Under DORA, financial entities must keep a register of all contractual arrangements with ICT third-party service providers — and keep it current.
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to EU financial entities from 17 January 2025. Article 28 requires them to manage ICT third-party risk and to maintain a register of information on all contractual arrangements for ICT services provided by third parties. Implementing technical standards define the templates, and competent authorities collect the registers.
| Area | Typical content |
|---|---|
| The entity | Legal entity identifiers and group structure |
| The provider | Identity, location and parent company |
| The arrangement | Contract references, dates, notice periods, governing law |
| ICT services | Type of service and data processed |
| Functions supported | Which business functions rely on the service and whether they are critical or important |
| Sub-contracting | Material sub-contractors in the chain |
| Assessment | Substitutability and exit considerations |
Build the register from your TPRM platform rather than a separate spreadsheet: every new ICT vendor captured at intake, contract dates and functions recorded once, sub-contractors updated during assessments, and an export in the required format when the authority asks.
Give every arrangement a named owner responsible for its data, and report completeness monthly. Regulators treat errors in the register as a sign of weak ICT third-party risk management.
The register is not only a reporting obligation. The same data — functions supported, criticality, substitutability and sub-contracting — drives tiering, contract requirements, exit planning and concentration analysis. Building the register inside the third-party risk process keeps the data current and makes the register a by-product of good management rather than a separate annual project.
NAZZTEC AI TPRM automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises. Our consultants design and run the process alongside it through our Governance, Risk & Compliance services.
Next step: request a demo of NAZZTEC AI TPRM or read more on the product page.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
Spreadsheets and e-mailed questionnaires cannot keep up with hundreds of vendors. Here is what AI-driven TPRM software must deliver — and where human judgement must stay in charge.
A 300-question spreadsheet sent to every supplier produces fatigue, not assurance. Design questionnaires by tier, ask for evidence, and review answers consistently.
Every asset passes through the same stages. Control each transition and the register stays accurate without annual clean-ups.
Tell us what you are working on. A senior NAZZTEC consultant will come back within one business day with a practical view.
We respond to every enquiry within one business day.