DORA · Third-Party Register
The Register of Information (RoI) submission-ready — no more Excel consolidation before the deadline.
The Register of Information is no longer an Excel exercise.
ICT risk officers at banks often describe their challenge this way: "It's DORA, not NIS2 — most compliance tools mix them up immediately." DORA requires in Art. 28/29 a complete register of all ICT third-party service contracts — including criticality classification, LEI identification, and concentration-risk assessment — that can be submitted to regulators in the EBA-ITS-2024/2956 format.
In practice, most institutions face: dozens or hundreds of contracts scattered across spreadsheets, emails, and vendor folders, manually consolidated before each deadline into a submission-ready version — with the risk that contracts are overlooked or the format doesn't align with the ESMA-ITS structure.
Concentration risk is no side issue: if multiple critical functions depend on the same ICT third-party provider, Art. 29 requires explicit assessment of that risk — something that is hard to detect reliably without a structured register.
Four building blocks for a submission-ready RoI.
Vendor Register with Criticality & LEI
Each ICT third-party provider is captured with criticality classification, LEI, and contract data in a structured format — not scattered across spreadsheets and files.
Concentration-Risk Flag
Clustering by service type and country, single points of failure across critical providers: the concentration analysis per Art. 29 is calculated deterministically from the register and sealed — a resilience response, not an Excel attachment.
RoI Versioned & Cryptographically Sealed
Every version of the register is sealed and cannot be changed undetectably afterward — you can prove to regulators which state was current at any point in time.
Export CSV (T01/T02/T04) + XBRL
Submission happens directly in the format regulators expect — no manual rebuild of the ESMA-ITS table structure just before the deadline.
Deeper dive into DORA and the Vendor Engine behind it.
Deadlines, ICT risk management, breach reporting, and primary sources in detail.
Regulation details →How vendor registry, security ratings, and risk assessment work together.
Feature details →Your first sealed third-party register — today.
In 30 minutes we show you what ReportAct delivers for this use case – no obligation.