DORA Compliance Was the Starting Point. Maturity Comes Next.

For many financial institutions, 2025 and 2026 were defined by one objective: delivering their DORA Register of Information on time.

The challenge was significant. Organisations were required to map ICT suppliers, document outsourcing arrangements, identify critical dependencies and provide regulators with a level of transparency that many had never been asked to demonstrate before.

Meeting those requirements was a major achievement.

But as the first reporting cycles move behind us, a new challenge is emerging.

The conversation is shifting from compliance to maturity.

The question is no longer, "Can we submit a Register of Information?" Instead, it is, "How do we make it more accurate, more efficient and more valuable to the organisation?"

The institutions that gained the most from their DORA programmes were not necessarily those that submitted first. They were the organisations that used the process to strengthen supplier governance, improve data quality and gain greater visibility into their third-party landscape.

Based on our experience supporting financial institutions across Europe, here are three practical lessons that can help organisations build a more mature and sustainable approach to managing their Register of Information.

1. Engage Suppliers Early

The quality of a Register of Information is ultimately determined by the quality of the underlying supplier data.

Much of the information required for DORA sits with suppliers themselves. This includes legal entity identifiers, data hosting locations, corporate structures and details of the ICT services being provided.

Organisations that engage suppliers early benefit from more complete data, fewer remediation activities and a stronger foundation for future reporting cycles.

Mature DORA programmes recognise that supplier engagement is not a one-off exercise. It is an ongoing partnership that helps maintain the quality and reliability of critical third-party information.

2. Reduce Duplication Through Collaboration

One of the most common frustrations for both financial institutions and suppliers is duplication.

Many organisations are requesting similar information from the same suppliers, often through separate processes and at different times. The result is repeated effort across the industry, with organisations collecting, validating and maintaining largely identical datasets.

As DORA programmes mature, firms have an opportunity to take a more collaborative approach.

By sharing best practices, aligning on common interpretations and encouraging greater reuse of supplier information, organisations can reduce administrative burden while improving consistency and data quality.

Reducing duplication is not simply about efficiency. It creates capacity to focus on the risks and insights that matter most.

3. Make the Register Part of Business-as-Usual Governance

A Register of Information touches multiple functions across an organisation. Procurement, IT, security, risk, compliance and legal teams all play a role in maintaining accurate information.

However, many organisations still treat the Register as a project that receives attention only when reporting deadlines approach.

That approach becomes unsustainable as supplier ecosystems evolve and regulatory expectations continue to develop.

The most mature organisations embed the Register within their wider governance and third-party risk management processes. Changes to suppliers, services and dependencies are reflected throughout the year, rather than being addressed through periodic remediation exercises.

When the Register becomes part of business-as-usual activity, reporting becomes easier because the underlying data is already being managed effectively.

Engaged suppliers, collaborative teams and strong governance create the foundation for a successful Register of Information.

The organisations making the greatest progress are increasingly combining all three through community-driven approaches that reduce duplication, improve supplier engagement and support the ongoing maintenance of supplier information.

But for many financial institutions, the biggest gains are still to come.

DORA 2.0: The Age of Automation and Collaboration

The first stage of DORA was about achieving compliance.

The next stage is about efficiency.

Efficiency through collaboration. Efficiency through consolidation. Efficiency through technology.

The institutions leading the next phase of DORA maturity are finding ways to spend less time gathering information and more time acting on it through automation, supplier engagement and shared approaches to data collection.

Athora Netherlands experienced this first-hand during their DORA preparations. Through FSQS-NE, over 400 suppliers were invited to provide Register of Information data, with suppliers completing their submissions in an average of just 18 days.

Rather than building a DORA data collection process from scratch, Athora was able to leverage an existing supplier community, established validation processes and a shared framework for collecting Register of Information data.

As Ruud van Ieperen, Manager Procurement & Vendor Management at Athora Netherlands, explained:

"With FSQS-NE automating the collection of information, our teams could work more efficiently and focus on the other aspects of compliance."

That is the difference between compliance and maturity.

And for many financial institutions, that journey is only just beginning.