OperationalResilience.help
The Continuity Desk - important services, kept running
Home / Line 12 - Register of information / Guide

Keeping the Register Current

Keeping the DORA register current is the habit that prevents drift: naming an owner, capturing changes as they happen, and reconciling the record against contracts and live services.

Published 26 October 2026Checked against the regulation text on 26 October 2026European Union (financial entities in scope of DORA)

The short answer

Keeping the register current means updating it when reality changes, not when a reporting deadline approaches. A new arrangement, a changed provider, a migrated service, a renewed contract, a new subcontractor, or a function that moves to a different platform should each reach the register promptly, through a defined route, with a named owner responsible for making the update. Without that habit, the register drifts, and drift is the pitfall named at the start of this cluster: a report that describes arrangements that no longer exist, an incident response that starts from the wrong map, and exit planning built on expired terms.

Currency is therefore a process, not a periodic effort. This guide explains the pieces of that process: ownership, change triggers, capture routes, reconciliation, and the simple tests that show whether the register reflects the firm as it is today. An entity that gets currency right will find reporting far less painful, because the reporting copy is already close to correct when it is taken.

Who owns currency?

Currency needs a named owner, not a shared hope that somebody will update the register. The owner does not need to know every arrangement personally, but they do need authority to chase updates, to set deadlines for information, and to escalate gaps. That authority should be recognised by the teams that create change: procurement, contract owners, technology teams, and branch managers. If those teams see register updates as optional paperwork, they will postpone them, and the owner will spend reporting season reconstructing months of change from scattered records.

What events should trigger an update?

The most reliable triggers are events the entity already tracks for other reasons. Signing a new ICT contract, amending or renewing an existing one, migrating a service, onboarding a new provider, changing a subcontractor, moving data or hosting, and decommissioning a service should each trigger a register review. Tying register updates to those existing events is more reliable than relying on memory or on a calendar reminder, because the event itself creates the record that the register needs. The trigger should be built into the event's workflow, so the contract or migration is not treated as complete until the register reflects it.

Less visible changes need triggers too. A team that starts using a new software tool, a branch that engages a local ICT provider, or a provider that changes its own arrangements may not pass through a formal contract event. Those cases need a lightweight notification route, such as a short form or a message to the register owner, that teams can use without friction. The route should be easy enough that using it is simpler than bypassing it. If notification feels bureaucratic, teams will skip it, and the register will miss exactly the informal changes that cause drift.

How does reconciliation catch what triggers miss?

Even good triggers miss things, so reconciliation acts as a safety net. Reconciliation means comparing the register against independent sources, such as the contract repository, supplier payment records, and technology inventories, and investigating differences. A contract with no register entry, a register entry with no live service behind it, and a payment to a technology provider that appears nowhere in the register are all signals worth following. The comparison does not need to cover every entry every time. Rotating samples, focused on new and high-impact arrangements, will catch most drift while keeping the work manageable.

How can an entity tell whether the register is current?

A few simple tests give a fair picture. Pick a recently signed ICT contract and check whether its register entry exists and matches the agreement. Pick a recently decommissioned service and check whether its entry has been closed or updated. Pick a live service at random and check whether its entry matches the contract, the provider, and the function it supports. If those tests pass, currency is probably in reasonable shape. If they fail, the failure points to the trigger or the owner that needs fixing, which is more useful than a general complaint that the register is stale.

Currency also shows in reporting. A reporting cycle that requires extensive reconstruction, frantic chasing, and large late corrections is telling the entity that its update process is weak, however polished the final submission looks. A reporting cycle that mainly involves checking a record already maintained through the year is telling the opposite story. The goal is the second kind of cycle, and it is achieved by small, regular updates, not by heroic effort before a deadline. That is the habit this guide advocates, and it protects every other use of the register as well.

Primary sources on the record

Legal status: Regulation (EU) 2022/2554 in force; applies from 17 January 2025, with technical standards applying on the dates stated in each standard. Application position for this topic: Applies from 17 January 2025. Technical standards apply on their own stated dates.

Follow the service map

Line 12 - Register of information DORA Register of Information The DORA register of information maps ICT third-party arrangements at entity level, so supervisors can see the dependencies behind a financial entity and the entity can keep that picture current. Line 12 - Register of information Register Quality Checks Quality checks turn the DORA register from a collection of entries into a trustworthy record, by testing links, completeness, consistency, and agreement with contracts and live services. Line 12 - Register of information Register and Third-Party Risk Link The register and third-party risk management feed each other: the register maps dependence, risk work judges what that dependence means, and its findings should flow back into the record.