Line4

In forceDigital operational resilience (DORA)Last checked 11 November 2026

DORA register of information (ICT third-party contracts)

A regulatory return listed by the European Banking Authority (EBA), European Union.

Financial entities keep a register of all their contracts with ICT (information and communication technology) third-party service providers. The EBA says the register is used by competent authorities and the European Supervisory Authorities (ESAs) to supervise compliance with DORA and to designate critical ICT third-party service providers that will be subject to EU oversight. Source

Official title: ITS on the content of the registers of information under DORA (Commission Implementing Regulation (EU) 2024/2956 on standard templates for the register of information)

The facts

Who files
All financial entities in scope of DORA keep the register at entity level and, for groups, at sub-consolidated and consolidated level (ITS Article 3(1); EBA preparations page). Competent authorities request the full registers from the entities and submit them to the ESAs, through the EBA's EUCLID platform (ESAs Decision ESA 2024 22, Articles 2, 3 and 6). Registers go at individual level for entities not in a group, and at the highest level of consolidation in the Union for groups (Article 3). The EBA's own wording: 'submission of the registers of information to the competent authorities that will provide the collected registers to the ESAs for the purposes of designation of the CTPPs.' Source
How often
Authorities submit 'on an annual basis' (ESAs Decision Article 4(1)). The ITS sets no reporting frequency; entities must keep the register up to date and review it regularly (ITS Article 3(3)). Source
Deadline
Authorities to the ESAs: 'by 31 March' each year, reference date '31 December of the calendar year preceding the reporting date' (ESAs Decision Articles 4(2) and 5(1)(a)). First round: reference date 31 March 2025, due 30 April 2025 (Articles 4(3) and 5(2)(a)). Entities to authorities: the EBA FAQ says 'the competent authorities will fix earlier deadlines for the financial entities to report the registers to the competent authorities', and 'The ESAs do not maintain a record of such individual deadlines' (FAQ questions 11 and 12). Format: plain-csv (FAQ question 18). Source
Format
xBRL-CSV. The EBA takes these reports only in xBRL-CSV, whatever the reference date (CSV adoption policy of release 4.2). Source
How it is filed
Filing routes recorded for the EBA: EUCLID (European Centralised Infrastructure of Data); Pillar 3 data hub (P3DH) submissions. See how firms file with the EBA.
Status
In forceThe 4.2 page says the DORA 4.2 version 'will not be applied, as it will be replaced by version 4.3'; the 4.3 page lists no DORA change; the 4.4 page lists 'Amendments to DORA reporting - Technical amendments to DPM and taxonomy' with expected first reference date 12/2027 (Phase 2). The EBA page 'Preparations for reporting of DORA registers of information' links the 4.0 reporting framework as the 'Reporting technical package'. The DORA ITS product page itself still shows the draft as 'Not yet applicable'; the 4.2 page lists the product as 'Status: In force'. Source
Legal basis
Group
Digital operational resilience (DORA)

Templates (15)

The tables and forms inside the return. Plain name first, the EBA's code in brackets.

  • Entity maintaining the register of information (B 01.01)
  • List of entities within the scope of the register of information (B 01.02)
  • List of branches (B 01.03)
  • Contractual arrangements - General Information (B 02.01)
  • Contractual arrangements - Specific information (B 02.02)
  • List of intra-group contractual arrangements (B 02.03)
  • Entities signing the Contractual arrangements for receiving ICT service(s) or on behalf of the entities making use of the ICT service(s) (B 03.01)
  • ICT third-party service providers signing the Contractual arrangements for providing ICT service(s) (B 03.02)
  • Entities signing the Contractual arrangements for providing ICT service(s) to other entity within the scope of consolidation (B 03.03)
  • Entities making use of the ICT services (B 04.01)
  • ICT third-party service providers (B 05.01)
  • ICT service supply chains (B 05.02)
  • Functions identification (B 06.01)
  • Assessment of the ICT services (B 07.01)
  • Definitions from Entities making use of the ICT Services (B 99.01)

Templates of module DORA in EBA release 4.0, read from the module's entry point in the taxonomy package; parts of a template split into sub-tables (a, b, c) are listed once. Source

Validation rules

49 rules, as counted from the EBA's published material. Software can run them exactly as published. Source

How they are written: Excel list with one row per rule and module version: an expression column in the EBA's DPM-XL syntax, severity (error or warning), active status and reference-date range. The same rules ship as XBRL Formula assertions in the taxonomy package..

EBA's list applies the active DORA_4.0 rules to reference dates from 2025-03-31 with no end date set.

The rules, on eba.europa.eu

How they were counted

Distinct rule codes listed for module DORA_4.0 in EBA's validation rules list VR_4.4.phase1_.xlsx ((from 4.0) EBA_Validation rules, latest update 12/10/2026) with IsActive = Active: 49 of 71 listed. 0 of the active rules have severity error; the rest are warnings.

Counts are in the EBA's own unit, so they are not comparable with other regulators' counts.

Public data

No published data from this return was found. No publication of this return's data found on the EBA's risk analysis and data pages (checked 2026-11-11). Source

Official documents (18)

The EBA's own files, with the size and SHA-256 fingerprint of each as downloaded on 11 November 2026, so anyone can tell whether a copy is the same version.

Sources

Every page and document this return's facts were read from.

Knowing exactly what is collected, in what format and under which rules is the first step to real-time supervision. Line4 builds SupTech software for financial regulators that runs checks like these as each return arrives.

Line4's text and records here are free to reuse under CC BY 4.0. Please credit: “Source: Line4 regulatory submissions library (CC BY 4.0), https://www.line4.ai”. The regulators' documents, forms, taxonomies, rules and data belong to them: see EBA's reuse terms. This describes what regulators publish. It is not legal or regulatory advice: always rely on the regulator's own text.

Contains material from the European Banking Authority (EBA), https://www.eba.europa.eu, reproduced with the source acknowledged as the EBA's legal notice requires. Source: European Banking Authority.

Last checked 11 November 2026.