ICT Third-Party Register (Register of Information)
The register of information is a structured record of every ICT third-party arrangement a financial entity relies on, required under DORA Article 28. Building and maintaining it, in the format competent authorities expect, is a core, recurring DORA obligation.
What the register must contain
Each arrangement is recorded with the provider, service, whether it supports a critical or important function, contract dates, governing law, and exit arrangements. The register must be kept current and be reportable to authorities on request. See the glossary definition for the full field set.
Build it yourself or with support
Our free TPP Register Generator produces a register in the EBA column format. For larger estates, providers offer tooling and managed maintenance, compare them in the directory.
The contract behind the register entry
The register records that an arrangement exists; Article 30 governs what the underlying contract must actually say. Baseline provisions apply to every ICT third-party arrangement: a clear description of the service, data location, availability commitments, and cooperation duties toward the entity and its supervisors. A stricter tier applies once the arrangement supports a critical or important function: audit and inspection rights for the entity, its external auditor, and the competent authority; termination rights the provider cannot contract away, on request from a competent authority, after a material breach, or where the provider's own resilience deteriorates; and exit assistance, a contractual obligation on the provider to help transition the service out, not just an entity right to walk away. When you build your register with the generator above, treat every "critical function: yes" row as a prompt to check the contract against this stricter tier. See our Article 30 checklistfor the full clause-by-clause breakdown. Banks and investment firms should note that Article 30's discipline is no longer confined to ICT: the EBA's final guidelines on non-ICT third-party risk, published September 2026, extend a comparable contractual standard, audit rights, exit strategy, subcontracting visibility, to third-party arrangements outside your ICT register.
Frequently asked questions
Who must maintain a register of information under DORA?
All in-scope financial entities must maintain a register of their ICT third-party arrangements at entity, sub-consolidated, and consolidated levels.
What format should the register use?
Authorities expect the harmonised EBA register template. Our generator exports matching columns.
How often is the register submitted?
Entities report their registers to competent authorities at least annually and whenever authorities request them.
Do register-of-information entries need to match the underlying contract?
Yes. The register is a summary of the contractual arrangement, so fields like criticality, data location, and exit strategy should reflect what the Article 30 contract terms actually say, not what the entity intends to negotiate later.