Maintaining and submitting the register of information under Article 28(3) DORA

This page applies to both frameworks: to financial entities under the full framework and under the simplified framework of Article 16 DORA, which from 1 January 2027 also includes factoring and leasing firms and the other institutions under Section 1a(2a) of the German Banking Act (KWG) (“KWG group” below), unless they are microenterprises. Which framework applies to you is explained on DORA applicability.

Who has to maintain a register of information?

Every financial entity to which Article 28 DORA applies. The register belongs to Article 28(3) and is maintained at entity level and at sub-consolidated and consolidated levels. Under the simplified framework of Article 16, Articles 28 to 30 also apply in principle, with reliefs such as dropping the strategy under Article 28(2) that do not affect the register (BaFin supervisory notice of 21 August 2025, section 7.2). Microenterprises also keep a register under DORA. The Regulation provides no exemption.

Who does not have to: For microenterprises in the KWG group, Articles 28 to 30 DORA do not apply under Section 1a(2a) sentence 2 no. 3 KWG. On our reading, the register therefore also falls away for them, because it sits in Article 28(3). This special rule is in the KWG and does not apply to other DORA microenterprises. Whether your institution is a microenterprise you check with both figures, as described on DORA applicability. Do not assume the status. ICT providers themselves do not keep a register, DORA places obligations only on financial entities. What your financial customers need from you for their register is set out on DORA for ICT providers.

What goes into the register?

All contractual arrangements on the use of ICT services provided by ICT third-party service providers (Article 28(3), first subparagraph). ICT services are digital and data services provided through ICT systems on an ongoing basis, including hardware as a service, excluding traditional analogue telephone services (Article 3(21)). The term is wider than outsourcing. Annex III of the Implementing Regulation lists 19 types, from project management and development through software licensing and operation including maintenance to cloud services. According to BaFin, the register includes:

• the direct ICT third-party service provider (rank 1) in every case, regardless of whether the service supports a critical or important function,
• for services supporting critical or important functions, all subcontractors that effectively underpin the provision of the service,
• for intra-group ICT providers, at least the first subcontractor outside the group, even without a link to critical or important functions.

BaFin’s MVP does not go into the register, and the Deutsche Bundesbank is not an ICT third-party service provider under DORA either. Additional information for your own contract management is permitted (Article 5(2) of the Implementing Regulation). In groups, the parent undertaking decides which entities are included (Article 6(1)).

How is the register structured?

Implementing Regulation (EU) 2024/2956 prescribes 15 templates (Annex I). Each template is a table with fixed columns, and each column has a code, such as B_02.02.0060, a format and a reporting option, such as mandatory, mandatory if a condition is met, or optional.

The templates are held together by three keys: the contractual arrangement reference number (B_02.01.0010), which the financial entity assigns, keeps unchanged and uses identically in all templates, the function identifier (B_06.01.0010, format F1, F2 and so on) and the identification code of the ICT third-party service provider (B_05.01.0010). Changing one of these values in one place but not in another produces errors.

LEI, EUID and other identifiers

The financial entity identifies itself in the register with its LEI. ICT third-party service providers that are legal persons are identified with a valid and active LEI or with the European Unique Identifier (EUID), with both where both are available (Article 3(5) of the Implementing Regulation). For legal persons outside the EU only the LEI is permitted. Other identifiers such as commercial register or VAT identification numbers may only be used for individuals acting in a business capacity (Annex I, B_05.01.0020). BaFin does not accept dummy LEIs. You obtain the identifiers from the provider itself. For subcontractors in the chain of critical or important functions, you make sure through the direct provider that an LEI or EUID is available (Article 3(6)).

How is the critical or important function recorded per contract?

Article 28(3), second subparagraph, DORA requires arrangements covering critical or important functions to be distinguished from the others. In the register this happens through the function: template B_06.01 lists every function with its own identifier for each combination of LEI, licensed activity and function, with the assessment “yes”, “no” or “assessment not performed”, the date of the last assessment, and the recovery time objective and recovery point objective in hours. In B_02.02 each contractual arrangement refers through the function identifier to the function it supports. If an arrangement supports several functions, on our reading of the template it appears in several rows, one per function.

If the service supports a critical or important function, further fields become mandatory: notice periods for both parties in calendar days, governing law, country of provision, storage of data with location, sensitiveness of the data, level of reliance, plus the whole of template B_07.01 with substitutability, date of the last audit, exit plan, possibility of reintegration, impact of discontinuing and alternative providers. You decide beforehand which functions are critical or important. The method is shown on classifying critical or important functions.

Filling aid: one contract, completed

Fictitious example, not a client. Muster-Factoring GmbH (23 staff, EUR 61 million total assets, not a microenterprise) from the example on the function list obtains its core factoring system as software as a service. The software vendor runs it in a subcontractor’s data centre. Two critical or important functions run on the core system: purchase of receivables (F1) and accounts receivable (F3). The table shows the main fields for this contract. Replace placeholders in angle brackets with real identifiers, never with invented ones.

Note for the KWG group: The selection list in B_01.01.0040 and the activities in Annex II follow the types of financial entity under Article 2 DORA. There is no separate option for institutions covered only through Section 1a(2a) KWG. Either “credit institutions” or “other financial entity” comes into question, and there is an argument for each reading. The Implementing Regulation intends “other financial entity” for parent undertakings that maintain the register at group level but are not themselves subject to the register duty because they do not fall under Article 2 DORA, such as financial holding companies, mixed financial holding companies or mixed-activity holding companies. Institutions under Section 1a(2a) KWG likewise do not fall under Article 2, but are themselves subject to the register duty through the KWG. The case is therefore only partly comparable, so “other financial entity” is supported only by analogy. “Credit institutions”, with the activities for credit institutions (Annex II, B_06.01.0020), is supported by the KWG, which applies DORA to these institutions “as if these institutions were CRR credit institutions” (our translation). We have not found a BaFin determination. Compare both fields with BaFin’s filling instructions and its sample completed Excel template, and ask BaFin if in doubt.

The column codes of template B_06.01 follow the corrigendum to the Implementing Regulation of 19 September 2025, which applies to the English text as well. It moved the columns from the assessment onwards forward by one: the assessment “critical or important” is in 0050, the reasons in 0060, the date of the assessment in 0070, the recovery objectives in 0080 and 0090, the impact of discontinuing in 0100. Documents using 0060 to 0110 follow the uncorrected text. Check the codes against the BaFin Excel template you use for submission.

The filling aid is also available as a file with the sheets filling aid, templates and checklist: Download the filling aid (Excel, xlsx, in German). It does not replace BaFin’s Excel template, which you use for submission.

How is the register submitted to BaFin?

BaFin handles two further duties from Article 28(3) through the register or existing channels. It takes the number of new arrangements from the register itself, so no separate report is needed. Planned arrangements for critical or important functions, and functions that have become critical or important, you notify in a timely manner. If there is also a notifiable outsourcing, you continue to notify it through the MVP specialist procedure “Anzeige von Auslagerungen” (notification of outsourcing). BaFin announces on its website that the DORA notification is to be possible in the same form in future. Where there is no overlap, send BaFin’s Excel form by email to DORA-Informationsregister@bafin.de.

Open for the KWG group: Article 28 applies to it from 1 January 2027 (Section 1a(2a) with Section 65a(3) KWG). Whether it already submits a register as of 31 December 2026 in 2027, or for the first time in 2028 as of 31 December 2027, is not settled in any source we have read. We recommend keeping the register ready for submission from January 2027, making a test submission early and following BaFin’s announcement at the start of the year.

Typical validation errors

We have not analysed the validation rules of the European Supervisory Authorities themselves. The error patterns below come from BaFin’s guidance and the wording of the Implementing Regulation. BaFin also provides an overview of possible error codes with remedies.

Three typical gaps

How to assess and renegotiate contracts with ICT providers and secure them with exit strategies is covered on managing ICT third-party risk.

How we can help

For institutions moving to Article 16 and for entities under the full framework we start with the DORA gap analysis. It shows whether register, function list and contracts fit together and what is missing before the next reference date. Legal questions on contracts and individual cases are for you to clarify with your legal advisers.