DORA: information register and ICT third-party management
The DORA information register is the inventory of every arrangement you have with ICT third-party service providers. In addition, supervisors collect it every year to monitor how much the financial sector depends on technology providers. Below: what it must contain, how to submit it in Spain, the Article 30 clauses and how to plan your exit.
In 30 seconds: Article 28(3) of DORA requires every financial entity to keep a register of information on its ICT contracts. The 15 templates of Implementing Regulation (EU) 2024/2956 set its format. After the first submission in April 2025, reporting is annual. Using that data, the European Supervisory Authorities (ESAs) designated 19 critical ICT providers in November 2025. Finally, services that support critical or important functions need stronger clauses and a tested exit strategy.
What is the DORA information register?
The Digital Operational Resilience Act, Regulation (EU) 2022/2554 (DORA), has applied since 17 January 2025. If you need an overview first, read DORA explained for non-financial companies.
Within that framework, Article 28(3) requires a register covering all arrangements for ICT services. Moreover, it must exist at entity level and, if you belong to a group, at sub-consolidated and consolidated level too. It also distinguishes the arrangements that support critical or important functions. The same article requires you to:
- Report at least once a year on new arrangements, providers and the services provided.
- Provide the full register whenever your competent authority asks for it.
- Notify the authority in good time of any planned contract for critical or important functions.
In practice, the DORA information register is a snapshot of your technology dependence. It therefore shows who provides each service, for which function and with which subcontractors.
What the templates in Regulation 2024/2956 require
The content comes from Commission Implementing Regulation (EU) 2024/2956, in force since 22 December 2024. There are 15 templates linked by keys, much like a relational database. As a result, an error in one table can invalidate another.
| Templates | What they capture |
|---|---|
| B_01.01 to B_01.03 | The entity maintaining the register, entities in scope and branches |
| B_02.01 to B_02.03 | Data on each arrangement and intra-group arrangements |
| B_03.01 to B_03.03 | Who signs each arrangement |
| B_04.01 | Entities using each ICT service |
| B_05.01 and B_05.02 | ICT providers and the subcontracting chain |
| B_06.01 | The entity’s functions and their criticality |
| B_07.01 | Assessment of each service: substitutability and exit options |
| B_99.01 | The entity’s own terminology |
The templates define the structure of the DORA information register down to the last field. In addition, each provider carries a unique code, usually its Legal Entity Identifier (LEI). Likewise, you must rank the subcontracting chain from the direct provider downwards.
DORA information register timeline: 2025 and the annual cycle
The first submission had an exceptional reference date. Since 2026, each entity has submitted its DORA information register once a year. However, national windows vary, so always confirm the dates with your supervisor.
| Date | Milestone |
|---|---|
| 17/01/2025 | DORA starts to apply and the register must exist |
| 1-22/04/2025 | CNMV window for the first submission, with data as at 31/03/2025 |
| 30/04/2025 | ESA deadline to receive the first registers |
| 31/12/2025 | Reference date for the 2026 submission |
| 1-29/03/2026 | CNMV window for 2026, with corrections allowed until 22/04/2026 |
| March every year | National supervisors forward the registers to the ESAs |
Towards the ESAs, the exchange format is xBRL-CSV, the EBA’s reporting standard. Even so, each supervisor sets its own entry channel. Validation rules also tighten every year, so a register that passed in 2025 may fail in 2026.
Who receives the register in Spain
Each entity sends it to its competent authority, which then forwards it to the ESAs. Spain has three:
- Banco de España (the central bank): credit, payment and e-money institutions, using its own DORA XBRL taxonomy.
- CNMV (the securities regulator): investment firms and asset managers. For 2026 it published an operational guide with its own Excel template.
- DGSFP (the insurance and pensions supervisor): insurers, reinsurers and pension funds.
We also have sector guides for banking and fintech and for insurers.
From your register to critical ICT providers (CTPPs)
The ESAs use the registers to measure how much the sector depends on each provider. With that data, on 18 November 2025 they published the first list of critical ICT third-party providers. There are 19, including AWS, Google Cloud, Microsoft, Oracle, SAP and IBM.
Since then, the ESAs have overseen those providers directly. Even so, the designation does not shift your responsibility. Your firm still answers for third-party risk, for its contracts and for its own DORA information register. The register also helps you measure the concentration risk covered by Article 29 before signing.
Minimum contractual clauses under Article 30
The register is only reliable if your contracts hold the information it asks for. Therefore, Article 30(2) sets minimum content for every ICT arrangement:
- A description of the services and whether the provider may subcontract them.
- Locations where the provider delivers services and processes data, with notice of any change.
- Protection of the availability, integrity and confidentiality of data.
- Access, recovery and return of data if the contract ends.
- Service levels, help during ICT incidents and cooperation with the authorities.
- Termination rights and minimum notice periods.
When the service supports critical or important functions, Article 30(3) also adds:
- Precise quantitative and qualitative service targets.
- Tested contingency plans and appropriate ICT security measures.
- Cooperation in threat-led penetration testing (TLPT).
- Unrestricted rights of access, inspection and audit.
- Exit strategies with a mandatory transition period.
For its part, Delegated Regulation (EU) 2024/1773 details the policy for these contracts. Likewise, Delegated Regulation (EU) 2025/532 governs their subcontracting.
Exit strategy: Article 28(8)
For each service supporting critical or important functions, you need a documented exit strategy. In particular, it must cover provider failure, serious service deterioration and contract termination. It also has to let you exit without disrupting your business or harming clients. In addition, you must test your exit plans and review them periodically. So link each plan to its row in the register: you will see at once which contracts already have a viable exit.
How to prepare your DORA information register step by step
- Inventory all ICT services, including those your own group provides.
- Map your functions and flag the critical or important ones.
- Obtain each provider’s LEI and check that it is valid.
- Document the subcontracting chain, starting with critical services.
- Review contracts against Article 30 and note what is missing.
- Validate the file in your supervisor’s test environment and then assign an owner to maintain it.
The most common errors are duplicate keys, invalid identifiers and empty mandatory fields. Supervisors reject a DORA information register with these flaws, and you then have to resubmit it in a rush.
This work fits with other frameworks. For example, if you already use ISO 27001 as a shortcut to NIS2, GDPR and DORA, you can reuse your supplier inventory.
Frequently asked questions
Who must keep a DORA information register?
Every financial entity covered by Article 2 of DORA, whatever its size. Proportionality shapes how you apply it, but it does not exempt you from keeping the register.
How often must you submit the DORA information register?
At least once a year, with data as at 31 December of the previous year. In addition, your supervisor can ask for the full register at any time.
What format does the DORA information register use?
The ESAs receive the data in xBRL-CSV, following the 15 templates of Regulation 2024/2956. By contrast, in Spain Banco de España uses its XBRL taxonomy, while the CNMV accepts an Excel template. Therefore, always follow your supervisor’s instructions.
Do intra-group ICT providers have to be included?
Yes. DORA treats group companies that provide you with ICT services as third-party providers too. Those arrangements therefore appear in the register as well.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC keeps your DORA information register alongside your other regulations: one control, many regulations. You record each ICT provider, the function it supports and its subcontracting chain, service by service. In addition, you link contracts and exit plans as evidence you can reuse for NIS2 and ISO 27001. The regulatory clock also alerts you before each submission window and each renewal. See the DORA guide or request a demo.
