How to fill in your DORA Register of Information
You don't "fill in" the register at random: it's a structured inventory of your ICT providers, organised into 15 linked templates. Here's the method, step by step, to build it without inconsistencies — and without rejection at submission.
In short — You build a DORA register in 6 steps: define the scope (entity/LEI), list the ICT arrangements, identify the providers with a valid LEI, map functions and their criticality, convert to xBRL-CSV, then validate the consistency before submission (OneGate in France).
Before you start: you need to know what to fill in. The DORA Register of Information is made of 15 templates in 8 groups (Commission Implementing Regulation (EU) 2024/2956), linked by foreign keys. If the structure isn't familiar, read the 15 templates of the register first. Otherwise, follow the steps.
Define the scope
Start with identity: which entity maintains the register, which entities fall within the scope of consolidation, and which branches exist. This is the foundation; everything else links to it through LEIs.
List the ICT contractual arrangements
List every arrangement with an ICT third-party provider and give it a unique reference. That reference is the hub of the whole register: almost every other template points to it. Then detail the services, functions and contractual terms.
Identify the ICT providers
Describe each provider and enter a valid LEI — verify it on GLEIF. Map the subcontracting chain too: a provider often relies on others, which must be declared.
Map functions and criticality
Link each ICT service to the business functions it supports, then assess those that are critical or important. This is the step the supervisor scrutinises most: it drives the level of requirements on the provider.
Complete signatories, usage… then convert to xBRL-CSV
Fill in the signatories of the arrangements and the entities using each service (B_03.x, B_04.01). Once the templates are gathered, assemble the xBRL-CSV package defined by the EBA (taxonomy + DPM): a free Excel export is not accepted.
Validate the consistency, then submit
Before submission, check cross-template consistency (every arrangement reference, provider code and function identifier must point to an existing record), UTF-8 encoding, ISO dates and DPM values. Submission then goes through the national portal — in France, OneGate (ACPR). Filing is annual; confirm the date with your authority.
The hard part isn't the formatting — it's keeping the whole thing consistent when the data comes from dozens of contracts.
Validate before you submit
DoraReady checks your register against the EBA's 116 validation rules, flags line by line what would cause a rejection (orphan references, invalid LEI, non-conforming DPM value, encoding…) and generates the xBRL-CSV package. Everything runs in your browser: your list of providers never leaves your machine.
Run the free diagnosticFrequently asked questions
Where do I start?
B_02.01, which is the hub for the rest.