- DORA has applied since 17 January 2025. Article 28(3) requires a register of all ICT third party arrangements, using templates set by Commission Implementing Regulation (EU) 2024/2956.
- In 2026 the EBA added a content review before the 31 March deadline, then ran data quality checks in April. Many registers had to be resubmitted in April and May 2026.
- The most common problems were placeholder values, missing LEIs and other reference data, invalid field entries, and difficulty identifying providers and their ultimate parent companies.
What the register is and who submits it
DORA applies to a wide range of financial entities, including UCITS management companies and AIFMs. Each must maintain a register of information on all its contractual arrangements for ICT services provided by third parties, and report it to its competent authority. In Ireland that is the Central Bank, through its portal.
The templates cover, in broad terms:
- the financial entity and the entities in its group that use the services
- each contractual arrangement and its key terms
- each ICT third party provider, its identifiers and its ultimate parent
- the ICT services provided and the business functions they support
- the criticality of those functions
- the chain of subcontractors for services that support critical or important functions
- how easy each provider would be to replace, and the exit arrangements
Supervisors use the registers to understand concentration risk across the sector, and the European Supervisory Authorities use them to help identify critical ICT third party providers for EU level oversight. A poor register is therefore not only a filing problem. It weakens your own view of your ICT dependencies.
How the Irish submissions have gone so far
2025, the first collection. Firms submitted their first registers through the Central Bank portal between 1 and 4 April 2025. Many submissions failed EBA validation and had to be resubmitted. Files were not packaged correctly or not in the required xBRL CSV format, did not follow the EBA technical specifications, or were missing reference data such as Legal Entity Identifiers (LEIs). The Central Bank said most failures came from the reporting package itself, not the portal.
2026, the second cycle. The portal opened for March 2026, with a deadline of 31 March. In the week of 16 February 2026 the EBA announced an additional review of the content of submitted registers, so firms received feedback straight away and could correct and resubmit before the deadline. The EBA then ran data quality checks in April 2026, and many registers failed them, leading to resubmissions through April and May. The recurring issues were generic or placeholder values, partial reference data, invalid field entries and difficulty identifying ICT providers and their ultimate parent entities.
2027, the third cycle. The portal is expected to open on 1 March 2027, with final submissions due by 31 March 2027. Expect the data quality bar to keep rising.
Why registers fail
- Contract data sits in procurement, legal and IT systems that do not talk to each other.
- Provider names are recorded inconsistently, so the same company appears three different ways.
- LEIs are missing, out of date or belong to the wrong group entity.
- Fields are filled with placeholders to get past validation, which the 2026 content review now catches.
- Services are not linked to the business functions they support, so criticality cannot be shown.
- Subcontracting chains for critical services are incomplete.
- The xBRL CSV package is built by hand or with a conversion step nobody fully understands.
- The register is rebuilt once a year, so it is out of date for the other eleven months.
What a maintained register looks like
| Data area | What it covers | Usual owner |
|---|---|---|
| Entity | The financial entity, group entities using the services, LEIs | Compliance or finance |
| Contracts | Contract references, dates, notice periods, governing law | Legal or procurement |
| Providers | Legal name, LEI, country, ultimate parent | Procurement or vendor management |
| Services | Service type, data involved, where it is stored and processed | IT |
| Functions | Business functions supported and their criticality | Operations and risk |
| Subcontracting | Subcontractors behind services for critical or important functions | Vendor management |
| Exit | How replaceable the provider is, exit plan status | Risk and IT |
The point of the table is ownership. Each area has a natural owner who keeps it current as part of normal work, rather than a compliance team chasing everyone in February.
How to build a register that passes first time
1. Keep one source of truth for contracts and providers
A small, controlled database with defined fields beats a workbook emailed around the firm. Every new contract, renewal or exit updates it as part of the procurement process.
2. Enrich with reference data automatically
Look up LEIs and ultimate parent entities from authoritative sources such as the GLEIF database, check they are active and record when they were last verified.
3. Link services to functions and criticality
Connect each ICT service to the business functions it supports and to your criticality assessment. This is what turns the register into a picture of operational dependency.
4. Validate every month, not every March
Run the published EBA validation rules and your own checks against the register monthly. Problems found in October are cheap to fix. Problems found on 30 March are not.
5. Generate the submission package automatically
Produce the xBRL CSV package from the database with a tested, repeatable process, so the file you submit always matches the data you hold.
6. Keep the history
Record what changed, when and why. The same data then supports incident reporting, exit planning and audit, not only the annual submission.
7. Run a dry run in January
Generate the full package early in the year, validate it and get sign off, so March is a submission rather than a project.
The register as an operational asset
Done well, the register answers questions your board and your Central Bank supervisor will ask anyway. Which providers support our critical functions? Where are we concentrated? Which contracts lack exit plans? Which services would an outage at one provider take down? For fund management companies, the same provider and contract data also supports delegation oversight and the more detailed delegation reporting coming under AIFMD II.
Where AI helps, and where it should not
AI can extract contract terms such as dates, notice periods and governing law from PDF agreements, propose LEI matches for provider names, flag entries that look like placeholders and spot inconsistencies between related fields. A person should confirm each extracted value before it enters the register, and the final submission should be produced by a deterministic, tested process.
A timeline to 31 March 2027
- November and December 2026: review the feedback from the 2026 cycle and fix the root causes, not only the individual errors.
- January 2027: complete missing data, refresh LEIs and parent entities, and run a full validation.
- February 2027: produce a dry run package, resolve findings and get sign off.
- March 2027: submit early in the window to leave time for any EBA feedback.
How HST can help
HST Solutions builds the data models, validation and reporting pipelines behind regulatory submissions for fund management companies and other financial services firms. We can turn a register held in spreadsheets into a maintained source of truth with automated enrichment, monthly validation and a repeatable xBRL CSV output. HST is ISO 27001 and ISO 22301 certified and works in line with DORA.
If your register still gets rebuilt every March, talk to an engineer, or see how we work with fund managers, ManCos and administrators.
FAQ
Sources
- Reporting Registers of Information, Central Bank of Ireland
- DORA Communications and Publications, Central Bank of Ireland
- DORA Register of Information, Forvis Mazars Ireland
- Irish firms to submit Register of Information by March 2026 deadline, Simmons & Simmons
- DORA Register of Information regulatory reporting, Vixio
- DORA Register of Information: achieving a key milestone, Mondaq
