DORA Register of Information Requirements Explained (Guide for EU Financial Entities)

Under the Digital Operational Resilience Act (DORA), all in-scope EU financial entities must submit a detailed Register of Information. Regulators like the European Banking Authority (EBA) use this Register to monitor ICT dependencies, assess exposure to critical ICT providers, and identify concentration risk across the EU financial system.

Nearly 93.5% of firms failed the dry run at the end of 2024, largely due to data quality problems and incorrect mapping. With mandatory annual reporting beginning in 2025, firms across the EU must improve their approach for the next DORA submission.

Let’s get into it. 💪🏻

What the DORA Register of Information Contains

The DORA Register of Information consists of 15 structured tables that map a firm’s entire ICT environment. These tables are designed to capture all ICT arrangements and the interdependencies across providers and functions.

The Register of Information includes:

1. Entity details
2. List of entities
3. List of branches
4. Contract overview
5. Contract details
6. Intra-group contracts
7. Signing entities
8. ICT providers
9. In-group providers
10. Service users
11. Subcontractors
12. Supply chain
13. Functions list
14. ICT assessment
15. Definitions used

Who Must Comply and When

Almost all financial entities in the EU must submit the Register of Information, regardless of size or number of ICT contracts. This includes:

• Banks and credit institutions
• e-Money and payments firms
• Investment firms
• Insurers
• Crypto-asset service providers (MiCA + DORA interaction)
• Trading venues
• FinTech and RegTech entities in scope

Frequency of reporting:

• Annual reporting
• Additional reporting when material ICT changes occur (per DORA Articles 28–30)

These timelines mean firms need ongoing governance of ICT data, not just point-in-time collection.

How to Complete the Register of Information (Using the 4 Keys)

Now, most importantly, let’s take a look at the four keys that connect all 15 tables. These keys determine how data links together and form the backbone of the Register.

Key 1: Contract Reference Number

• Unique internal ID for each ICT contract
• Must be consistent across all templates
• Applies to external and internal/intragroup providers

Key 2: Legal Entity Identifier (LEI)

• Required for the contracting entity and each direct ICT provider
• This is a 20-character code unique to each entity

Key 3: Function ID

• This is a unique function ID that you create from the LEI, the licensed activity + the function
• For example, if Salesforce supports your sales team for both your payment and e-money activities, you need two separate function IDs.

Key 4: ICT Service Type (Annex III Codes S01–S19)

• Classifies the service and determines applicable data fields
• Examples include S01 (ICT Project Management) and S02 (ICT Development)

Using these keys correctly is essential because all validation checks rely on them. Take a look at how these keys link across the 15 tables.

Step-by-Step Compliance Checklist

This checklist provides a practical step-by-step process to follow once the four keys are understood.

Step 1: Build the ICT Services Inventory

Begin by capturing all ICT services used across the organisation, including external and intragroup arrangements. Engage operational teams to ensure the list reflects actual usage. This step forms the foundation for the steps to follow.

Step 2: Assess Criticality

Next, determine whether each service supports Critical or Important Functions (CIFs) under Article 3(22). Identify material subcontractors under Article 30(2). This assessment helps determine which additional data fields will apply in later steps.

Step 3: Map the ICT Supply Chain

Once criticality is established, map the supply chain for each service.

• Assign the correct Annex III ICT service type
• Identify direct providers and any material subcontractors
• Rank them appropriately (Rank 1 = direct provider)
• Link all providers using contract references and ICT service types

Below is an example of what an ICT service supply chain looks like in practice.

Your direct ICT providers are always Rank 1.
They may use Rank 2 material subcontractors.
And those may rely on Rank 3 subcontractors.

The key point is that everyone in that chain sits in the same supply chain if they map back to the same contract reference number and the same Annex III ICT service type.

Step 4: Apply the Four Keys Consistently

Then, apply the four keys across every relevant template.

• Use the same contract reference number throughout
• Ensure each provider’s LEI is correct
• Apply Function IDs consistently across business units
• Verify that ICT service types match the service they describe

Step 5: Validate Data Quality

Finally, validate all fields. Check that all fields are complete and accurate. Follow the EBA’s Data Point Model (DPM) dropdown lists and coding rules carefully to avoid misreporting.

Lessons Learned from DORA 1.0

The dry run results show why firms must improve their approach ahead of the next DORA submission.

As mentioned above, 93.5% of firms failed the dry run 😰 meaning only 6.5% passed all 116 validation checks, with most failures being due to missing mandatory data.

Here’s where firms tripped up:

These lessons show where firms should focus in the next submission, particularly on supplier LEIs, service-type mapping, and consistent key usage.

Submit Your DORA Return 90% Faster with Complyfirst

Now, in case you’re wondering how we support firms with their DORA returns, here’s a quick overview. We focus on 4 key things:

1. Easy Uploads and Updates

Easily upload your own files or EBA templates, and reuse last year’s Register to avoid having to start from scratch.

2. EBA Guidance Built into Every Cell

Each cell you’re working in includes direct extracts from official EBA materials to remove having to search across different documents.

3. Real-Time, Plain-English Error Messages

Validate your data as you work, and fix issues with clear “how to fix it” steps.

4. 1:1 Expert Support

Most importantly, we’re here for you! We’re available via Slack, Teams, and Zoom for quick troubleshooting (even on deadline day 😬).

Watch Our DORA ROI Lessons-Learned Webinar with Fiona

After supporting firms through the first full year of DORA, Fiona hosted a live webinar with fscom sharing how financial entities across Europe responded to DORA, and what to do differently for the next submission. Have a watch below.

The DORA Register of Information is complex, data-heavy, and strictly validated. Firms must understand the 15-table structure, apply the four keys consistently, and document the full ICT supply chain, including subcontractors. With improved data governance, early preparation, and the right support, firms can avoid the high failure rates seen in DORA 1.0 and ensure smooth 2026 reporting.