm whether the service supports a critical or important function and record the function identifier.
2. Confirm that supervisory conditions for contracting are met.
3. Identify and assess the risks, including whether the arrangement adds to ICT concentration risk (section 10).
4. Complete due diligence on the provider and record the outcome in the Supplier Security Assessment (compliance/supplier-security-assessment).
5. Identify and assess conflicts of interest.
6. Confirm the provider applies appropriate information security standards, and for critical or important functions the most current and highest-quality standards (Article 28(5)).
7. Set the audit frequency and areas on a risk basis (Article 28(6)).

10. Concentration risk and exit

10.1 Concentration view

Total spend in the example is the sum of CA-0001 to CA-0005 (2,400,000 plus 1,850,000 plus 900,000 plus 300,000 plus 120,000, which is 5,570,000 EUR). The PRV-002 figure counts direct spend of 1,850,000 and an estimated 1,150,000 of PRV-001 charges attributable to hosting; mark estimates as such in the live register. Shares overlap because the same spend is seen at two ranks.

10.2 Exit plan register

11. Key contractual provisions check

Legend: Yes means the element is present; Gap means a mandatory element is missing. The 30(3) elements apply to every arrangement for a service supporting a critical or important function, so CA-0005 (F3) needs the TLPT cooperation clause even if the entity is not yet identified for TLPT under Article 26(8).

Gaps: [list each gap with the remediation route, for example contract amendment at renewal, side letter or compensating control, and the target date]. Delegated Regulation (EU) 2024/1773 sets the content of the policy that governs these arrangements, including governance, the ex-ante risk assessment, due diligence, conflicts of interest, contractual clauses, monitoring, and exit and termination.

12. Definitions template

13. Data quality controls

13.1 Pre-submission checklist

• Run the competent authority's or EBA validation rules on the export and clear every blocking error.
• Confirm that the reference date and the date of reporting are correct.
• Confirm that every function marked critical or important has at least one arrangement and an assessment.
• Obtain sign-off from the owner and the accountable management body member.

14. Reporting, notifications and critical providers

14.1 Submission record

For the first collection the ESAs asked competent authorities to report the registers to them by 30 April 2025 (JC 2024 99). In 2026 the reference date was 31 December 2025 and authorities collected registers between February and March 2026 on national deadlines. Confirm the reference date, window and validation rules in your authority's notice each year.

14.2 Notifications to the competent authority

14.3 Critical ICT third-party service providers

The ESAs designate critical ICT third-party service providers (CTPPs) under DORA Article 31 and publish the list. The first list, published in November 2025, named 19 providers. Mark each provider in the register that is on the current list, because a designated provider is overseen by a Lead Overseer and the entity may receive information or recommendations that affect its arrangement.

Check the current list on the ESAs' DORA oversight pages; it is updated over time.

15. Glossary and references

15.1 Glossary

15.2 References

Standard and licence note

Based on Regulation (EU) 2022/2554 (DORA), Commission Implementing Regulation (EU) 2024/2956 and Commission Delegated Regulations (EU) 2024/1773 and (EU) 2025/532, as published in the Official Journal of the European Union, and on public reporting material of the European Supervisory Authorities. EU legislative texts are free to reuse. Template codes and article numbers are cited and requirements are summarised in original wording; no legal text or reporting template is reproduced. Check the consolidated texts on EUR-Lex, your competent authority's reporting instructions and the current ESAs list of critical providers before use. This is a documentation format, not legal advice. Template licence: MIT.