Line4

In forceAll sectors: ICT third-party registers (EU, ESAs)Last checked 11 November 2026

Register of information on ICT third-party arrangements (DORA RoI)

A regulatory return listed by the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht) (BaFin), Germany.

Financial entities send BaFin their full register of contractual arrangements with ICT third-party service providers (Article 28(3) DORA). BaFin analyses it, for example for concentration risk, and passes it to the ESAs, which use the registers each year to designate critical ICT third-party providers. Source

Official title: Informationsregister nach Art. 28 Abs. 3 DORA

The facts

Who files
Firms supervised by BaFin that must apply DORA. BaFin can also ask for the register at other times. Source
How often
Annual, showing the position at 31 December of the previous year. Source
Deadline
The submission must be completed without errors by 31 March. BaFin announces at the start of each year when it starts accepting registers. No taxonomy changes are planned for the 2027 cycle. Source
Format
xBRL-CSV, Excel. Only through the MVP Portal (procedure 'Digital Operational Resilience Act (DORA)'): a structured xBRL-CSV file to the ESAs' taxonomy (EBA reporting framework 4.0), or BaFin's Excel template; test submissions any time via 'TEST: Digital Operational Resilience Act (DORA)'. Source
How it is filed
Filing routes recorded for the BaFin: MVP Portal (Melde- und Veröffentlichungsplattform, reporting and publishing platform); Direct submission to BaFin outside the MVP Portal. See how firms file with the BaFin.
Status
In force
Group
All sectors: ICT third-party registers (EU, ESAs)

Templates (0)

The library lists no templates for this return.

EU return: the templates and instructions are defined by the ESAs and published in the EBA's reporting framework. See the library's EBA entry eba/dora (docs/eba/dora.md). German firms use the ESAs' templates and taxonomy, or BaFin's Excel version. Source

Validation rules

The BaFin publishes the checks it runs on this return. They could not be counted from the published material. Software can run them exactly as published. Source

How they are written: ESA validation rules for the register, published by BaFin as an Excel file.

BaFin validates first, then the ESAs (up to 48 hours). The duty is met only when the ESAs have validated the register; the ESAs then check data quality and may ask for corrections through the MVP Portal. BaFin publishes a list of possible error codes and fixes.

The rules, on bafin.de

How they were counted

Not counted here: the ESAs' validation rules apply (see eba/dora).

Counts are in the BaFin's own unit, so they are not comparable with other regulators' counts.

Public data

No published data from this return was found. No data from the registers published by BaFin was found. Source

Official documents (7)

The BaFin's own files, with the size and SHA-256 fingerprint of each as downloaded on 11 November 2026, so anyone can tell whether a copy is the same version.

  • MVP-Portal

    List of returns · HTML

    BaFin's page on its reporting and publishing platform (Melde- und Veröffentlichungsplattform, MVP). It lists 44 specialised procedures (Fachverfahren) firms use to file with BaFin, with registration steps and manuals. Read in German; the English version lists only 18 of them.

  • Informationsregister und Anzeigepflichten (DORA)

    Filing rules · HTML

    Annual submission of the DORA register of information by 31 March (state at 31 December), via the MVP Portal, as xBRL-CSV to the ESAs' taxonomy or with BaFin's Excel template; BaFin and then the ESAs validate it.

  • Informationsregister Vorlage 1-00

    Template · XLSM · 396.9 KB · 25 March 2026

    SHA-256 4e50f0b6ea18show in full4e50f0b6ea18f83787cfcdfcf5d28ec527f91858c27e3fd0435c5100976e630b
  • Validierungsregeln (ESA) für das Informationsregister

    Validation rules · XLSX · 41.8 KB · 25 March 2026

    SHA-256 d545c0a33e48show in fulld545c0a33e48f00f366272b4203dbe6517256aa7f09a51039e9ecf86bca1f37f
  • Hinweise für die Einreichung des Informationsregisters

    Filing rules · PDF · 535.8 KB

    Not read in full; size and hash recorded.

    SHA-256 9067395f2e72show in full9067395f2e72e4bec9d8a6ce3a0e2c885ffb36efd40ac97bb3d4eb0f9c6db0af
  • Ausfüllhinweise für die Excel-Vorlage des Informationsregisters

    Instructions · PDF · 172.9 KB · 25 March 2026

    Not read in full; size and hash recorded.

    SHA-256 e8569633bb39show in fulle8569633bb39b0a08239027143bf9a5e0856b1a941bfac20aac9bf612ad90d30
  • Benutzerhandbuch für das MVP Portal

    Guidance · PDF · 3.3 MB

    User manual for registering on the MVP Portal and applying for specialised procedures. Not read in full; size and hash recorded.

    SHA-256 ad770ad7df85show in fullad770ad7df85ff9be0dcd51cb1dc67d7edb2db7c7c6cb35cab09ca5ff605278e

Sources

Every page and document this return's facts were read from.

Knowing exactly what is collected, in what format and under which rules is the first step to real-time supervision. Line4 builds SupTech software for financial regulators that runs checks like these as each return arrives.

Line4's text and records here are free to reuse under CC BY 4.0. Please credit: “Source: Line4 regulatory submissions library (CC BY 4.0), https://www.line4.ai”. The regulators' documents, forms, taxonomies, rules and data belong to them: see BaFin's reuse terms. This describes what regulators publish. It is not legal or regulatory advice: always rely on the regulator's own text.

© Federal Financial Supervisory Authority / www.bafin.de. Documents copied here are unchanged. The plain-English summaries are Line4's own; BaFin does not endorse this library.

Last checked 11 November 2026.