The DORA Register of Information: what goes in it, and how to keep it

Article 28(3) of DORA requires every financial entity to maintain a Register of Information on all its contractual arrangements for the use of ICT services. The format is set by an implementing technical standard, ITS (EU) 2024/2956, which lays the register out as a set of linked templates (B_01.01 through B_99.01). Your competent authority can request it, and the supervisors use the registers across the sector to map concentration risk.

In practice the register is where DORA's third-party pillar becomes real work, because it has to be complete, consistent, and current. A spreadsheet can get you started, but it tends to drift the moment a contract changes or a new subcontractor appears.

What belongs in the register

• Every ICT contractual arrangement: reference, type of ICT service, start and end dates, notice periods, governing law, the country where the service is provided and where data is stored, and the annual cost.
• Each ICT third-party service provider: name, an identifier (LEI or EUID where it exists), the type of provider, country, and its place in any subcontracting chain.
• The functions the service supports, and the critical-or-important-function determination for each, with the reasoning behind it.
• The entities in your group that are in scope, and which of them signs each arrangement.
• For services supporting a critical or important function: substitutability, whether an exit plan exists, and the alternative providers you have identified.

How to keep it submission-ready

The register is not an annual project, it is a standing record. The entities that stay ready treat it like an inventory: a contract cannot go live without a register entry, a provider change updates the chain, and the critical-function determination is revisited when a service materially changes.

Compliance One gives you the register as native, linked records rather than a spreadsheet: providers, contracts, functions and the CIF determination, with the contract automatically flagged as CIF-supporting the moment you link it to a critical function. You export each template to CSV in the official column shape, and the submission tracker holds the date your authority set, because DORA leaves that exact date to each competent authority rather than fixing one across the EU.

The register is the first thing a supervisor asks for and the last thing most teams keep up to date. Flip that order.