The deadline for submitting the register of information is approaching. Austrian financial institutions must complete their reports by March 31, 2025 and upload them to the FMA's incoming platform by April 11, 2025. In Germany, BaFin has extended the submission deadline to April 28, 2025 (as of March 31, 2025).
The register of information in brief
The Digital Operational Resilience Act (DORA) requires the European financial sector to maintain a register of all contractual agreements relating to the procurement of ICT services from third-party service providers. This is intended to provide the European Supervisory Authorities (ESAs) with an overview of financial firms' dependencies on their third-party ICT providers in order to identify and mitigate concentration risks. According to the regulation, the register of information must be made available to the competent authority at any time upon request and actively reported on annually.
In an online workshop with about 3,000 participants, BaFin addressed the most important questions regarding the submission. Here is a brief summary:
Choose the right format
At the European level, the ESAs have specified xBRL as the data format for the register of information. The Excel template used for the 2024 dry run is not valid for the final submission.
In order to support small and medium-sized companies in particular in preparing the reports, BaFin has developed its own Microsoft Excel template that companies can use on a voluntary basis. After submission, BaFin will convert the template to xBRL and forward it to the ESAs.
The BaFin template is based on the ITS (Implementing Technical Standards) for the register of information and has the same numbering and names. However, there are some restrictions on its use. During the workshop, those responsible explained that the xlsx template is only compatible with the Windows operating system and has only been tested in Microsoft Excel. In addition, Excel includes macro elements, the use of which is prohibited by the IT departments of many organizations for security reasons.
Alternatively, German financial institutions are free to upload their register of information directly in the ESAs xBRL format. According to BaFin, this option is likely to be more suitable for larger firms, as the Excel template reaches its capacity limits with larger volumes of data. Austria's FMA also provides its own Excel template, which is mandatory for financial companies.
Be sure to enter the data correctly
When using spreadsheets, manual data entry can quickly lead to typographical, transcription, or inadvertent errors. These must be prevented at all costs in order to avoid error messages or queries from the authorities.
BaFin also emphasized in the workshop that companies should only fill in the provided template with content and not make any structural changes, otherwise the file will not work when uploading.
Do not wait until the deadline to submit
To submit the register of information, the financial company must first register on the national authority's website. In Austria, uploading is possible from April 1 to April 11, 2025, and in Germany, from April 14 to April 28, 2025.
Once the register has been uploaded, a processing time of several days is expected, as both the national authority and the ESAs have to check and approve the file. Only then will the submission be considered complete. In addition, no notification of status updates is provided, which requires firms to be proactive in their monitoring. The BaFin therefore recommends that a sufficient buffer of time should be built into the submission in order to be able to react to feedback and possible error messages.
Fabasoft DORA offers the option to automatically generate the register of information and report it in the required format.
Additional links:
Information and technical requirements of the ESAs
