DORA – Current State of the Regulatory Reporting Requirements

Since 17 January 2025 the Digital Operational Resilience Act (DORA) applies to financial companies throughout the European Union. The regulation aims to create a high common level of digital operational resilience throughout the financial sector. 

In the following article we have summarized the current state of the regulation adoption, and the practical insights needed for the reporting.  

 

Register of Information (RoI) 

• ITS for Register of Information 

The  technical implementation standard for the Information Register (ITS) has been adopted and is currently in force.   

• Taxonomy Data Point Model has been updated to reflect ITS  

While the version of the taxonomy used for the Dry Run in summer 2024 was 3.5, the regulator has adopted an updated version – 4.0. It introduced standardized templates for the Register of Information, detailing contractual arrangements with ICT third-party service providers additional columns.  The most recent version of the taxonomy can be downloaded here. 

• Updates on Q&A are regularly being published by EBA 

As there are continuous questions from the industry of different topics connected to the first Register of Information (RoI) Reporting, the ESAs have published “Frequently Asked Questions”.  The aim of the Frequently Asked Questions is to provide further guidance in the reporting and clarify points, which have not yet been clarified anywhere else. In addition, it clarifies some differences between the description in ITS and the technical implementation of EBA. 

An example of such differences would be column 0060 of template 05.02 which from technical standpoint is mandatory for reporting and cannot be left empty according to EBA specifications. However, ITS states that if the ICT third-party service provider (field B_05.02.0030) is a direct ICT third-party service provider i.e. at ‘rank’ r = 1 (field B_05.02.0050) column 0060 should be left empty. DORA Q&A 147 clarifies this discrepancy, by explaining that field B_05.02.0060 should be filled in with the same value reported in B_05.02.0030 for suppliers with rank “1”. 

Our RegWatch Team has reviewed all points in the document and ensured full implementation in our service. 

 

Reporting of ICT-related incidents 

•  PSD2 reporting guidelines have been repealed 

To avoid double reporting, now that harmonized incident reporting under DORA is in place, the European Banking Authority (EBA) has repealed the Guidelines on major incident reporting under the revised Payment Service Directive (PSD2), for the entities in scope of DORA. The full article can be accessed here. 

• ITS on Incident Reporting not yet adopted

The technical implementation standard for the reporting of incidents has not yet been adopted, however it is available as a draft here

• Technical artefacts not yet published

The EBA has not yet provided technical artefacts for reporting.  For this reason, each of the local regulators has started to give their own technical guidelines for temporary reporting until the final artefacts are published. The most commonly adopted artefact for reporting incidents is the excel file, published by EBA as a clarification.

• Study on the centralization of incident reporting

The ESAs have published a study on feasibility of further centralization of major ICT-related incident reporting by financial entities: It outlines the different development options for incident reporting – varying from completely decentralized reporting to which NCA to centralized EU hub for reporting. The European Council and the European Commission, which will consider its findings for potential future developments in relation to the further centralization of major ICT-related incident reporting in the financial sector. 

 

Future developments: 

• By 30 April, the first RoI reporting needs to be completed and submitted to EBA by the NCAs  

• By the end of the July, the ESAs will perform the critically assessment and notify the third-party service providers of their classification as critical 

• Until the first half of September the classified service providers can object to the assessment 

• By the end of 2025, the final designation of the CTPPs should be finalized and published 

• During the year, the ITS for incident reporting is likely to be adopted and a decision on the centralization (or non-centralization) of the reporting.  

• A technical format for incident reporting should be published 

• A new taxonomy will be published for EBA. This will likely result in a change of the reporting format for the RoI, as the ESA are expected to adopt unified reporting DPM format for all reporting from 2026. 

 

Stay compliant with cleversoft´s DORA Reporting Service 

 Ensure complete DORA compliance with cleversoft’s comprehensive service: 

• Adapt to changing regulatory requirements 

•  Stay informed on the latest developments from our dedicated Regulatory Watch team. 

• Provide full transparency, auditability and traceability of all data  

•  Manage contract information efficiently in a singleplace instead of going through different templates 

• Information on the description in ITS within the system 

We are fully committed to providing our clients with the support and guidance they need to be successful in the implementation of this new regulatory framework. 

Partner with experts for your compliance journey.  

Questions about DORA compliance or our services? Contact our team through our website contact form. 

Want to learn more? Visit our DORA service page.