Top 5 tips for nailing the DORA Register of Information

2026 is going to be different. This year firms are going into this with their eyes open. With a mission on the mind of less stress, less back-and-forth and crucially, less wasted time.

As a partner who supported many financial institutions across Europe with their register of information submission last year – here's what we learnt.

Tip 1: Know what you need to collect

Why is early dialogue with regulators important for the DORA Register of Information?

Early dialogue with regulators helps firms clarify expectations to avoid reworks later. The regulators want to support, they have a supervisory role, but they want to work in tandem to streamline the DORA process and improve resilience across the industry.

DORA requirements are still being interpreted in practice, particularly around scope, categorisation, and level of detail. Engaging regulators early allows firms to:

• Confirm how requirements are interpreted in their jurisdiction and understand their areas of focus

• Identify gaps from their first submission and understand remediation expectations

• Reduce avoidable mistakes that increase workload in future reporting cycles

 Firms that communicate early are better positioned to submit a Register that meets expectations the first time. 

Tip 2: Collaborate with peers

How can firms reduce duplication of effort when building the Register of Information?

Firms can reduce duplication by collaborating with peers and sharing best practices.

Many institutions face the same DORA challenges - often involving the same third-party suppliers. Rather than working in isolation, firms can:

• Learn from peer approaches to proportionality and sustainability

• Align on practical interpretations of ambiguous requirements

• Avoid repeatedly validating identical supplier data, such as entity identifiers

Collaboration leads to more efficient compliance and greater consistency across the industry.

Tip 3: Work with your suppliers

What role should suppliers play in completing the DORA Register of Information?

Suppliers should be treated as partners and primary data providers.

They often hold the most accurate and up-to-date information required for the Register, including:

• Legal Entity Identifiers (LEIs) and EUIDs

• Data hosting locations

• Ultimate parent company details

DORA ICT service categorisation also remains nuanced. Suppliers are well placed to explain whether their services qualify as ICT and how they map to DORA categories. Engaging suppliers early improves data quality and speeds up the process.

Tip 4: Communicate internally

Who should own the Register of Information internally?

Ownership of the Register of Information should be shared across the organisation.

The Register is not a single-team exercise. It requires input from procurement, IT, risk, compliance, and the business. Best practice includes:

• Clearly defining responsibility for each data element

• Making insights visible across teams to support deeper due diligence

• Treating the Register as a living record, not a one-off task

Strong internal communication keeps the Register accurate, current, and usable.

Tip 5: Leverage technology for efficiency and scalability

Why is leveraging technology critical for the DORA Register of Information?

Technology is essential because DORA requires firms to understand not just third parties, but the wider supply chain that supports ICT services.

A technology-enabled approach helps firms:

• Automate data collection from suppliers, reducing manual effort and errors

• Collect data at entity and service level, supporting more accurate supply chain mapping

• Generate preformatted, regulator-ready reports without rebuilding the Register each cycle

• Scale visibility to fourth parties and beyond when required

• Support group-level reporting and future regulatory changes, such as potential ICT and non-ICT register consolidation under the proposed EBA TPRM Guidelines

By replacing spreadsheets with a centralised, always available database, firms can automate, standardise, and scale their Register of Information while meeting today’s DORA requirements efficiently and remaining ready to deepen supply chain visibility when required.

Final takeaway: What’s the key to getting the DORA Register of Information right?

The key to nailing the DORA Register of Information is communication.

Firms that communicate effectively:

• With regulators to align expectations

• With peers to reduce duplication

• With suppliers to improve data quality

• And internally to maintain ownership and accuracy

are far better positioned to meet DORA requirements - not just once, but year after year.