OperationalResilience.help
The Continuity Desk - important services, kept running
Home / Line 12 - Register of information / Guide

Register Reporting to Authorities

Reporting the DORA register to the competent authority turns an internal record into a supervisory submission, and the discipline of that handover shapes the quality of the whole register.

Published 26 October 2026Checked against the regulation text on 26 October 2026European Union (financial entities in scope of DORA)

The short answer

Reporting means sending the register of information to the competent authority, in the form and through the route that authority requires, so supervisors can use it alongside registers from other entities. The register is not merely held for inspection. It is reported, which changes the standard it must meet. An internal working document can tolerate rough edges and known gaps, because the team that wrote it knows where they are. A reported register cannot rely on that shared knowledge. It must stand on its own, with entries a reader who did not write them can follow, compare, and question.

This guide covers the reporting act itself: what completeness means for a submission, how the reporting copy relates to the working register, how errors and later corrections are handled, and why reporting discipline improves the register between submissions. The later guide on supervisory use explains what authorities do with the reported information. This guide stays with the sender's side of the exchange, and with the habits that make a submission reliable.

What is actually sent?

What is sent is the register as it stands at the reporting point, presented in the required format. That sounds straightforward, but it raises a practical question: is the reporting copy a snapshot of the working register, or a separately prepared document. The safer approach is a snapshot, taken from the same record the entity uses day to day, so the reported register and the working register cannot drift apart. A separately retyped submission invites transcription differences, and those differences will surface when a supervisor compares the submission with answers given later in an incident or a meeting.

How is completeness checked before sending?

Before sending, the register owner should run the checks described in the quality guide across the reporting copy: every arrangement has its provider, service, function, contract, and data and location facts; every entry links cleanly to the others; entity and branch information matches the current structure; and no known arrangement is missing. A pre-submission review by someone other than the person who compiled the register adds value, because the compiler stops seeing gaps in work they know well. That reviewer does not need to redo the whole register. A focused review of new, changed, and high-impact entries will catch most problems.

Known gaps deserve an explicit decision before sending. If an entry cannot be completed because a provider has not supplied information, the entity should record the gap, the steps taken to close it, and the plan for completing it, rather than inventing a plausible value to fill the field. A submission that hides gaps behind invented detail is harder to defend than a submission that shows its work. Supervisors understand that information can be incomplete. They are less forgiving of information that looks complete but is not.

What happens when a submitted register turns out to be wrong?

Errors will happen, because registers describe changing arrangements and reporting points are fixed in time. The important question is what the entity does when it discovers an error after submission. The disciplined response is to correct the working register promptly, record the correction and its reason, and follow the reporting route for updating the authority where the applicable instructions require it. That response treats the register as a living record, which is consistent with DORA's overall approach, rather than as a filing that cannot be revisited until the next cycle.

Why does reporting improve the register itself?

Reporting imposes a deadline, and deadlines concentrate attention, but the deeper benefit is external readership. Knowing that a supervisor will read the register, compare it with other registers, and ask follow-up questions changes how entries are written. Vague service descriptions, unlinked functions, and stale contracts become visible risks rather than internal untidiness. Teams that might otherwise postpone register updates find a reason to supply information on time, because the submission depends on it.

That effect only lasts if the entity treats feedback seriously. Questions from the competent authority about a submission should be logged, answered from the register and its sources, and used to improve the next cycle's checks. Over time, that loop turns reporting from a periodic burden into a regular test of the register's health. An entity that welcomes that test will find its working register improving as well, since the same record serves incident response, exit planning, and risk management every day between submissions.

Primary sources on the record

Legal status: Regulation (EU) 2022/2554 in force; applies from 17 January 2025, with technical standards applying on the dates stated in each standard. Application position for this topic: Applies from 17 January 2025. Technical standards apply on their own stated dates.

Follow the service map

Line 12 - Register of information DORA Register of Information The DORA register of information maps ICT third-party arrangements at entity level, so supervisors can see the dependencies behind a financial entity and the entity can keep that picture current. Line 12 - Register of information Register Format and Templates Format and templates give the DORA register its comparability: consistent fields, clear labels, and a structure that lets readers and supervisors search, compare, and trust the record. Line 12 - Register of information Keeping the Register Current Keeping the DORA register current is the habit that prevents drift: naming an owner, capturing changes as they happen, and reconciling the record against contracts and live services.