The European Supervisory Authorities ESAs (EBA, EIOPA, and ESMA) have recently announced a key decision under the Digital Operational Resilience Act (DORA): By 30 April 2025, competent authorities must submit detailed registers of information (RoI) about the contractual arrangements between financial entities and their critical information and communication technology (ICT) service providers to the ESAs.
Let's talk how we can help your business.
Connect to a new world of efficiency by utilizing cleversoft’s business solutions.
The European Supervisory Authorities ESAs (EBA, EIOPA, and ESMA) have recently announced a key decision under the Digital Operational Resilience Act (DORA): By 30 April 2025, competent authorities must submit detailed registers of information (RoI) about the contractual arrangements between financial entities and their critical information and communication technology (ICT) service providers to the ESAs. This implies that companies will need to provide their RoI to national authorities in advance, according to the specific timelines set by each national authority. These timelines still have to be announced. The ESA´s decision also establishes a framework for reporting, which includes timelines, frequency and reference dates, general procedures for transmitting information, quality assurance and data revisions, and access to confidential information.
Financial firms are already preparing – now it’s time to stay ahead
Although the EU commission has not yet to adopt the technical standards for the information registers, the main requirements were already outlined in the ESAs’ final report published in January 2024.
The ESAs expect minimal changes, some uncertainty remains. The European Commission recently rejected the draft Implementing Technical Standards (ITS) on the grounds that the Legal Entity Identifier (LEI) should not be mandatory for identifying ICT third-party service providers. The Commission has proposed the European Unique Identifier (EUID) instead, a change the ESAs have expressed concerns about due to potential complexity.
To mitigate this uncertainty, it is relevant for financial companies to start creating their registers as far as possible, especially for information that may not be immediately available such as relevant identifiers of ICT providers.
Upcoming information workshop on DORA Dry Run results: 18 December
The ESAs launched a DORA dry run in the summer, for which cleversoft customers received a free setup on request. More details are available in our recent blog post.
On 18 December 2024, the ESAs will host an information workshop from 10:00 to 13:00 CET, to discuss the results of the test run and provide additional information on how to prepare their registers. Interested parties can register by 16 December 2024 via the following link.
DORA Reporting Service
Besides being a vendor to some of your services, and thus adhering to the DORA compliancy ourselves, cleversoft also has launched the DORA Reporting Service to support financial institutions.
This service helps our customers to manage the actual contract registry – allowing both full contract registration or data enrichment to a pre-existing registry, to make sure all required data is recorded. In addition to registry management, the service also produces the Register of Information reports in the required XBRL csv format. Incident reporting works in the same way, with XBRL output and the necessary reporting moments related to an incident.
To further enhance this service, we have integrated management reporting that provides alerts for contract expirations and auto-renewals, based on the contract data.
cleversoft Compliance Package
Our Compliance Package offers targeted regulatory support for clients requiring additional legal and regulatory assistance. Designed for internal audit departments or external auditors, it provides verifiable proof of compliance with standards set by key supervisory authorities, including FCA, EIOPA, BaFin, FINMA, and others.
The package includes detailed reports that validate cleversoft’s commitment to legal compliance, technological excellence, and adherence to industry best practices.
Important: To access further details or sign the DORA addendum, add our Compliance Package to your subscription.
Important Note:
Validation Rules and Data model
- The ESAs have released validation rules and a visual representation of the data model to facilitate preparations for financial institutions: validation rules.
- The final version, including updated rules, data models, taxonomy, and technical packages, will be finalized and published in December 2024.
Which third-party providers are considered CTPPs?
Under DORA, critical ICT service providers (CTPPs) are defined as those of systemic importance to financial stability within the EU. They are typically:
- Provide ICT services to at least 10% of EU-based financial institutions.
- Support critical functions of large financial institutions.
- Offer ICT services that are difficult to replace.
The specific designation and supervision of CTPPs will take place from 17 January 2025.
Do you have questions about the deadlines or the implementation of DORA? Our experts will be happy to advise you on the necessary steps and the appropriate tools. Simply contact us using the contact form on our website.