Sovereignty · Updated 10 November 2026 · 9 min read

The DORA register of information on ICT third-party providers, explained for 2026

What the register holds, which suppliers and subcontractors belong in it, how the yearly filing runs, and what to ask a hosting provider so you can fill in its rows.

View as Markdown

The register of information is a structured record that every financial entity under DORA keeps of all its contracts for ICT services, from cloud hosting to software subscriptions. Article 28(3) of Regulation (EU) 2022/2554 requires it, Commission Implementing Regulation (EU) 2024/2956 fixes its templates, and supervisors collect it every year. The ESAs then use the combined registers to decide which providers are critical for the EU financial sector.

This page explains the register itself. For the wider contract rules DORA and NIS2 put on your hosting choices, read NIS2 and DORA for hosting. None of this is legal advice.

The register at a glance

Question	Answer
Legal basis	DORA Article 28(3), with templates in Implementing Regulation (EU) 2024/2956
Who keeps it	Financial entities in DORA's scope, at entity level and, for groups, at sub-consolidated and consolidated level
What it covers	All contractual arrangements for ICT services from ICT third-party service providers
Extra depth	Subcontractors that effectively underpin services supporting critical or important functions
Provider identifier	A valid and active LEI or EUID for providers that are legal persons
How often	Kept up to date continuously, reported to your supervisor at least yearly
Reference date	31 December of the year before the filing
What the ESAs use it for	Designating critical ICT third-party service providers for EU-level oversight

What goes into it

The implementing regulation sets out fifteen templates in its Annex I. Read together, they describe who you are, what you've signed, with whom, who sits behind them, and what each service supports.

B_01.01 to B_01.03: the entity keeping the register, the entities in the consolidation, and branches outside the home country
B_02.01 to B_02.03: general and specific details of each contractual arrangement, and links between intra-group and external arrangements
B_03.01 to B_03.03: which entities sign for receiving services, which providers sign for delivering them, and which group entities sign on behalf of others
B_04.01: the entities that actually use each ICT service
B_05.01 and B_05.02: the direct providers and subcontractors, and the shape of each ICT service supply chain
B_06.01: the functions of your business those services touch
B_07.01: your assessment of services that support a critical or important function
B_99.01: the terms and closed lists you used

Which providers belong in it

DORA defines ICT services broadly: digital and data services provided through ICT systems to internal or external users on an ongoing basis, including hardware as a service. Traditional analogue telephone services are the stated exception. In practice your web host, cloud provider, SaaS tools and managed IT support all count.

The register maps a chain, not just a supplier list. The provider you signed with has rank 1. Anyone it relies on for that service, such as the data centre or cloud underneath, has a rank above 1. You must record:

every ICT service you buy directly from a third-party provider
every subcontractor that effectively underpins a service supporting a critical or important function, or a material part of one
ICT intra-group service providers, where a group entity supplies ICT mainly to other group members

For services that support a critical or important function, you have to get identifiers for those subcontractors through your direct provider. That's why the answers your host gives you matter.

How the yearly filing works

The ESAs' Board of Supervisors decided on 8 November 2024 that national authorities send the full registers to the ESAs by the end of March each year. Each authority sets its own window and format, so check yours. For the 2026 filing, which used 31 December 2025 as its reference date:

Netherlands, DNB: open from 2 March 2026 with a deadline of 20 March 2026, as xBRL-CSV or through DNB's own Excel template.
Malta, MFSA: a window from 1 January to 21 March each year from 2026 onwards, in DORA-compliant plain CSV, and a filing counts only once its status shows Accepted.
Luxembourg, CSSF: due by 31 March 2026, with third-country branches of credit institutions given until 30 June 2026 on a best-effort basis.

The CSSF said the ESAs would run further quality checks during April 2026 and that a refused register had to be corrected and filed again. The MFSA is explicit that missing its window can lead to regulatory action. The MFSA also tells significant banks supervised directly by the European Central Bank to follow the ECB's instructions on filing.

If your authority repeats the same calendar, the next register reflects your contracts on 31 December 2026 and falls due in the first quarter of 2027.

What the registers were used for

On 18 November 2025 the ESAs published the first list of designated critical ICT third-party service providers. They built it from the registers financial entities had filed, then assessed systemic importance, reliance for critical or important functions, and how hard each provider would be to replace. The list has 19 entries, among them Amazon Web Services EMEA Sarl, Google Cloud EMEA Limited, Microsoft Ireland Operations Limited, Oracle Nederland B.V., Orange SA, SAP SE and Deutsche Telekom AG.

Designation puts these providers under direct ESA oversight. It doesn't take any duty off you: they still appear in your register, and you still assess them like any other provider.

What to ask your hosting provider

To fill in the rows for a hosting or cloud provider, you'll usually need:

The exact legal entity you contract with, its country and its LEI or EUID.
The services you get, described clearly enough to map to the ICT service types in the templates.
Where the service runs and where data is stored, by country.
The subcontractors behind the service, with their legal names, countries and identifiers, at least where the service supports a critical or important function.
Contract dates and notice periods, so your contract records and exit planning line up.
What a replacement would involve, for your own assessment of services that support critical or important functions.

How Eurobase would appear in a register

Here's how the public facts map, as an example of a small European web host. Eurobase is registered as a business in Warsaw, Poland, and its billing terms describe it as a Polish VAT-active sole proprietorship. The implementing regulation exempts individuals acting in a business capacity from the LEI or EUID rule, so agree with your compliance team which identifier fields apply before you file.

Rank	Provider	Country	Role for your app
1	Eurobase	Poland	Builds, hosts and serves your app
2	Scaleway SAS	France / EU	Hosting, runtime, database, storage and email infrastructure
2	GitHub, Inc.	United States	Repository connection and deploy triggers, only when you connect GitHub
2	GitLab Inc.	United States	Repository connection and deploy triggers, only when you link a gitlab.com repository
2	Codeberg e.V.	Germany	Repository connection and deploy triggers, only when you link a codeberg.org repository

The servers behind your app are European infrastructure run by Scaleway, a French provider. Work toward ISO 27001 and SOC 2 has started, but neither certificate is held yet. The public terms don't set a service level unless a signed agreement does, and the DPA lets you choose deletion or return of customer personal data when the service ends. If you classify the hosted service as supporting a critical or important function, the public terms fall short of the contract content DORA Article 30(3) requires, and you'd have to negotiate a signed agreement or pick another host. The subprocessor list is public, and For why the two US rows deserve attention, read EU region vs EU company.

Frequently asked questions

Does a small fintech need a register of information?

If you're a financial entity listed in DORA Article 2, yes. Article 28(3) applies to all financial entities in scope and covers all ICT contracts, whatever their size. Proportionality and lighter rules for microenterprises affect other parts of DORA, but not whether the register exists.

Do I have to list free tools and small SaaS subscriptions?

The register covers all contractual arrangements for ICT services, and the definition of ICT services is broad. So before leaving out a free tier or a small tool you rely on, check how your supervisor reads it. Your supervisor's FAQ and the EBA's reporting materials are the place to settle edge cases.

How deep into subcontractors do I have to go?

For every ICT service, you record the direct provider. For services that support a critical or important function, you also record every subcontractor that effectively underpins it, with ranks showing where each sits in the chain.

What is an LEI and does my provider need one?

An LEI is a Legal Entity Identifier, a global code for legal entities. The implementing regulation asks you to identify providers that are legal persons with a valid and active LEI or an EUID, the European Unique Identifier from EU business registers, and both where available. If your provider has neither, ask early, well before your filing window opens.

Is the register the same as the list of critical providers?

No. Your register lists your own contracts. The list of critical providers is what the ESAs designate after analysing every register across the EU. A provider can be critical to your business without being on the ESAs' list.