DORA ITS on Register of Information

This template lists all contractual arrangements with direct ICT third-party service providers.

For each contractual arrangement with a direct ICT third-party service provider, the financial entity maintaining the register of information shall assign a unique ‘contractual arrangement reference number’ to identify unambiguously the contractual arrangement itself.

This template provides details in relation to each contractual arrangement listed in template B_02.01 with regard to:

1. (a)
   the ICT services included in the scope of the contractual arrangement;
2. (b)
   the functions of the financial entities supported by those ICT services;
3. (c)
   other important information in relation to the specific ICT services provided (e.g. notice period, law governing the arrangement, etc.).

This template provides information on the entity signing the contractual arrangements with the direct ICT third-party service provider for the entity making use of the ICT services.

Where the register of information is maintained and updated at entity level, the entity signing the contractual arrangement and the entity making use of the ICT services is the financial entity maintaining and updating the register of information.

In the context of sub-consolidation and consolidation, the financial entity making use of the ICT services provided is not necessarily the entity signing the contractual arrangement with the ICT third-party service providers.

This template identifies all entities making uses of the ICT services provided by ICT third-party service providers and registered in the register of information.

The entities making use of the ICT services shall be either the financial entities in scope, or the ICT intra-group service providers.

Where the register of information is maintained and updated at entity level, the entity signing the contractual arrangement and the entity making use of the ICT services are the financial entity maintaining the register.

This template lists and provides general information to identify:

1. (a)
   the direct ICT third-party service providers;
2. (b)
   the ICT intra-group service providers;
3. (c)
   all subcontractors included in template B_05.02 on ICT service supply chain;
4. (d)
   the ultimate parent undertaking of the ICT third-party service providers listed in points (a), (b) and (c).

This template identifies and links the ICT third-party service providers that are part of the same ICT service supply chain.

Financial entities shall identify and rank the ICT third-party service providers for each ICT service included in each contractual arrangement.

Example: a financial entity has a contractual arrangement with an ICT third-party service provider (‘ICT third-party service provider X’) to receive 2 specific ICT services (‘ICT service A’ and ‘ICT service B’) and the service provider makes use of a subcontractor (‘ICT third-party service provider Y’) to provide one of those services (‘ICT service B’).

• In relation to ICT service A, the ICT service supply chain is composed of one ICT third-party service provider, ICT third-party service provider X, which will be ranked as number 1 in the template. ICT third-party service provider X is the direct ICT third-party service provider.

• In relation to ICT service B, the ICT service supply chain is composed of two ICT third-party service providers:

  1. (a)
     ICT third-party service provider X, which will be ranked number 1 in the template. ICT third-party service provider X is the direct ICT third-party service provider.
  2. (b)
     ICT third-party service provider Y, which will be ranked number 2 in the template. ICT third-party service provider Y is a subcontractor.

  All ICT third-party service providers belonging to the same ICT service supply chain share the same ‘contractual arrangement reference number’ as referred to in template B_02.01 and the same type of ICT services

This template identifies and provides information on the functions of the financial entity making use of the ICT services.

In the information to be provided in this template, financial entities shall include a unique identifier, the ‘function identifier’ for each combination of a financial entity’s LEI, licenced activity and function.

Example: a financial entity (LEI: 21USLEIC20231109J3Z8) which operates under two licensed activities (‘activity A’ and ‘activity B’) will be given two unique ‘function identifiers’ for the same function X (e.g. sales) performed for activity A and activity B, respectively. The function identifier will be:

1. F1 for the combination of ‘21USLEIC20231109J3Z8’ ‘Activity A’ and ‘Function X’

2. F2 for the combination of ‘21USLEIC20231109J3Z8’ ‘Activity B’ and ‘Function X’

This template captures entity-internal explanations, meanings, and definitions of the closed set of indicators used by the financial entity in the register of information.

Example: In template B_07.01 the financial entity shall provide an indication of the impact of discontinuation of the ICT services by using a closed set of options (low, medium, high). In template B_99.01 the financial entity shall specify the meaning of those options.

Identify the type of financial entity using one of the options in the following closed list:

1. 1.
   credit institutions;
2. 2.
   payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366 of the European Parliament and of the Council;
3. 3.
   account information service providers;
4. 4.
   electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC of the European Parliament and of the Council;
5. 5.
   investment firms;
6. 6.
   crypto-asset service providers authorised under Regulation (EU) 2023/1114 of the European Parliament and of the Council
7. 7.
   issuers of asset-referenced tokens authorised under Regulation (EU) 2023/1114;
8. 8.
   central securities depositories;
9. 9.
   central counterparties;
10. 10.
    trading venues;
11. 11.
    trade repositories;
12. 12.
    managers of alternative investment funds;
13. 13.
    management companies;
14. 14.
    data reporting service providers;
15. 15.
    insurance and reinsurance undertakings;
16. 16.
    insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries;
17. 17.
    institutions for occupational retirement provision;
18. 18.
    credit rating agencies;
19. 19.
    administrators of critical benchmarks;
20. 20.
    crowdfunding service providers;
21. 21.
    securitisation repositories.
22. 22.
    other financial entity;

Where the register of information is maintained at the group level by the parent undertaking, which is not itself subject to the obligation to maintain such register, i.e. it does not fall under the definition of financial entities set out in Article 2 of the Regulation (EU) 2022/2554 (e.g., financial holding company, mixed financial holding company or mixed-activity holding company) ‘Other financial entity’ option shall be chosen.

Identify the type of financial entity using one of the options in the following closed list:

1. 1.
   credit institutions;
2. 2.
   payment institutions, including payment institutions exempted pursuant to Directive (EU) 2015/2366;
3. 3.
   account information service providers;
4. 4.
   electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC;
5. 5.
   investment firms;
6. 6.
   crypto-asset service providers authorised under Regulation (EU) 2023/1114;
7. 7.
   issuers of asset-referenced tokens authorised under Regulation (EU) 2023/1114;
8. 8.
   central securities depositories;
9. 9.
   central counterparties;
10. 10.
    trading venues;
11. 11.
    trade repositories;
12. 12.
    managers of alternative investment funds;
13. 13.
    management companies;
14. 14.
    data reporting service providers;
15. 15.
    insurance and reinsurance undertakings;
16. 16.
    insurance intermediaries, reinsurance intermediaries and ancillary insurance intermediaries;
17. 17.
    institutions for occupational retirement provision;
18. 18.
    credit rating agencies;
19. 19.
    administrators of critical benchmarks;
20. 20.
    crowdfunding service providers;
21. 21.
    securitisation repositories;
22. 22.
    other financial entity;
23. 23.
    non-financial entity: ICT intra-group service provider;
24. 24.
    non-financial entity: other.

Determine the hierarchy of the financial entity in the consolidation using one of the options in the following closed list:

1. 1.
   The financial entity is the ultimate parent undertaking in the consolidation;
2. 2.
   The financial entity is the parent undertaking of a sub-consolidated part in the consolidation;
3. 3.
   The financial entity is a subsidiary in the consolidation and is not a parent undertaking of a sub-consolidated part;
4. 4.
   The financial entity is not part of a group;
5. 5.
   The financial entity is a service provider to which the financial entity (or the third-party service provider acting on its behalf) is outsourcing all its operational activities.

Where an entity fulfils more than one options from the closed list above, the higher-level option applicable to this entity shall be selected.

Identify the date using ISO 8601 (yyyy–mm–dd) code of the date of deletion of the financial entity from the register of information.

Where the financial entity has not been deleted, ‘9999-12-31’ shall be reported.

Identify the ISO 4217 alphabetic code of the currency used for the preparation of the financial entity’s financial statements.

The currency reported shall be the same currency used by the financial entity for the preparation of the financial statements at entity, sub-consolidated or consolidated level, as applicable.

Monetary value of total assets of the financial entity as reported in the financial entity’s annual financial statement of the year before the date of the last update of the register of information. Monetary value shall be reported in units.

Refer to Annex IV for the filling in this column.

Identify a branch of a financial entity located outside its home country using a unique code for each branch. One of the options in the following closed list shall be used:

1. (a)
   LEI of the branch if unique for this branch and different from B_01.03.0020;
2. (b)
   other identification code used by the financial entity to identify the branch (where the LEI of the branch is equivalent to the one in template B_01.03.0020 or equivalent to the LEI of another branch).

As reported in B_01.02.0010

Identify the financial entity head office of the branch, using the LEI, 20-character, alpha-numeric code based on the ISO 17442 standard

Identify the contractual arrangement between the financial entity or, in case of a group, the group subsidiary and the direct ICT third-party service provider.

The contractual arrangement reference number is the internal reference number of the contractual arrangement assigned by the financial entity.

The contractual arrangement reference number shall be unique and consistent over time at entity, sub-consolidated and consolidated level, where applicable.

The contractual arrangement reference number shall be used consistently across all templates of the register of information when referring to the same contractual arrangement.

For the case where an entity is acting on behalf of a financial entity for all the activities of the financial entity including the ICT services (refer to recital 7) the contractual arrangement reference number can be the contractual arrangement between the entity and its direct ICT third-party service provider.

Identify the type of contractual arrangement by using one of the options in the following closed list:

1. 1.
   standalone arrangement;
2. 2.
   overarching / master contractual arrangement;
3. 3.
   subsequent or associated arrangement.

Annual expenses or estimated costs (or intragroup transfer) of the ICT services contractual arrangement for the past year. Monetary value shall be reported in units.

The annual expense or estimated cost shall be expressed in the currency reported in B_01.02.0040.

In case of an overarching arrangement with subsequent or associated arrangements, the sum of the annual expenses or estimated costs reported for the overarching arrangement and the subsequent or associated arrangements shall be equal to the total expenses or estimated costs for the overall contractual arrangement. There shall be no repetition or duplication of annual expenses or estimated costs. The following cases should be reflected:

1. (a)
   where the annual expenses or estimate costs are not determined at the level of the overarching arrangement (i.e. they are 0), the annual expenses or estimated costs shall be reported at the level of each subsequent or associated arrangements.
2. (b)
   where the annual expenses or estimated costs cannot be reported for each of the subsequent or associated arrangements, the total annual expenses or estimated costs shall be reported at the level of the overarching arrangement.
3. (c)
   where there are annual expenses or estimated costs related to each level of the arrangement, i.e. overarching and subsequent or associated, and that information is available, the annual expenses or estimated costs shall be reported without duplication at each level of the contractual arrangement.

As reported in B_04.01.0020

Identify the financial entity making use of the ICT service(s) using the LEI, 20-character, alpha-numeric code based on the ISO 17442 standard

As reported in B_05.01.0010

Code to identify the ICT third-party service provider as reported in B_05.01.0010 for that provider.

As reported in B_05.01.0020

Type of code to identify the ICT third-party service provider in B_02.02.0030 as reported in B_05.01.0020 for that provider.

Identify the end date as stipulated in the contractual arrangement using the ISO 8601 (yyyy–mm–dd) code. Where the contractual arrangement is indefinite, it shall be filled in with ‘9999-12-31’. Where the contractual arrangement has been terminated on a date different than the end date, this shall be filled in with the termination date.

Where the contractual arrangement foresees a renewal, this shall be filled in with the date of the contract renewal as stipulated in the contractual arrangement.

Where the contractual arrangement has been terminated or ended, identify the reason of the termination or ending of the contractual arrangements using one of the options in the following closed list:

1. 1.
   Termination not for cause: The contractual arrangement has expired/ended and has not been renewed by any of the parties;
2. 2.
   Termination for cause: The contractual arrangement has been terminated, the ICT third-party service provider being in a breach of applicable law, regulations or contractual provisions;
3. 3.
   Termination for cause: The contractual arrangement has been terminated, due to the fact that impediments of the ICT third-party service provider capable of altering the supported function have been identified;
4. 4.
   Termination for cause: The contractual arrangement has been terminated due to weaknesses of the ICT third-party service provider regarding the management and security of sensitive data or information of any of the counterparties;
5. 5.
   Termination following a request by a competent authority: The contractual arrangement has been terminated following a request by a competent Authority.
6. 6.
   Other: The contractual arrangement has been terminated by any of the parties for any other reason than the reasons referred to in points 1 to 5.

Is the ICT service related to (or does it foresee) storage of data (even temporarily)?

One of the options provided in the following closed list:

1. 1.
   Yes;
2. 2.
   No.

Identify the country of location of the data at rest (storage) using the ISO 3166–1 alpha–2 code.

If there are several countries of location, additional row(s) shall be used for each country.

Identify the country of location of the management of the data (processing) using the ISO 3166–1 alpha–2 code.

If there are several countries of location, additional row(s) shall be used for each country.

Identify the level of sensitiveness of the data stored or processed by the ICT third-party service provider using one of the options provided in the following closed list:

1. 1.
   Low
2. 2.
   Medium;
3. 3.
   High.

The most sensitive data take precedence: e.g. if both ‘Medium’ and ‘High’ apply, then ‘High’ shall be selected.

One of the options in the following closed list shall be used:

1. 1.
   Not significant;
2. 2.
   Low reliance: in case of disruption of the services, the supported functions would not be significantly impacted (no interruption, no important damage) or disruption can be resolved quickly and with minimal impact on the functions supported;
3. 3.
   Material reliance: in case of disruption of the services, the supported functions would be significantly impacted if the disruption lasts more than a few minutes/few hours, and the disruption may cause damages, but is still manageable;
4. 4.
   Full reliance: in case of disruption of the services, the supported functions would be immediately and severely interrupted/damaged, for a long period.

Reference number of the contractual arrangement between the entity making use of the ICT service(s) provided and the ICT intra-group service provider.

The contractual arrangement reference number shall be unique and consistent over time and across all the group.

As reported in B_02.02.0010

Identify the contractual arrangement reference number signed by the undertaking

As reported in B_02.02.0010

Identify the contractual arrangement reference number signed by the ICT third-party service provider

As reported in B_05.01.0010

Code to identify the ICT third-party service provider as reported in B_05.01.0020 for that provider.

As reported in B_05.01.0020

Type of code to identify the ICT third-party service provider in B_03.02.0020 as reported in B_05.01.0020 for that provider.

As reported in B_02.02.0010

Identify the reference number of the contractual arrangement signed by the entity for providing ICT service(s)

As reported in B_01.02.0010

Identify the entity providing ICT services using LEI, 20-character, alpha-numeric code based on the ISO 17442 standard.

As reported in B_02.01.0010

Identify the reference number of the contractual arrangement in relation to the financial entity making use of the ICT services provided

One of the options in the following closed list shall be used:

1. 1.
   The financial entity making use of the ICT service(s) is a branch of a financial entity
2. 2.
   The financial entity making use of the ICT service(s) is not a branch

As reported in B_05.01.0010 for that ICT third-party service provider.

Examples:

• The identification code of the direct ICT third-party service provider providing ICT service to the financial entity making use of it;

• The identification code of the subcontractor at rank 2 providing service to the direct ICT third-party service provider.

Where the ICT third-party service provider is signing the contractual arrangement with the financial entity, it is considered as a direct ICT third-party service provider and the ‘rank’ to be reported shall be 1;

Where the ICT third-party service provider is signing the contract with the direct ICT third-party service provider, it is considered as a subcontractor and the ‘rank’ to be reported shall be 2;

The same logic apply to all the following subcontractors by incrementing the ‘rank’.

Where multiple ICT third-party service providers have the same ‘rank’ in the ICT service supply chain, financial entities shall report the same ‘rank’ for all those ICT third-party service providers.

To be left blank if the ICT third-party service provider (template B_05.02.0030) is a direct ICT third-party service provider i.e. at ‘rank’ r = 1 (template B_05.02.0050);

Where the ICT third-party service provider is at ‘rank’ r = n where n>1, indicate the ‘Identification code of the recipient of the sub-contracted services’ at ‘rank’ r=n-1 that subcontracted the ICT service (even partially) to the ICT third-party service provider at ‘rank’ r=n.

Examples:

• The identification code of the direct ICT third-party service provider receiving the service from the subcontractor at rank 2;

• The identification code of the subcontractor at rank 2 receiving the service from the subcontractor at rank 3.

The code used to identify the recipient of sub-contracted ICT services shall match the identification code provided in B_05.01.0010 for that provider.

To be left blank where the ICT third-party service provider template B_05.02.0030) is at rank r = 1 (template B_05.02.0050);

Where the ICT third-party service provider is at ‘rank’ r = n where n>1, indicate the ‘Type of code to identify the recipient of the sub-contracted service’ at ‘rank’ r=n-1 that subcontracted the ICT service (even partially) to the ICT third-party service provider at ‘rank’ r=n.

1. 1.
   ‘LEI’ for LEI
2. 2.
   ‘EUID’ for EUID
3. 3.
   CRN for Corporate registration number
4. 4.
   VAT for VAT number
5. 5.
   PNR for Passport Number
6. 6.
   NIN for National Identity Number

The type of code used to identify the recipient of sub-contracted ICT services shall match the identification code provided in B_05.01.0020 for that provider.

The function identifier shall be composed by the letter F (capital letter) followed by a natural number (e.g. ‘F1’ for the 1^st function identifier and ‘Fn’ for the n^th function identifier with ‘n’ being a natural number).

Each combination between ‘LEI of the financial entity making use of the ICT service(s)’ (B_06.01.0040), ‘Function name’ (B_06.01.0030) and ‘Licenced activity’ (B_06.01.0020) shall have a unique function identifier.

Example: a financial entity which operates under two licensed activities (‘activity A’ and ‘activity B’) will be given two unique ‘function identifiers’ for the same function X (e.g. Sales) performed for activity A and activity B.

One of the licenced activities referred to in the underlying legal acts listed in Annex II for the different types of financial entities.

Where the function is not linked to a registered or licenced activity, ‘support functions’ shall be reported.

As reported in B_04.01.0020

Identify the financial entity using the LEI, 20-character, alpha-numeric code based on the ISO 17442 standard

Use this column to indicate whether the function is critical or important according to the financial entity’s assessment. One of the options in the following closed list shall be used:

1. 1.
   Yes;
2. 2.
   No;
3. 3.
   Assessment not performed.

Identify the date using ISO 8601 (yyyy–mm–dd) code of the date of the last assessment of criticality or importance in case the function is supported by ICT services provided by ICT third-party service providers.

Where the assessment of the function’s criticality or importance is not performed, it shall be filled in with ‘9999-12-31’

Use this column to indicate the impact of discontinuing the function according to the financial entity’s assessment. One of the options in the following closed list shall be used:

1. 1.
   Low
2. 2.
   Medium;
3. 3.
   High;
4. 4.
   Assessment not performed.

Use this column to provide the results of the financial entity’s assessment in relation to the degree of substitutability of the ICT third-party service provider to perform the specific ICT services supporting a critical or important function.

One of the options in the following closed list shall be used:

1. 1.
   Not substitutable;
2. 2.
   Highly complex substitutability;
3. 3.
   Medium complexity in terms of substitutability;
4. 4.
   Easily substitutable.

One of the options in the following closed list shall be used:

1. 1.
   The lack of real alternatives, even partial, due to the limited number of ICT third-party service providers active on a specific market, or the market share of the relevant ICT third-party service provider, or the technical complexity or sophistication involved, including in relation to any proprietary technology, or the specific features of the ICT third-party service provider’s organisation or activity;
2. 2.
   Difficulties in relation to a partial or full migration of the relevant data and workloads from the relevant ICT third- party service provider to another ICT third-party service provider or by reintegrating them in the financial entity’s operations, due either to significant financial costs, time or other resources that the migration process may entail, or to an increased ICT risk or other operational risks to which the financial entity might be exposed;
3. 3.
   Both reasons referred to in points 1 and 2.

Use this column to provide the date of the last audit on the specific ICT services provided by the ICT third-party service provider.

This column relates to audits conducted by any of the following:

1. (a)
   the internal audit department or any other additional qualified personnel of the financial entity;
2. (b)
   a joint team together with other clients of the same ICT third-party service provider (‘pooled audit’);
3. (c)
   a third party appointed by the supervised entity to audit the service provider.

This column does not relate to the reception or reference date of third-party certifications or internal audit reports of the ICT third-party service provider, the annual monitoring date of the arrangement by the financial entity or the date of review of the risk assessment performed by the financial entity.

This column shall be used to report all types of audits performed by any of the subjects referred to in points (a), (b) and (c) concerning fully or partially the ICT services provided by the ICT third-party service provider.

To report the date, the ISO 8601 (yyyy–mm–dd) code shall be used.

Where no audit has been performed, it shall be filled in with ‘9999-12-31’.

Use this column to report the existence of an exit plan from the ICT third-party service provider in relation to the specific ICT service provided.

One of the options in the following closed list shall be used:

1. 1.
   Yes;
2. 2.
   No.

One of the options in the following closed list shall be used:

1. 1.
   Easy;
2. 2.
   Difficult;
3. 3.
   Highly complex.

Use this column where the ICT service is provided by an ICT third-party service provider that is not an ICT intra-group service provider

Use this column to provide the impact for the financial entity of discontinuing the ICT services provided by the ICT third-party service provider according to the financial entity’s assessment.

One of the options in the following closed list shall be used:

1. 1.
   Low
2. 2.
   Medium;
3. 3.
   High;
4. 4.
   Assessment not performed.

One of the options in the following closed list shall be used:

1. 1.
   Yes;
2. 2.
   No;
3. 7.
   Assessment not performed.

For each ICT third-party service provider supporting a critical or important function, the assessment to identify an alternative service provider shall be performed.