DORA register of information template (ITS 2024/2956)

This DORA register of information template sets out the 15 templates of Implementing Regulation (EU) 2024/2956, from B_01.01 to B_99.01, with their official column codes, a filled fictitious example and the consistency checks that most often make a submission fail. It implements Article 28(3) of DORA, which requires the register at entity, sub-consolidated and consolidated level.

The register of information is a set of 15 linked tables describing every contractual arrangement for ICT services that a financial entity, or its group, has with ICT third-party service providers, intra-group providers included. The tables are joined by four keys: the contractual arrangement reference number, the identifier of entities and providers (LEI or EUID), the function identifier and the type of ICT services (recital 8 of the ITS).

This page is the template itself. Scope, governance, build steps and the submission process are covered in the companion guide to the DORA register of information; the overall framework is summarised on the DORA page.

Download, free and without sign-up: Excel workbook (.xlsx).

Which templates make up the register of information?

The primary keys come from the ESAs' Data Model for DORA RoI published with the reporting package. A key column can never be empty in a submitted file.

What columns does each template contain?

The tables below reproduce the column codes and labels of Annex I to the ITS. "Required" summarises the fill-in option of the ITS; closed lists are in Annex I (entity types, hierarchy, termination reasons), Annex II (licensed activities) and Annex III (types of ICT services S01 to S19).

B_01.01 – Entity maintaining the register of information

B_01.02 – List of entities within the scope of consolidation

B_01.03 – List of branches

B_02.01 – Contractual arrangements – general information

B_02.02 – Contractual arrangements – specific information

B_02.03 – List of intra-group contractual arrangements

B_03.01, B_03.02 and B_03.03 – Signatories

B_04.01 – Entities making use of the ICT services

B_05.01 – ICT third-party service providers

B_05.02 – ICT service supply chain

B_06.01 – Functions identification

The ITS annex skips code 0050 in this template, while the ESAs' annotated table layout and data model number the same columns c0010 to c0100 without a gap. The "CSV" column gives the header expected in the reporting file.

B_07.01 – Assessments of the ICT services

B_99.01 – Definitions from entities making use of the ICT services

B_99.01 holds one internal definition for each option of six closed lists: type of contractual arrangement (B_02.01.0020), sensitiveness of data (B_02.02.0170), impact of discontinuing the function (B_06.01.0110), substitutability (B_07.01.0050), possibility of reintegration (B_07.01.0090) and impact of discontinuing the ICT services (B_07.01.0100). The ITS lays it out as rows R0010 to R0190 with columns C0010 to C0040; the ESAs' reporting layout turns it into a single row of 19 columns (0010 to 0190), one per option.

What does a filled register look like?

The example below is fictitious. Example Bank SA is a Belgian credit institution that keeps a consolidated register for itself and its subsidiary Example Tech Services SRL, an ICT intra-group service provider. It uses two ICT providers: Example Tech Services SRL, which operates the core banking platform, and Nimbus Cloud Europe BV, an external infrastructure provider contracted by Example Tech Services SRL to host that platform.

The LEIs are invented for this example: they pass the format check (18 characters plus two check digits) but do not exist in the GLEIF database and must never be submitted.

B_01.01 (entity maintaining the register)

B_01.02 (entities in scope)

The parent repeats its own LEI in 0060: the ESAs' reporting FAQ asks for this when an entity has no direct parent (DORA Q&A 2024_7278). Total assets are left empty for the non-financial entity.

B_02.01 (arrangements) and B_02.03 (intra-group link)

CA-2023-001 is the intra-group contract between the bank and Example Tech Services SRL; CA-2023-002 is the contract between Example Tech Services SRL and Nimbus Cloud Europe BV. Both must appear in B_02.01, and B_02.03 links them.

B_02.02 (one row per arrangement, entity, provider, function and service; main columns shown)

The platform supports two functions, so each arrangement takes two rows (Article 4(2) of the ITS: one value per field, one extra row per extra value). "Not applicable" fills the key column 0150 when no data is stored (DORA Q&A 2024_7280). The other columns (notice periods, governing law, data sensitiveness) are in the downloadable file.

B_03.01, B_03.02, B_03.03 and B_04.01 (who signs, who provides, who uses)

B_05.01 (providers and ultimate parents) and B_05.02 (supply chain)

Example Bank SA appears in B_05.01 because it is the ultimate parent of an ICT provider: the ultimate-parent code in 0110 must exist as a provider row (rule 807). Nimbus Cloud Europe BV signed with a group entity to serve the bank, so it is a direct provider (Article 1(1)(b) of the ITS) and takes rank 1. For rank 1, the ESAs ask to repeat the provider's code in 0060 instead of leaving the key empty (DORA Q&A 2024_7284).

B_06.01 (functions, ITS codes) and B_07.01 (assessment, main columns)

RTO and RPO are expressed in hours: 1 when under an hour, 0 when not defined. Each combination of LEI, licensed activity and function gets its own identifier (F1, F2…).

In a reporting file, closed-list values and countries are replaced by the ESAs' codes (for example eba_GA:BE for Belgium, eba_GA:qx2007 for "Not applicable").

Which consistency checks make a submission fail?

The ESAs run three layers of checks on each file: technical checks, DPM validation rules and business checks against reference data. Technical errors reject the file; the other findings are warnings, but authorities expect a corrected resubmission. Rule codes below are those published by the ESAs and explained by the CSSF.

Which keys must match between templates?

What did the dry run and the first submissions teach?

• In the ESAs' 2024 dry run, 6.5% of the 947 registers analysed passed all 116 data quality checks; missing mandatory information caused 86% of failures, with B_02.02 and B_07.01 holding most of the gaps.
• Close to 9,000 invalid LEIs were reported for financial entities themselves, often national codes typed in LEI fields.
• In their May 2025 observations on the first official reporting, the ESAs counted 58,170 EUIDs in an invalid format, against 2,717 found in BRIS and 258 not found.
• The ACPR noted that validation rules changed during the 2025 window, and that 2026 rejections came from wrong reference dates (2025-12-31 expected, not the filing deadline), incomplete archive trees and non-UTF-8 files.
• For 2026, the CSSF stated that the ESAs' checks had not changed since April 2025 but would be applied to more data fields.

How do you keep the register at group (consolidated) level?

• Scope. The parent undertaking sets the perimeter following sectoral consolidation rules; a sub-consolidated or consolidated register includes all financial entities and ICT intra-group providers of the group (Article 6 of the ITS).
• One register, three levels. A group may keep a single register that serves entity, sub-consolidated and consolidated levels, provided each entity can extract and report its own part (recital 2 of the ITS).
• What goes to the ESAs. Registers are reported at individual level for entities outside a group or whose parent is outside the Union with no Union parent, and otherwise at the highest level of consolidation in the Union (ESAs reporting FAQ).
• Hierarchy. B_01.02.0050 places each entity: ultimate parent, parent of a sub-consolidated part, subsidiary, not part of a group, or service provider to which all operations are outsourced; choose the highest level that applies.
• Shared identifiers. Keep one contract reference, one provider code and one function identifier per object across all entities; consistency between entity and consolidated levels is an explicit duty (Article 3(3) of the ITS).
• Intra-group chains. Report the intra-group contract and the external contract in B_02.01, and link them in B_02.03. Group entities established outside the Union that serve EU entities count as intra-group providers.

For the wider control set, the DORA readiness checklist (Excel, 45 requirements) covers the other DORA pillars.

Frequently asked questions

Is there an official Excel template?

The legal templates are in the ITS annex. For reporting, the ESAs publish a plain-CSV package (taxonomy, data model, validation rules); the Excel workbook and conversion tool released for the 2024 dry run were preparation tools.

Must ICT services that do not support critical functions be recorded?

Yes. Article 28(3) covers all contractual arrangements for ICT services. Several columns, and template B_07.01, only apply to services supporting critical or important functions.

Which subcontractors go into the register?

Only those that effectively underpin ICT services supporting critical or important functions (Article 3(2)(b) of the ITS).

What if a provider has no LEI?

EU legal persons are identified by an LEI or an EUID; legal persons outside the Union by an LEI only; alternative codes (CRN, VAT, passport, national ID) are for individuals acting in a business capacity. The ESAs accept another identifier for a third-country provider without an LEI, flagged as a data quality issue rather than rejected.

How often is the register updated and reported?

It is maintained continuously, reported at least yearly and provided in full on request (Article 28(3) of DORA). The next reference date is 31 December 2026.

Sources

• Regulation (EU) 2022/2554 (DORA), Article 28(3)
• Commission Implementing Regulation (EU) 2024/2956, templates for the register of information
• EBA – Preparations for reporting of DORA registers of information (data model, taxonomy, validation rules)
• ESAs – DORA RoI reporting FAQ, version of 28 March 2025
• ESAs – Observations from reporting of RoI: key common issues (updated 16 May 2025)
• ESAs – 2024 dry run summary report (17 December 2024)
• EBA Q&A 2024_7278 (direct parent), 2024_7280 (data storage location), 2024_7284 (recipient code at rank 1)
• CSSF – Guidance on ESA error messages for the DORA register (15 May 2025)
• CSSF – Submission timeframe 2026
• NBB – OneGate DOR domain (DORA_ROI)
• ACPR – DORA webinar of 23 January 2026