DORA Register of Information — what it is, who must file, and how to get it right

Under DORA Article 28(3), every in-scope EU financial entity must build, maintain and file a structured register of its ICT third-party arrangements. This guide explains what the register is, who must file, what the ESA template requires, and — crucially — the 2026 deadline for each national regulator, several of which fall before the 31 March date most vendors quote.

What it is

The Register of Information is the structured record, required by DORA Article 28(3), of every contractual arrangement your firm has with an ICT third-party service provider — cloud hosting, data feeds, key management, and the subcontractors behind them. It is filed annually to your national competent authority (NCA).

Who must file

All 22,000+ EU financial entities in DORA scope — banks, investment firms, payment and e-money institutions, insurers, fund managers, and crypto-asset service providers (CASPs). Scope follows your EU authorisation, not your headquarters: an EU-licensed subsidiary of a non-EU group is in scope.

What the ESA template requires

• Provider identity — legal name and a valid LEI for every ICT third party
• Contract scope, service type and the function it supports
• Service locations and where data is processed and stored
• Fourth parties — the material subcontractors behind your providers
• Criticality — whether the function is critical or important
• Exit strategies (Art 28(8)) and audit rights (Art 30) on critical providers

The annual cycle & format

The reference date is 31 December; the headline ESA deadline is 31 March — but each NCA sets its own date, and several are earlier. The format is XBRL-CSV: a structured machine-readable file the regulator's systems ingest. Excel is increasingly rejected outright (CySEC's Circular C751 bans it), so a register in the wrong format fails before its contents are even assessed.

Every NCA's 2026 deadline

This guide is general information, not legal advice. Deadlines and formats can change — confirm the current requirement directly with your national competent authority before you file.