Check a DORA Register of Information against the EBA validation rules

What it checks, in the order the EBA does

Rule codes are the EBA's, so the output reads against the official rule list and the official feedback file. Checks the EBA does not run carry an AA- prefix and say what they rest on.

If a file has already come back rejected, the guide to errors 805, 806 and 807 explains each code, the one on what each template holds shows how the tables link, the one on LEI or EUID covers provider identifiers, and the deadlines by regulator give each NCA's 2026 window. For the providers registers repeat most, the ICT provider list gives the entity to file, its LEI status and renewal, lapsed twins and the CTPP it rolls up to.

Package and file names

The zip name pattern, the root folder, META-INF, report.json, parameters.csv and FilingIndicators.csv with their exact headers, entityID and refPeriod agreeing with the file name, lower-case table names, UTF-8. Rules 103–115, 306, 701–724.

Headers and rows

Only the column codes the taxonomy defines, none twice, none blank; every row with the same number of cells as the header; comma-separated, not semicolon. Rules 801, 802, 809.

Keys

Key columns filled (805) and unique as a tuple (806), and all twenty-two foreign keys the taxonomy declares (807): contracts to B_02.01, entities to B_01.02, providers to B_05.01, functions to B_06.01, ultimate parents to their own row.

Values

Dates as yyyy-mm-dd (330), integers without decimals (331), amounts as plain numbers (305), link columns true (333), and every enumerated cell drawn from its closed list with the eba_ prefix (503) — with a suggestion when the code is right and the prefix or case is wrong.

Business rules

The DPM rules with warning severity: existence (e2xxxx_e), row-level mandatory fields (v88xx_m), the conditional rules on subsequent arrangements, total assets and substitutability reasons, sign rules, LEI format.

Identifiers

ISO 17442 check digits on every LEI (the EBA regex passes a typo; the checksum does not), placeholders such as DUMMYLEI…, EUID structure, and the ITS rule that a legal person carries an LEI or EUID — which the DPM stopped enforcing in March 2025 but the regulation did not.

What the ITS asks for but no rule enforces

Notice periods, governing law, data storage and reliance for services supporting critical functions; a B_07.01 assessment for each of them; an annual expense for every direct provider; contracts that end before they start. None of these is rejected. All of them are what the content review in April 2026 is about.

GLEIF, on request

Existence and status of every LEI, the country check (VR_16), and a comparison of the names and ultimate parents the register declares with what each entity has filed with GLEIF. The only step that leaves the tab; it sends the LEIs and nothing else.

Built from public data, all of it dated

Everything the checker knows comes from a document or dataset anyone can download. The point of listing them is that you can check the checker.

• EBA XBRL taxonomy 4.0, DORA module 1.1.0

  The fifteen tables, every column type, primary and foreign keys and all closed lists — generated from the taxonomy files, not typed.

• EBA technical checks and validation rules for RoI reporting, 28 April 2025

  The rule codes and severities, including the March 2025 deactivations.

• ESAs RoI reporting FAQ, 28 March 2025

  The placeholder conventions (9999-12-31, qx2007, "Not Applicable") and the empty-template rules.

• EBA Filing Rules v5.5 and the plain-CSV package guide

  File naming, folder layout, parameters.csv and FilingIndicators.csv.

• ESAs list of designated critical ICT third-party providers, 18 November 2025

  Nineteen names. The ESAs publish no identifiers; the LEIs used to match them are listed below.

• GLEIF Global LEI Index (CC0)

  Live, from your browser, batched 200 at a time. Legal name, legal address, registration status, direct and ultimate parent.

• European Commission adequacy decisions

  The country classification behind the data-location table.

• ESAs dry-run summary report (ESA 2024 35) and EBA observations from the 2025 collection

  Which errors are common, and therefore which hints are worth writing.

Questions people ask

What is the DORA register of information?

Under Article 28(3) of the Digital Operational Resilience Act, every financial entity in the EU must maintain a register of all its contractual arrangements with ICT third-party providers and report it to its competent authority on request, in practice once a year. The format is set by Implementing Regulation (EU) 2024/2956: fifteen linked templates (B_01.01 to B_99.01) covering the entities in scope, each contract, each provider and its ultimate parent, the functions the services support, their criticality, and a risk assessment of every service supporting a critical or important function.

What format does the register of information have to be submitted in?

What the ESAs receive is a zip containing plain CSV files in the xBRL-CSV layout: one lower-case file per template (b_01.01.csv … b_99.01.csv), plus report.json, parameters.csv and FilingIndicators.csv, inside a root folder named like the zip. The zip itself is named <LEI>.<CON|IND>_<country>_DORA010100_DORA_<reference date>_<timestamp>.zip. Several national authorities accept an Excel workbook and convert it to this package for you; the checks that matter are still run on the converted package.

What are the DORA validation rules?

The EBA publishes them as a spreadsheet, updated last on 28 April 2025. They come in four layers: technical checks on the package (rules 101–115 and 701–724, which reject the file), DPM technical checks on types, keys and closed lists (305–333, 503, 805–809, which also reject), DPM business validation rules on mandatory and conditional fields (the v88xx_m, e2xxxx_e and sign rules, which are warnings), and LEI and EUID checks against GLEIF and BRIS (VR_2 to VR_78, also warnings). The 2026 collection uses the same taxonomy and rules as 2025.

Why was my register rejected with error 807?

Rule 807 is a foreign-key failure: a value in one template must exist as a key in another, and does not. The most common case by far is an ultimate parent named in B_05.01 column c0110 that has no row of its own in B_05.01. Others are a contract reference used in B_02.02, B_03.xx, B_04.01, B_05.02 or B_07.01 that is missing from B_02.01, a function identifier in B_02.02 that is not defined in B_06.01 for the same entity, and a provider code with no row in B_05.01. The checker names the reference (R1 to R22) and the row.

Do I need an LEI for every ICT provider?

The ITS says a legal person is identified by an LEI or, for EU companies, an EUID; third-country legal persons by an LEI only; other codes (registration number, VAT, passport) only for individuals acting in a business capacity. The DPM rule enforcing this was switched off in March 2025, so a national code will not cause a rejection, but it remains what the regulation asks for and what supervisors have said they will follow up on. Where a provider genuinely has no identifier, the FAQ allows a placeholder to avoid a key failure; the checker flags those so you know how many you have.

Which ICT providers have been designated critical under DORA?

On 18 November 2025 the three European Supervisory Authorities published the first list of critical ICT third-party providers under Article 31 DORA, nineteen in all: Accenture plc, Amazon web Services EMEA Sarl, Bloomberg L.P., Capgemini SE, Colt Technology Services, Deutsche Telekom AG, Equinix (EMEA) B.V., Fidelity National Information Services, Inc., Google Cloud EMEA Limited, International Business Machine Corporation, InterXion HeadQuarters B.V., Kyndryl Inc., LSEG Data and Risk Limited, Microsoft Ireland Operations Limited, NTT DATA Inc., Oracle Nederland B.V., Orange SA, SAP SE, Tata Consultancy Services Limited. The EBA is lead overseer for all of them. The checker marks any of them that appear in a register.

Is the register uploaded anywhere?

No. The zip, CSVs or workbook are read in your browser tab and every check runs there. The one optional step that leaves the tab is the GLEIF lookup, which sends the LEI codes found in the register, and nothing else, directly to api.gleif.org; GLEIF publishes the data under CC0 and the request does not pass through this site. Closing the tab is the deletion step.

What does this not check?

It does not query the Business Registers Interconnection System for EUIDs, which has no open interface, so EUIDs are checked for structure only. It does not know about checks a national portal adds on top of the EBA set, or how a portal converts an Excel template. It does not judge whether a function should have been classed as critical; it only says where the data is inconsistent with that classification. It is a checker, not legal advice.