Vixio Warns Spreadsheet-Reliant Firms Risk Falling Short on DORA

Vixio, a regulatory technology provider, warned this week that financial firms still running DORA compliance on spreadsheets, email chains and disconnected tools risk falling short as supervisors step up scrutiny, more than 21 months after the rules began to apply on January 17, 2025.

The warning lands as the evidence base is building. Dutch data show 94% of registers approved in 2026, EU supervisors have named 19 critical technology providers, and the first EU-wide incident report counts 3,383 major incidents.

DORA compliance is now a supervisory test rather than a project plan. Banks, insurers, payment institutions and investment firms must show that data, incident handling and supplier controls work in practice and that the management body owns them.

What DORA compliance requires from financial firms

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, sets one EU framework for technology risk at financial entities. It rests on five pillars: ICT risk management, incident reporting, resilience testing, third-party risk management and information sharing.

Accountability sits with the management body. Under the regulation it must approve and oversee the ICT risk framework, whatever is outsourced.

Vixio argues the difficulty lies less in the regulation itself than in the technical standards, guidelines and Q&As beneath it. They set how incidents are classified, how the register is structured and how deep subcontracting chains must be documented. Firms operating in several member states also face different national filing windows, formats and taxonomy versions. Vixio sells software for tracking DORA changes and set out its case in a post on DORA compliance software.

Whether a tool is needed is a firm’s own decision. What supervisors have published is narrower: they are testing data quality, incident discipline and supplier oversight, whatever system produces them.

Register of information data quality is improving

The register of information is the inventory of every ICT contract a firm holds, linked to the functions it supports. It also feeds the EU’s choice of which providers to oversee.

The starting point was poor. In the voluntary 2024 dry run, run by the European Supervisory Authorities (ESAs), only 6.5% of the 947 registers analyzed passed all 116 checks, according to the ESAs’ summary report. Missing mandatory information accounted for 86% of all errors, and half of the remaining registers failed fewer than five checks. The ESAs noted that firms took part on a best-efforts basis.

The live cycles have gone better. The Netherlands’ Authority for the Financial Markets (AFM) said on August 6, 2026 that the share of registers approved by the European Banking Authority rose from 40% in 2025 to 94% in 2026. The AFM credited a better grasp of the required format and told firms to keep watching the quality of the register and the underlying data.

The AFM’s update also reported that supervisory reviews found firms without every required policy or procedure, or with documents that did not fully meet the rules. Firms using group-level documents must confirm they cover every DORA requirement. The licensed entity, it said, remains responsible at all times.

DORA incident reporting is lower than supervisors expected

A major ICT incident triggers three filings: an initial notification, an intermediate report and a final report. The initial notice is due within hours of a firm classifying the incident as major, often while technology teams are still restoring service and legal teams are reviewing communications.

The AFM said the number of DORA incident reports it received was lower than expected. It told firms that incidents must be promptly detected, classified and reported within the statutory deadlines. Its review found most entities have adequate detection measures but weaker preventive ones, notably in logical access management and in patch and vulnerability management.

The ESAs published their first annual report on major ICT-related incidents on June 3, 2026, covering 2025. It counted 3,383 major incidents. Almost one third involved a failure at a third party, while cybersecurity events made up about 10%. The February 2025 TARGET Services outage and the April 2025 Iberian blackout produced many of the reports.

For incident reporting teams, the third-party share matters most. It ties each filing back to what the firm knows about its suppliers.

Critical ICT provider oversight is now live

On November 18, 2025, the ESAs published their first list of designated critical ICT third-party providers, 19 in all. The list covers hyperscale cloud, data center, network and financial-sector technology providers. The ESAs built it from firms’ registers and a criticality assessment run with national authorities.

The ESAs said they will assess whether these providers have appropriate risk management and governance frameworks. They will keep engaging with them during upcoming examination activities, and the list will be updated every year.

The oversight does not replace a firm’s own duties. Banks and insurers must still keep a third-party risk management program, link contracts to critical functions, assess concentration risk, hold workable exit plans and secure audit and access rights. A weak register undercuts all of it, because the register is where the ESAs started.

The regulation leaves penalties for financial entities to member states. For critical providers it allows periodic penalty payments of up to 1% of average daily worldwide turnover. The sources reviewed for this article contain findings and supervisory statements, not fines against banks.

Bank supervisors set DORA compliance priorities

The European Central Bank named operational resilience and ICT capabilities as one of two overarching goals in its supervisory priorities for 2026 to 2028, published in November 2025. Law-firm summaries of the document describe an expectation that banks strengthen resilience in line with DORA, especially on ICT third-party risk and incident response. They also describe on-site inspection campaigns on cybersecurity and ICT third-party risk, plus work on threat-led penetration testing (TLPT).

TLPT applies only to firms their authorities identify, usually the largest and most systemic. These firms must run advanced tests of live systems at least every three years under Articles 26 and 27 of DORA. Commission Delegated Regulation (EU) 2025/1190 sets the detailed standards for how those tests are run.

For the other firms, the wider operational resilience rulebook still applies. Teams that want a primer can use RegTech Post’s DORA requirements guide.

What comes next for DORA compliance

The ESAs have said they will update the list of critical providers each year, which puts the next list around the first anniversary of the November 18, 2025 designation. Firms running TLPT will report their first completed tests to their authorities over the coming cycles, and the next register of information submission window opens under each national authority’s own timetable.