Key Takeaways — DORA Register of Information Requirements
The DORA Register of Information (RoI) is the most operationally complex obligation under Regulation (EU) 2022/2554. Financial entities must document every ICT third-party arrangement across 15 interconnected ESA templates, maintained at entity, sub-consolidated, and consolidated levels. In the ESA's 2024 Dry Run, only 6.5% of registers passed all 116 validation checks. Non-compliance can trigger fines of up to 2% of global annual turnover. Annual submission to NCAs is due by March 31 each year.
Definitions
What is the DORA Register of Information?
DORA Register of Information (RoI) is a mandatory structured register required under Article 28(3) of the Digital Operational Resilience Act (Regulation (EU) 2022/2554). It requires all in-scope financial entities to maintain a complete, up-to-date record of all contractual arrangements with ICT third-party service providers, structured across 15 interconnected templates defined by the European Supervisory Authorities' Implementing Technical Standards.
What is DORA (Digital Operational Resilience Act)?
DORA is Regulation (EU) 2022/2554 of the European Parliament and of the Council, establishing a comprehensive framework for digital operational resilience in the EU financial sector. It entered into force on 16 January 2023 and applies from 17 January 2025, covering 20 categories of financial entities including banks, insurers, investment firms, and crypto-asset service providers.
What are ESA Implementing Technical Standards (ITS)?
ESA Implementing Technical Standards are binding technical rules developed jointly by the European Banking Authority (EBA), European Securities and Markets Authority (ESMA), and European Insurance and Occupational Pensions Authority (EIOPA) under DORA Article 28(9). They define the exact templates, data fields, taxonomies, and validation rules for the Register of Information.
What is a Legal Entity Identifier (LEI)?
LEI is a 20-character alphanumeric code that uniquely identifies legal entities participating in financial transactions, as defined by ISO 17442. LEI codes are mandatory identifiers in DORA RoI templates for linking entities, providers, and contractual arrangements across the register.
Frequently Asked Questions
What is the DORA Register of Information (RoI)?
The DORA Register of Information is a mandatory structured register required under Article 28(3) of Regulation (EU) 2022/2554. It requires financial entities to document all ICT third-party service arrangements across 15 interconnected templates defined by the ESA Implementing Technical Standards. The register must be maintained at entity, sub-consolidated, and consolidated levels, covering entity information, contractual arrangements, ICT services, and provider supply chains.
How many templates does the DORA Register of Information contain?
The ESA Implementing Technical Standards under DORA Article 28(9) define 15 interconnected templates (B_01 through B_06, plus sub-templates). Each template contains dozens of mandatory fields with strict taxonomies and 116 data quality validation rules. Templates cover entity identification, contractual arrangements, ICT service details, risk assessments, and sub-outsourcing chains.
What was the pass rate in the ESA DORA Dry Run?
According to the EBA DORA Dry Run Summary Report published in December 2024, only 6.5% of submitted registers passed all 116 data quality validation checks. Nearly 1,000 financial entities participated across the EU. The report found that 86% of errors were caused by missing mandatory information such as unique identifiers and supply chain data, highlighting the operational complexity of the RoI requirement.
What are the penalties for non-compliance with the DORA Register of Information?
Under DORA Article 50 of Regulation (EU) 2022/2554, non-compliance can result in fines of up to 2% of global annual turnover for financial entities. Additionally, competent authorities can impose daily penalties of up to 1% of average daily worldwide turnover to compel remediation. Critical ICT third-party providers face separate penalty regimes under DORA Article 35.
When is the DORA Register of Information submission deadline?
Financial entities must submit their Register of Information to their National Competent Authority (NCA) annually by March 31. The register must also be maintained on an ongoing basis and be available for supervisory review on request at any time. NCAs consolidate submissions and forward them to the European Supervisory Authorities for critical provider designation analysis.
Which financial entities are in scope for the DORA Register of Information?
DORA applies to 20 categories of financial entities as defined in Article 2 of Regulation (EU) 2022/2554. These include credit institutions, investment firms, insurance and reinsurance undertakings, payment institutions, electronic money institutions, central securities depositories, central counterparties, trading venues, trade repositories, managers of alternative investment funds, management companies, data reporting service providers, crypto-asset service providers, and crowdfunding service providers.
What data fields are mandatory in the DORA RoI templates?
Mandatory fields span entity identification (LEI codes per ISO 17442), contractual arrangement details (start dates, termination clauses, governing law), ICT service descriptions (service types using ESA taxonomies), risk assessments (criticality or importance classifications), sub-outsourcing chains (identification of all sub-contractors), and data processing locations. The ESA validation framework applies 116 automated quality checks across these fields.
How does the DORA RoI differ from existing outsourcing registers?
Unlike the EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02), the DORA RoI covers all ICT third-party arrangements — not just outsourcing — and requires structured, machine-readable data across 15 templates rather than free-text documentation. It mandates entity-level granularity across entire corporate groups, includes sub-outsourcing chain mapping, and enforces 116 automated validation rules. The scope is also broader, covering 20 categories of financial entities beyond just credit institutions.
Statistics and Sources
According to the EBA DORA Dry Run Summary Report (December 2024), only 6.5% of submitted registers passed all 116 data quality validation checks, with nearly 1,000 financial entities participating. The report found that 86% of errors were caused by missing mandatory information. A Deloitte survey (Digital Operational Resilience Act Survey, Wave 3) found that 46% of financial institutions cite the Register of Information as DORA's single hardest requirement, and only 50% of institutions expected to reach full compliance by end of 2025. According to a Censuswide survey of EMEA financial services organizations (2025), 34% cite third-party oversight as the hardest DORA requirement. DORA Article 50 of Regulation (EU) 2022/2554 establishes fines of up to 2% of global annual turnover for non-compliant financial entities.
DORA RoI Template Overview
| Template | Scope | Key Mandatory Fields |
|---|
| B_01.01 | Entity maintaining the register | LEI, entity name, entity type, competent authority |
| B_01.02 | Entities within the scope of consolidation | LEI, entity name, country, relationship type |
| B_01.03 | Branches of entities | Branch identifier, country, head office LEI |
| B_02.01 | Contractual arrangements — general | Contract reference ID, start date, governing law, termination rights |
| B_02.02 | Contractual arrangements — specific | Criticality assessment, data processing country, substitutability |
| B_03.01 | ICT third-party service providers | Provider LEI, provider name, country of incorporation, provider type |
| B_03.02 | ICT third-party service providers — additional | Ultimate parent LEI, group structure |
| B_04.01 | ICT services — function identification | Function name, criticality or importance, business line |
| B_05.01 | Sub-outsourcing — ICT sub-contractors | Sub-contractor LEI, sub-contractor name, service description |
| B_05.02 | Sub-outsourcing — chain details | Chain rank, data processing location, oversight arrangements |
| B_06.01 | Assessment of ICT services | Exit strategy, alternative providers, impact assessment |
