DORA register of information: 2027 annual submission

The register of information is a structured list of every contract a financial entity has with information and communication technology (ICT) third-party service providers, such as cloud, software and data providers. The Digital Operational Resilience Act (DORA) (external site) requires it in Article 28(3).

The register shows supervisors which ICT providers the financial sector depends on, and for which functions. The European Supervisory Authorities (ESAs) use the registers to identify critical ICT third-party providers, which then fall under EU oversight (EBA (external site)).

Each year the register is reported as it stood on a reference date. For the first cycle in 2025 the reference date was 31 March 2025; from 2026 onwards it is 31 December of the preceding year (EBA (external site)).

The 2027 report therefore shows the register as at 31 December 2026. As an example, a contract signed on 15 December 2026 belongs in the 2027 report, while one signed on 5 January 2027 appears only in the 2028 report (EBA (external site).pdf)).

Entities report to their national competent authority, which checks data quality and sets its own earlier deadline. In Malta, for example, the window runs from 1 January to 21 March (MFSA (external site)).

The content follows the templates of Implementing Regulation (EU) 2024/2956 (external site). The tables are linked by keys such as the contract reference number and the provider identifier, a legal entity identifier (LEI) or European unique identifier. Contracts that support critical or important functions are shown separately from the others (EUR-Lex (external site)).

The duty covers financial entities under DORA: banks, investment firms, asset managers, insurers, payment institutions, crypto-asset service providers and market infrastructures (EUR-Lex (external site)). The roles most directly concerned:

• Operational Risk Analyst: maps each ICT contract to the critical or important functions it supports.
• Regulatory Reporting Analyst: files the register in the ESA format before the national deadline.
• Data Governance Analyst: keeps the keys between contracts, providers and functions consistent.
• Master Data Specialist: maintains provider identifiers such as the LEI in the register.
• IT Auditor: tests the completeness of the register against contracts and ICT services in use.
• Cyber Risk Consultant (Banking): links third-party risk assessments to the register entries.

DORA has applied since 17 January 2025 (EUR-Lex (external site)). The templates were adopted on 29 November 2024 (EUR-Lex (external site)).

An ESAs Decision of 8 November 2024 set the collection cycle. Competent authorities sent the 2025 registers to the ESAs by 30 April 2025; from 2026 onwards their deadline is 31 March of each year (EBA (external site).pdf)).

For this entry, the reference date of 31 December 2026 and the ESA deadline of 31 March 2027 are both confirmed. Entity deadlines are earlier and set nationally (EBA (external site)).

Before DORA, EU law did not harmonise the monitoring of ICT third-party risk in finance. DORA set common rules on ICT risk management, incident reporting, resilience testing and third-party risk (EUR-Lex (external site)).

The ESAs used the first registers to designate the first critical ICT third-party providers on 18 November 2025 (EBA (external site)).