EU national supervisory authorities will collect the Register of Information (ROI) pursuant to the EU's Digital Operational Resilience Act (DORA) from in scope financial entities in April 2025, with the reference date set as 31 March 2025. ROIs are reports by in-scope EU financial entities on all contractual arrangements on the use of information and communication technology (ICT) services provided by ICT third-party service providers. The financial entity must differentiate between providers who are not critical and providers who are considered critical and important.
The Irish Central Bank has announced that it will collect the ROIs between 1-4 April 2025. The German BaFin has set 11 April as the deadline. In-scope financial entities across the EU should expect that there will be a similar process locally.
Under the Implementing Technical Standards on the Register of Information, information to be collected includes:
- Identification of ICT third-party service providers (will need to have either a valid LEI code or EU-ID for the files to pass validation);
- Detail on the nature of the ICT services provided;
- Detail on contractual arrangements;
- Risk classification;
- Monitoring and oversight mechanisms;
- Sub-outsourcing arrangements; and
- ICT-related incidents.
The European Supervisory Authorities have provided useful information on how to prepare to report the ROI which is available online. In Ireland, the Central Bank will publish a system guide to submitting the ROI in March 2025. The German BaFin has provided information here (in German).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
