Skip to main content
Deep dive

What goes in the DORA register of information, and when is it due?

Every contract for ICT services, at entity and group level, in the 15 templates of Implementing Regulation (EU) 2024/2956, with each provider identified by LEI or EUID. Dutch firms file it once a year: in 2026 by 20 March with DNB or 31 March with the AFM, as xBRL-CSV. No 2027 window has been announced.

4 min read

What goes in the DORA register of information, and when is it due?

Every contractual arrangement your firm has for ICT services, recorded in the 15 templates of Implementing Regulation (EU) 2024/2956, at entity level and, for groups, at sub-consolidated and consolidated level. Each ICT third-party service provider that is a legal person is identified by a valid LEI or EUID. The duty sits in Article 28(3) of DORA and has applied since 17 January 2025.

Dutch firms file the register once a year. In 2026 the reference date was 31 December 2025 and the deadline was 20 March with DNB or 31 March with the AFM. Neither supervisor has announced a window for 2027.

At a glance

Legal duty

Regulation (EU) 2022/2554 (DORA), Article 28(3)

Templates

Implementing Regulation (EU) 2024/2956, Annex I: 15 templates, B_01.01 to B_99.01

Applies since

17 January 2025

Provider identifier

LEI or EUID for legal persons (Art. 3(5) ITS); LEI only outside the EU

Format

xBRL-CSV, EBA reporting framework 4.0

File with (NL)

DNB via MijnDNB, or the AFM via the AFM Portaal; ECB-supervised banks report to the ECB at consolidated level

2026 cycle

Reference date 31 December 2025; DNB by 20 March 2026, AFM by 31 March 2026

2027 cycle

No window announced as at 14 October 2026

Which contracts belong in it?

All of them. Article 28(3) covers "all contractual arrangements" on the use of ICT services, with no size threshold and no materiality floor.

The register must then separate the contracts that support a critical or important function from those that do not, because that distinction drives the extra contract terms in Article 30(3) and the supervisor's interest.

Two edges are worth knowing.

The AFM says a free service with no contract does not have to be included. And the simplified regime for small investment firms in Article 16 switches off Articles 5 to 15 only, so it does not touch the register, which sits in Chapter V.

Four rules attached to Article 28(3)

  • Art. 28(3), first subparagraph

    Three levels

    Maintain and update the register at entity level, and at sub-consolidated and consolidated level. The ITS requires every data element to be completed at entity level (Art. 4(3)).

  • Art. 28(3), second subparagraph

    Critical or not

    Distinguish contracts covering ICT services that support critical or important functions from those that do not.

  • Art. 28(3), fourth subparagraph

    On request, any time

    Make the full register, or specified sections, available to the competent authority when it asks. The annual filing is the minimum, not the only occasion.

  • Art. 28(3), fifth subparagraph

    Tell them first

    Inform the competent authority in good time about planned contracts for ICT services that support critical or important functions.

Why the identifiers decide whether it is accepted

The register is a contract inventory, but it is checked like a data file. Each provider needs a valid and active LEI or EUID (Article 3(5) of the ITS), and the same applies, collected through the direct provider, to subcontractors that support critical or important functions (Article 3(6)). The supervisors join the templates on those keys. A contract that points at a provider the register does not contain breaks the file.

The dates

One chronology in date order. Each label gives the date as the source states it and who set it.

2024

  1. 2 December 2024 · Set by law

    Implementing Regulation (EU) 2024/2956 published in the Official Journal

2025

  1. 17 January 2025 · Set by law

    DORA applies, including the register duty in Article 28(3)

  2. 31 March 2025 · Set by DNB

    Reference date for the first register

  3. 23 April 2025 · Set by DNB

    First DNB deadline, after a window from 1 April

  4. 30 April 2025 · Set by the ESAs

    National supervisors pass the registers to the European supervisors

  5. 28 May 2025 · Set by DNB

    Last date for corrections to the first register

  6. 18 November 2025 · Set by the ESAs

    First list of 19 critical ICT third-party providers, drawn from the registers

2026

  1. 20 March 2026 · Set by DNB

    DNB deadline for the 2026 register, reference date 31 December 2025, window from 2 March

  2. 31 March 2026 · Set by the AFM

    AFM deadline for the 2026 register, resubmissions welcome until 30 April

  3. April 2026 · Set by the EBA

    Additional data-quality checks on templates B_01.02 and B_05.01

Without an official date

  1. No official date as at 14 October 2026

    Register for 2027: reference date 31 December 2026 on the annual pattern; no window announced

Where you file in the Netherlands

DNB collects the register through the Reporting Service in MijnDNB. It accepts an xBRL-CSV file, or its own Excel template, which DNB converts. The entity identifier in the file is the LEI followed by ".IND" or ".CON", and for 2026 the taxonomy and template were unchanged from 2025. Banks under direct ECB supervision report at consolidated level to the ECB instead.

The AFM collects through the AFM Portaal and accepts xBRL-CSV only. "Excel wordt niet geaccepteerd." Both use the EBA's reporting framework 4.0 for the register.

What got registers rejected

The most frequent technical rejections the AFM listed in its Q&A session of 5 March 2026, by error code. Error 807 was the most common.

Error codeWhat it means

807

Foreign key violation: a record refers to a key that does not exist in the template it points to

103

The ZIP file name does not match the folder inside it

701

report.json, parameters.csv or FilingIndicators.csv is missing

714

The entityID does not match the LEI in the file name

What the data showed

The 2024 dry run set the baseline. In their dry-run summary report the European supervisors analysed 947 registers from 1,039 participating firms: 6.5% passed every data-quality check, and missing mandatory information made up 86% of all errors in the report. Function identifiers were often absent.

It improved fast. In its DORA Update 7 of August 2026, the AFM reports that 40% of the registers filed with it were accepted by the EBA in 2025, rising to 94% in 2026.

EBA testing in spring 2025 still counted 58,170 EUIDs in an invalid format.

What can GenCompl.ai do for you?

We read Article 28 and the ITS as rules, so the register duties that reach your licence, and the dates behind them, are derived from a description of your firm with the article behind each line.

Book a working session

Questions and answers

Does a microenterprise have to file a register?

Article 28(3) has no exemption for size, and the simplified regime in Article 16 does not switch off Chapter V. We found no supervisor statement exempting microenterprises, so treat the duty as applying.

Do intra-group IT services go in the register?

Yes. The ITS requires a group register to include all financial entities and ICT intra-group service providers (Article 6(2)).

What if a provider has no LEI?

For a legal person established in the EU, an EUID is an accepted alternative. DNB flags a provider with another identifier in its data-quality check but does not reject the file for it. Providers outside the EU need an LEI.

Who receives the register after DNB?

The national supervisors pass the registers to the European supervisors, who aggregate them yearly for the Oversight Forum (Article 31(10)). That is how the first 19 critical ICT third-party providers were identified on 18 November 2025.

Can I file in Excel?

With DNB, yes: it converts its own Excel template. With the AFM, no: from 2026 only xBRL-CSV is accepted.

Regulations

  • Digital Operational Resilience Act (DORA)

    DORA is Regulation (EU) 2022/2554. It has applied since 17 January 2025 to 20 categories of licensed financial entity, from banks to crypto-asset service providers. It requires an ICT risk management framework, major incident reporting within 4 hours of classification, an annual register of ICT contracts, and threat-led penetration testing every three years.

    Next
    Commission review of DORA and report to Parliament and Council (Art. 58(1))

    Checked