Resources / Guide

DORA register of information

Updated 16 October 2026

Article 28(3) of Regulation (EU) 2022/2554 (DORA) requires every financial entity to keep a register of information on all its contractual arrangements for information and communication technology (ICT) services provided by third parties. Implementing Regulation (EU) 2024/2956 sets the register out in 15 templates.

The 15 templates

1. Entity maintaining the register of information
2. List of entities within the scope of consolidation
3. List of branches
4. Contractual arrangements: general information
5. Contractual arrangements: specific information
6. List of intra-group contractual arrangements
7. Entities signing the contractual arrangements for receiving ICT service(s) or on behalf of the entities making use of the ICT service(s)
8. ICT third-party service providers signing the contractual arrangements for providing ICT service(s)
9. Entities signing the contractual arrangements for providing ICT service(s) to other entities within the scope of consolidation
10. Entities making use of the ICT services
11. ICT third-party service providers
12. ICT service supply chain
13. Functions identification
14. Assessments of the ICT services
15. Definitions from entities making use of the ICT Services

Filing the register

The register is submitted to the entity's competent authority (in Greece, the Bank of Greece or the Hellenic Capital Market Commission, depending on the entity), which passes it to the European Supervisory Authorities. Submissions use the plain-csv report package of the European Banking Authority (EBA) for reporting framework 4.0: one CSV file per template, with a report description, parameters and filing indicators, in one zip file named after the entity's Legal Entity Identifier (LEI).

Where registers fall short

• Arrangements that support a critical or important function need most of B_02.02 and all of B_07.01.
• Every LEI must pass the ISO 17442 check digits.
• A provider that belongs to the group must name its ultimate parent in B_05.01.
• Storage and processing countries are keys and are paired in every combination.

Build and file the register in Vardion

• Fill the register field by field, with the closed lists of Implementing Regulation (EU) 2024/2956 built in.
• See every missing mandatory field by its code before the authority does.
• Fill the functions from your business impact analysis instead of typing them twice.
• Download the filing package, checked before download, and a spreadsheet for review.