Guide

Why an accepted 2026 register can fail in 2027

A register that CySEC accepted in February 2026 was checked against the EBA filing rules of that moment. Three rule versions later, the same file is not guaranteed to pass. Most of what rejects a package is mechanical, which is good news: it can be tested in minutes, before anyone opens a contract.

By Mark Pesah · Last reviewed 14 October 2026

How exacting the checks are

When the European Supervisory Authorities ran their voluntary dry run in 2024, 6.5% of the registers submitted passed all checks. The rest failed on structure, identifiers or references, not on substance. The checks have not become more forgiving since; they have become more numerous.

What changed in the filing rules since the 2026 filing

The EBA filing rules are the technical conditions every xBRL-CSV package must meet, regardless of which report it carries. Between v5.7 (November 2025, the version in force for the 2026 filing) and v5.9 (June 2026) there were three changes of substance:

Everything else that rejects packages predates 2026 and still applies: the generatingSoftwareInformation block is required and its absence is a known rejection; the encoding check (UTF-8, no byte-order mark) is blocking; monetary values must respect the accuracy bound; filing indicators are lower-case true; dates, countries and currencies follow ISO 8601, ISO 3166-1 alpha-2 and ISO 4217; every coded field takes a value from the EBA data-point model, never free text.

What fails inside the register itself

References that do not resolve

The register is fifteen linked tables. Every contractual arrangement reference used in B_02.02, B_02.03, the B_03 templates, B_04.01, B_05.02 and B_07.01 must exist in B_02.01; every provider must exist in B_05.01; every function identifier in B_06.01. A single dangling reference fails the package (EBA validation error 807). This is the most common way a register that was assembled by hand across several spreadsheets fails after an edit.

Identifiers

An LEI is checked for its checksum and its status: a lapsed or retired LEI is a finding. Identifier types are constrained by who the provider is — legal persons carry an LEI or EUID, non-EU legal persons an LEI only, and company-register or VAT numbers are accepted only for individuals acting in a business capacity. A provider that had a valid LEI in January 2026 may have let it lapse since.

Conditional fields for critical or important functions

Marking a service as supporting a critical or important function switches on obligations elsewhere: the conditional fields in B_02.02, a complete supply chain in B_05.02 and an assessment row in B_07.01. A register where the flag was set but the dependent rows were not completed fails on consistency.

Content that moved

Contracts were renewed, providers were replaced, notice periods renegotiated, a cloud provider moved its data location. None of that is a validation failure; all of it is a register that no longer describes the firm. The 2027 filing is a full register as at 31 December 2026, not a copy of the 2026 one with a new date.

Same templates, different rules

The February 2027 filing stays on the DORA module of EBA framework 4.0 (module 1.1.0). The EBA has scheduled technical amendments to the DORA module for framework 4.4, Phase 2, first reference date 31 December 2027 — the register due in early 2028. So the templates a firm filled in 2026 are the templates it fills in 2027; the filing rules and the content are what changed.

What to do with this

1. Run the package you filed in 2026 through the current filing and validation rules before changing anything. The result is a list of rule IDs, and it tells you whether your problem is mechanical, identifiers, or content.
2. Fix identifiers first. An LEI application or renewal is not instant, and providers rarely answer the first email.
3. Only then update the content from the contracts, and validate again before the compliance officer signs off.

The first step is what we offer for free, below.