--- title: "What goes in the DORA register of information, and when is it due?" description: "What the DORA register of information contains, the 15 ITS templates, how DNB and the AFM collect it, and the data errors that got registers rejected." canonical: "https://gencompl.ai/deep-dives/dora-register-of-information" language: "en-US" type: "Deep dive" published: "2026-10-14T18:39:40.017Z" modified: "2026-10-14T18:54:18.170Z" --- # What goes in the DORA register of information, and when is it due? Every contract for ICT services, at entity and group level, in the 15 templates of Implementing Regulation (EU) 2024/2956, with each provider identified by LEI or EUID. Dutch firms file it once a year: in 2026 by 20 March with DNB or 31 March with the AFM, as xBRL-CSV. No 2027 window has been announced. **What must the DORA register of information contain, how is it filed in the Netherlands, and what gets it rejected?** Defined in: [DORA](https://gencompl.ai/regulations/dora) (32022R2554) [Home](https://gencompl.ai/) › [Deep dives](https://gencompl.ai/deep-dives) › What goes in the DORA register of information, and when is it due? ## What goes in the DORA register of information, and when is it due? Every contractual arrangement your firm has for ICT services, recorded in the 15 templates of [Implementing Regulation (EU) 2024/2956](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2956), at entity level and, for groups, at sub-consolidated and consolidated level. Each [ICT third-party service provider](https://gencompl.ai/glossary/ict-third-party-service-provider) that is a legal person is identified by a valid [LEI](https://gencompl.ai/glossary/legal-entity-identifier-or-lei) or EUID. The duty sits in Article 28(3) of [DORA](https://gencompl.ai/regulations/dora) and has applied since 17 January 2025. Dutch firms file the register once a year. In 2026 the reference date was 31 December 2025 and the deadline was 20 March with [DNB](https://gencompl.ai/authorities/dnb) or 31 March with the [AFM](https://gencompl.ai/authorities/afm). Neither supervisor has announced a window for 2027. ## At a glance - **Legal duty**: [Regulation (EU) 2022/2554](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng) (DORA), Article 28(3) - **Templates**: [Implementing Regulation (EU) 2024/2956](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2956), Annex I: 15 templates, B\_01.01 to B\_99.01 - **Applies since**: 17 January 2025 - **Provider identifier**: LEI or EUID for legal persons (Art. 3(5) ITS); LEI only outside the EU - **Format**: xBRL-CSV, EBA reporting framework 4.0 - **File with (NL)**: DNB via MijnDNB, or the AFM via the AFM Portaal; ECB-supervised banks report to the ECB at consolidated level - **2026 cycle**: Reference date 31 December 2025; DNB by 20 March 2026, AFM by 31 March 2026 - **2027 cycle**: No window announced as at 14 October 2026 ## Which contracts belong in it? All of them. Article 28(3) covers "all contractual arrangements" on the use of ICT services, with no size threshold and no materiality floor. The register must then separate the contracts that support a critical or important function from those that do not, because that distinction drives the extra contract terms in Article 30(3) and the supervisor's interest. Two edges are worth knowing. The AFM says a free service with no contract does not have to be included. And the simplified regime for small investment firms in Article 16 switches off Articles 5 to 15 only, so it does not touch the register, which sits in Chapter V. ## Four rules attached to Article 28(3) *Art. 28(3), first subparagraph* ### Three levels Maintain and update the register at entity level, and at sub-consolidated and consolidated level. The ITS requires every data element to be completed at entity level (Art. 4(3)). *Art. 28(3), second subparagraph* ### Critical or not Distinguish contracts covering ICT services that support critical or important functions from those that do not. *Art. 28(3), fourth subparagraph* ### On request, any time Make the full register, or specified sections, available to the competent authority when it asks. The annual filing is the minimum, not the only occasion. *Art. 28(3), fifth subparagraph* ### Tell them first Inform the competent authority in good time about planned contracts for ICT services that support critical or important functions. ## Why the identifiers decide whether it is accepted The register is a contract inventory, but it is checked like a data file. Each provider needs a valid and active LEI or EUID (Article 3(5) of the ITS), and the same applies, collected through the direct provider, to subcontractors that support critical or important functions (Article 3(6)). The supervisors join the templates on those keys. A contract that points at a provider the register does not contain breaks the file. ## The dates One chronology in date order. Each label gives the date as the source states it and who set it. ### 2024 - **2 December 2024 · Set by law**: Implementing Regulation (EU) 2024/2956 published in the Official Journal ### 2025 - **17 January 2025 · Set by law**: DORA applies, including the register duty in Article 28(3) - **31 March 2025 · Set by DNB**: Reference date for the first register - **23 April 2025 · Set by DNB**: First DNB deadline, after a window from 1 April - **30 April 2025 · Set by the ESAs**: National supervisors pass the registers to the European supervisors - **28 May 2025 · Set by DNB**: Last date for corrections to the first register - **18 November 2025 · Set by the ESAs**: First list of 19 critical ICT third-party providers, drawn from the registers ### 2026 - **20 March 2026 · Set by DNB**: DNB deadline for the 2026 register, reference date 31 December 2025, window from 2 March - **31 March 2026 · Set by the AFM**: AFM deadline for the 2026 register, resubmissions welcome until 30 April - **April 2026 · Set by the EBA**: Additional data-quality checks on templates B\_01.02 and B\_05.01 ### Without an official date - **No official date as at 14 October 2026**: Register for 2027: reference date 31 December 2026 on the annual pattern; no window announced ## Where you file in the Netherlands [DNB](https://www.dnb.nl/en/sector-news/supervision-2026/dora-reporting-dora-registers-of-information-in-march-2026/) collects the register through the Reporting Service in MijnDNB. It accepts an xBRL-CSV file, or its own Excel template, which DNB converts. The entity identifier in the file is the LEI followed by ".IND" or ".CON", and for 2026 the taxonomy and template were unchanged from 2025. Banks under direct ECB supervision report at consolidated level to the ECB instead. The [AFM](https://www.afm.nl/~/profmedia/files/onderwerpen/dora/20260305-qa-dora-sessie.pdf) collects through the AFM Portaal and accepts xBRL-CSV only. "Excel wordt niet geaccepteerd." Both use the EBA's reporting framework 4.0 for the register. ## What got registers rejected The most frequent technical rejections the AFM listed in its Q&A session of 5 March 2026, by error code. Error 807 was the most common. | Error code | What it means | | --- | --- | | 807 | Foreign key violation: a record refers to a key that does not exist in the template it points to | | 103 | The ZIP file name does not match the folder inside it | | 701 | report.json, parameters.csv or FilingIndicators.csv is missing | | 714 | The entityID does not match the LEI in the file name | ## What the data showed The 2024 dry run set the baseline. In their [dry-run summary report](https://www.eba.europa.eu/sites/default/files/2024-12/c1454b59-15cc-445e-be14-966e3338cedc/ESA%202024%2035%20DORA%20Dry%20Run%20exercise%20summary%20report%20for%20publication.pdf) the European supervisors analysed 947 registers from 1,039 participating firms: 6.5% passed every data-quality check, and missing mandatory information made up 86% of all errors in the report. Function identifiers were often absent. It improved fast. In its [DORA Update 7](https://www.afm.nl/~/profmedia/files/publicaties/2026/dora-update-7-nl.pdf) of August 2026, the AFM reports that 40% of the registers filed with it were accepted by the EBA in 2025, rising to 94% in 2026. EBA testing in spring 2025 still counted 58,170 EUIDs in an invalid format. > **Our analysis: Accepted is not the same as correct** > > The AFM's acceptance rate of 94% in 2026 says the file format is solved. It does not say the content is right. EBA testing material notes that a wrong LEI does not lead to rejection, and DNB flags a provider without an LEI or EUID in its quality check without rejecting the file. Validation catches broken keys, not a contract mapped to the wrong function or a provider recorded under the wrong legal entity. Those are the errors a supervisor finds when it uses the register, and the ESAs drew on the registers to designate the 19 critical providers. > **What we could not establish** > > No supervisor has announced the 2027 window; the reference date of 31 December 2026 is our inference from the annual pattern. The AFM gave 22 March 2026 in a November 2025 notice and 31 March in its March 2026 session; we use the later date. The DORA article wording was checked against a reproduction of the Official Journal text, not the EUR-Lex page itself. ## What can GenCompl.ai do for you? We read Article 28 and the ITS as rules, so the register duties that reach your licence, and the dates behind them, are derived from a description of your firm with the article behind each line. - [Book a working session](https://gencompl.ai/contact) ## Questions and answers ### Does a microenterprise have to file a register? Article 28(3) has no exemption for size, and the simplified regime in Article 16 does not switch off Chapter V. We found no supervisor statement exempting microenterprises, so treat the duty as applying. ### Do intra-group IT services go in the register? Yes. The ITS requires a group register to include all financial entities and ICT intra-group service providers (Article 6(2)). ### What if a provider has no LEI? For a legal person established in the EU, an EUID is an accepted alternative. DNB flags a provider with another identifier in its data-quality check but does not reject the file for it. Providers outside the EU need an LEI. ### Who receives the register after DNB? The national supervisors pass the registers to the European supervisors, who aggregate them yearly for the Oversight Forum (Article 31(10)). That is how the first 19 critical ICT third-party providers were identified on 18 November 2025. ### Can I file in Excel? With DNB, yes: it converts its own Excel template. With the AFM, no: from 2026 only xBRL-CSV is accepted. ## Sources - [Regulation (EU) 2022/2554 (DORA), Articles 16, 28 and 31](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng) (EUR-Lex · 14 December 2022) - [Commission Implementing Regulation (EU) 2024/2956: standard templates for the register of information](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2956) (EUR-Lex · 29 November 2024) - [DORA reporting: registers of information in March 2026](https://www.dnb.nl/en/sector-news/supervision-2026/dora-reporting-dora-registers-of-information-in-march-2026/) (DNB) - [DORA-uitvraag: DORA-informatieregister in april 2025](https://www.dnb.nl/nieuws-voor-de-sector/toezicht-2025/dora-uitvraag-dora-informatieregister-in-april-2025/) (DNB) - [DORA: status uitvraag informatieregister](https://www.dnb.nl/nieuws-voor-de-sector/toezicht-2025/q2/dora-status-uitvraag-informatieregister) (DNB · 6 May 2025) - [DORA: additionele datakwaliteitscontroles informatieregister](https://www.dnb.nl/nieuws-voor-de-sector/toezicht-2026/dora-additionele-datakwaliteitscontroles-informatieregister/) (DNB · 10 March 2026) - [DORA in Open Book Supervision](https://www.dnb.nl/en/sector-information/open-book-supervision/laws-and-eu-regulations/dora/) (DNB) - [Q&A DORA-sessie](https://www.afm.nl/~/profmedia/files/onderwerpen/dora/20260305-qa-dora-sessie.pdf) (AFM · 5 March 2026) - [DORA Update 7](https://www.afm.nl/~/profmedia/files/publicaties/2026/dora-update-7-nl.pdf) (AFM) - [Uitvraag DORA-informatieregister](https://www.afm.nl/en/sector/actueel/2025/nov/sb-uitvraag-dora) (AFM · 4 November 2025) - [DORA dry run exercise: summary report](https://www.eba.europa.eu/sites/default/files/2024-12/c1454b59-15cc-445e-be14-966e3338cedc/ESA%202024%2035%20DORA%20Dry%20Run%20exercise%20summary%20report%20for%20publication.pdf) (ESAs) - [Observations from RoI reporting testing: common issues](https://www.eba.europa.eu/sites/default/files/2025-04/717e7e5f-14ac-45c6-b336-b0aac6a9062a/Observations%20from%20RoI%20reporting%20testing%20-%20common%20issues%20-%20April%202025%20%281%29.pdf) (EBA · 16 April 2025) - [Preparation for DORA application: reporting framework 4.0](https://www.eba.europa.eu/activities/direct-supervision-and-oversight/digital-operational-resilience-act/preparation-dora-application) (EBA) - [ESAs provide roadmap towards designation of CTPPs under DORA](https://www.eiopa.europa.eu/esas-provide-roadmap-towards-designation-ctpps-under-dora-2025-02-18_en) (ESAs · 18 February 2025) - [European Supervisory Authorities designate critical ICT third-party providers](https://www.esma.europa.eu/press-news/esma-news/european-supervisory-authorities-designate-critical-ict-third-party-providers) (ESAs · 18 November 2025) ## Related content ### Regulation - [Digital Operational Resilience Act (DORA)](https://gencompl.ai/regulations/dora): DORA is Regulation (EU) 2022/2554. It has applied since 17 January 2025 to 20 categories of licensed financial entity, from banks to crypto-asset service providers. It requires an ICT risk management framework, major incident reporting within 4 hours of classification, an annual register of ICT contracts, and threat-led penetration testing every three years.