Guide

The DORA Register of Information, explained

Every financial entity under DORA keeps a register of all its contractual arrangements for ICT services and files it with its supervisor once a year. In Cyprus that means an xBRL-CSV package through the CySEC XBRL Portal by 28 February. Here is what the register contains and who has to produce it.

By Mark Pesah · Last reviewed 14 October 2026

What the register is

Article 28(3) of DORA (Regulation (EU) 2022/2554) requires every financial entity to maintain and keep up to date a register of information on all contractual arrangements for the use of ICT services provided by ICT third-party service providers, and to make it available to its competent authority on request and at the yearly reporting date. The European Supervisory Authorities set the content and structure in implementing technical standards (Commission Implementing Regulation (EU) 2024/2956), and the EBA publishes the templates, the data-point model and the validation rules that every submission is checked against.

It is not a questionnaire. It is a relational data set: fifteen linked tables, each row in one table pointing at rows in others. A register "fails" when the data does not hold together, long before anyone reads what it says.

The fifteen templates

How the templates link

Three keys hold the register together, and every reference must resolve or the package is rejected at validation:

• The contractual arrangement reference number (B_02.01) is reused in B_02.02, B_02.03, the B_03 templates, B_04.01, B_05.02 and B_07.01. It is the entity's own numbering; once chosen, it has to be used consistently.
• The provider identifier and identifier type (B_05.01) identify every provider wherever it appears. Legal persons are identified by LEI or, for EU companies, EUID; a legal person outside the EU needs an LEI. Company-register numbers, VAT numbers and the like are allowed only for an individual acting in a business capacity. An LEI that has lapsed or been retired is a finding, not a value.
• The function identifier (B_06.01, F1, F2 …) ties each ICT service to the business function it supports, and marks the ones that are critical or important. For those, the conditional fields in B_02.02, a full supply chain in B_05.02 and an assessment row in B_07.01 become mandatory.

Each ICT service is classified into one of nineteen types defined by the standard, from S01 (ICT project management) through S13 (software licensing), S17 (cloud infrastructure) and S19 (cloud software) — a closed list, never free text. Dates, countries and currencies follow ISO formats; every coded field takes its value from the EBA data-point model.

Who files it in Cyprus

CySEC's Circular C751 addresses Cyprus Investment Firms, crypto-asset service providers authorised under MiCA, authorised AIFMs, UCITS management companies, central securities depositories and trading venues. Being a micro-enterprise simplifies parts of DORA's ICT governance; it does not remove the register. Payment institutions, e-money institutions and account-information service providers are also financial entities under DORA and report to the Central Bank of Cyprus; the CBC's submission channel is not covered by this guide.

Firms authorised during 2026 prepare their first register for 28 February 2027. For a crypto firm that typically means twenty to forty ICT providers, many of them without an LEI yet, which is why the identifier work is worth starting before the contracts are read.

Which taxonomy applies in February 2027

The register is filed on the DORA module of the EBA's reporting framework 4.0 (module version 1.1.0). The EBA has scheduled technical amendments to the DORA module in framework 4.4, Phase 2, with a first reference date of 31 December 2027 — that is, the register due in early 2028. The 2027 filing therefore uses the same templates as 2026; what changed in between is the filing rules and, for most firms, the contracts.