Register of information
RoIAlso called DORA register of information, ICT register of information
A register of information is the record every EU financial entity keeps under DORA of all its contractual arrangements with ICT third-party service providers. It lists each provider, the services used, the functions they support and the subcontractors involved. Supervisors collect it each year.
How it works
Firms build the register at entity, sub-consolidated and consolidated level using standard templates set by EU implementing rules. Providers are identified by legal entity identifier, and each contract is tagged with the service type and whether it supports a critical or important function. National supervisors collect the registers and pass them to the European Supervisory Authorities. The 2026 cycle covered contracts in place on 31 December 2025.
The register is the data behind DORA oversight. Supervisors use it to spot concentration on a few providers and to inform the designation of critical ICT third-party service providers. Inside the firm it drives third-party risk work, from mapping critical functions to planning exits. Supervisors reject submissions with missing or inconsistent data.
The rules
Requires financial entities to maintain a register of information on all ICT services contracts, report new arrangements at least yearly and provide the full register on request.
EU financial entities in scope of DORASets the standard templates, data fields and instructions for the register at entity, sub-consolidated and consolidated level.
EU financial entities in scope of DORACommon questions
Who must keep a DORA register of information?
Every financial entity in scope of DORA, including banks, insurers, investment firms, payment institutions and crypto-asset service providers. Groups keep a register at entity level and at sub-consolidated and consolidated level.
What deadline applies to the register?
Registers are collected each year. The 2026 cycle used a 31 December 2025 reference date. National supervisors set their own collection windows, some closing on 31 March 2026, and the ESAs then ran quality checks on the registers during April.
In what format is the register submitted?
The ESAs collect registers in a structured format based on their reporting taxonomy. Supervisors run validation checks on each file and can reject registers with missing or inconsistent data, which triggers a resubmission.
How does the register link to critical ICT providers?
The ESAs use register data to measure how much the EU financial sector relies on each ICT provider. That analysis feeds the designation of critical ICT third-party service providers, which then fall under direct EU oversight.
