DORA register of information

Do we need an LEI or an EUID for each ICT provider in the DORA register?

A provider that is a legal person needs an LEI or, if it is registered in an EU business register, an EUID; both where it has both. A provider outside the EU needs an LEI and nothing else will do. A lapsed LEI is still that provider's LEI, no published check rejects a file for it, and the ESAs said they would not enforce status strictly in 2025. What rejects a file on receipt is an empty identifier or a parent code that matches no row, not a bad one. Since 2026 there is a second hurdle: the ESAs review data quality in April and can send a register back for resubmission, and placeholder codes are among the examples given.

Every rule below is quoted from the ITS, the ESAs' FAQ, the EBA's rule list or GLEIF's own definitions, with the document's date. Checked against those sources on 18 October 2026. Nothing here is legal advice; it is what the documents say.

The practical step after reading this is to run the register through the DORA Register Checker. It verifies every LEI's check digits, looks each one up in GLEIF for existence and status, checks EUID structure, and runs the key rules that actually reject files. It runs in your browser and the register is not uploaded.

The rule, in the regulation's own words

Article 3(5) of Implementing Regulation (EU) 2024/2956 (adopted 29 November 2024, in force 22 December 2024): financial entities “shall use a valid and active legal entity identifier (LEI) or the European Unique Identifier referred to in Article 16 of Directive (EU) 2017/1132 (‘EUID’), and where available both of these identifiers, to identify all of their ICT third-party service providers that are legal persons, except for individuals acting in a business capacity.”

Article 3(6) extends the same requirement to subcontractors that underpin ICT services supporting critical or important functions: the financial entity must ensure, through the direct provider, that they “use a valid and active LEI or provide their EUID, and where available both”.

Recital 9 makes the geography explicit: either identifier for providers established in the Union, “whereas the ICT third-party service providers established in third-countries should be identified with LEI only”. The Annex I fill-in instruction for B_05.01.0020 says it without the hedging: “Only LEI shall be used for legal persons that are not established in the Union.” EBA Q&A 2024_7283 (final answer 28 March 2025) repeats that sentence almost word for word, and the ESAs' FAQ of 28 March 2025 (Q39) puts it as: for legal persons registered outside the EU “only LEI can be used”.

“Where available both” has a place in the template. The first code goes in B_05.01.0010 with its type in 0020; the second goes in the optional additional-code field B_05.01.0030 with its type in 0040. The EBA runs the same GLEIF and BRIS checks on that second field (VR_77 and VR_78).

The reporting financial entities themselves, in B_01.01 and B_01.02, are identified by LEI only (FAQ Q39). The EUID option exists for providers, not for you.

Who gets which identifier

ProviderAllowed in B_05.01.0020Source
Legal person registered in an EU business registerLEI or EUID; both where available (the second in B_05.01.0030)ITS Art. 3(5); FAQ Q39
Legal person established outside the EULEI onlyITS recital 9 and B_05.01.0020 instruction; FAQ Q39; Q&A 2024_7283
Individual acting in a business capacityCRN, VAT, PNR or NIN (or an LEI if they have one)FAQ Q39, Q47
Ultimate parent undertaking (B_05.01.0110)Same rules; the code must match that parent’s own B_05.01.0010 rowITS Annex I, B_05.01.0110 and 0120
The reporting entity and its group (B_01.01, B_01.02)LEI onlyFAQ Q39

The type code is the bare value: LEI, EUID, CRN, VAT, PNR or NIN. The country-code-plus-underscore form printed for B_05.01.0020 in the Official Journal text is listed by the ESAs under errors in the published ITS; report the value without the country code (FAQ Q47; Q&A 2024_7283).

Why there are two identifiers at all

The ESAs' draft did not offer an EUID. The European Commission rejected that draft on the grounds that it is necessary to “allow financial entities the choice of identifying their ICT third-party service providers registered in the EU either by using the Legal Entity Identifier (LEI) or by using the European Unique Identifier (EUID)”. On 15 October 2024 the ESAs answered that two identifiers “could bring additional complexity that would negatively impact the quality of data used, and risk delays in the designation of critical ICT third-party service providers”. They accepted that the EUID is free of charge to EU-registered companies, but said it “would limit the access to and the possibility for verification of the information by the financial entities and competent authorities”. If both identifiers had to coexist, the ESAs asked that financial entities be given “the preference for using LEI, especially where both identifiers are available”, and that groups keep the codes for their providers consistent.

The Commission's version is the one that became law six weeks later. That history explains the shape of the rule: the EUID is an alternative only where it can exist, which is inside the EU business registers, and the LEI stays the only option everywhere else.

It also explains the verification problem the ESAs predicted. An LEI can be checked against GLEIF by anyone, free, by API. An EUID can only be checked in the Business Registers Interconnection System, and the FAQ (Q41) says plainly: “only manual searches on BRIS are available and there are no API for batch processing”. The EBA's own engine works around that by fetching EUIDs from BRIS into a cache before it runs the identifier checks (EBA feedback explanation, 10 February 2025). A financial entity has no such cache.

What the two codes are

LEI

A 20-character alphanumeric code under ISO 17442, which is how the ITS instruction for B_05.01.0010 describes it. The last two characters are check digits, so a typo usually fails arithmetic before it fails a database. The EBA's LEI format rules (v8826_m, v8890_m to v8892_m) only test the pattern, eighteen letters or digits then two digits, which a transposed code passes; the checksum does not. Those format rules cover the B_01 entity templates; a provider LEI in B_05.01 is tested only against GLEIF (VR_71, VR_77).

Every LEI record carries a registration status and a NextRenewalDate, “the next date by which the LEI information must be renewed and re-certified by the Legal Entity” (GLEIF LEI-CDF 3.1). The data is published under CC0 and the GLEIF API answers a single record at api.gleif.org/api/v1/lei-records/{LEI} with no key.

EUID

The European Unique Identifier is the code a company or branch carries in the Business Registers Interconnection System. Section 9 of the Annex to Implementing Regulation (EU) 2021/1042 (18 June 2021) builds it from a country code, a register identifier, the registration number in that register, and an optional verification digit. The ITS instruction for B_05.01.0010 refers to “Article 9” of that Regulation; the structure is in section 9 of its Annex. The ESAs note it is free of charge to EU-registered companies.

Written out, the country and register part is separated from the company number by a dot, and the ESAs' FAQ (Q45) says the dot is part of the code and must be reported. The EBA's two “easy validations” (observations, April 2025): it should contain a dot, and it should start with the two-letter ISO code of an EEA country. You find it by searching the company on the e-Justice business registers search, one company at a time.

What a lapsed LEI means, from GLEIF rather than from a reseller

If you have read that a lapsed LEI is “no LEI” or “invalid”, that is not GLEIF's definition. GLEIF's data format defines LAPSED as “an LEI registration that has not been renewed by the NextRenewalDate and is not known by public sources to have ceased operation”. In GLEIF's own words, from its 2017 note on renewal rates: “an LEI with the registration status ‘lapsed’ remains a valid LEI. The status ‘lapsed’ simply indicates that a legal entity is behind schedule with its renewal, i.e. re-validation of its information against third party sources.”

So two things are true at once. The code still uniquely identifies the provider and will resolve in GLEIF. And the ITS asks for a “valid and active” LEI, which a lapsed one is not, because the yearly re-validation of its name, address and parent has not been done.

Scale, as of 18 October 2026, from the GLEIF API: 3,465,910 LEI records in total, of which 1,988,277 are ISSUED, 1,212,096 are LAPSED, 256,274 RETIRED and 1,732 ANNULLED. Roughly one record in three is lapsed, so a register of any size will contain some.

The same GLEIF note is also clear about the cost of leaving it: entities behind schedule with their renewal “risk being sanctioned for non-compliance with the applicable law or losing business, because counterparties might refuse to transact with entities that keep their LEI in lapsed status”. Still the right code, but not a state to leave a provider in.

The statuses you will meet, and what to do

StatusGLEIF definition (LEI-CDF 3.1)For the register
ISSUEDValidated and issued; the entity was operating as of the last update.What the ITS means by active. Nothing to do.
LAPSEDNot renewed by the NextRenewalDate, and not known from public sources to have ceased operation.Still the entity’s LEI. Not what the ITS asks for. Ask the provider to renew; see below for how the ESAs treated it.
RETIREDThe entity has ceased operation without merging into another.Unlikely to be the counterparty on a live contract. Find out who you are actually contracting with.
MERGEDThe entity was merged into another legal entity and no longer exists as an operating entity. GLEIF marks this value deprecated, and the API returned no records with it on 18 October 2026.Report the surviving entity.
ANNULLEDMarked erroneous or invalid after issue.Do not use it. Look the entity up by name.
DUPLICATEA second registration of the same entity; assigned to the one that should no longer be used.Use the surviving LEI.
PENDING_TRANSFER / PENDING_ARCHIVALThe registration is being moved to a different LEI issuer (LOU); it reverts to a non-pending status afterwards.The code does not change. Keep it and look again later.

What happens if you get it wrong

The ESAs run four categories of checks in sequence: technical checks on the package, DPM technical checks, DPM business validation rules, and finally the EUID and LEI checks (EBA feedback explanation, 10 February 2025). In that document's process diagram only the first step has a reject path; once a file passes it, the response is “pending further validations” and the other three produce findings in a results file. The EBA's observations from the 2025 collection list, per rule, whether it led to a reject.

MistakeRuleRejects the file?Source
Identifier left empty (it is a key column)805YesEBA rule list 28 Apr 2025; observations Apr 2025; FAQ Q40
Ultimate parent code in B_05.01.0110 that matches no provider row807YesEBA rule list; observations (807 listed first among the most common errors)
Same identifier on two provider rows806No in the EBA pipeline, but fix itRule list (DPM technical check); observations table says no reject, though the same deck’s 806 slide says “rejected”
Type of code not one of the closed-list values503No in the EBA pipeline (finding after acceptance)EBA rule list, DPM technical checks; feedback explanation 10 Feb 2025
Entity LEI in B_01.01 to B_01.03 not in the 18+2 patternv8826_m, v8890_m to v8892_mNo (warning)EBA rule list
LEI not found in GLEIFVR_71 (B_05.01.0010), VR_77 (B_05.01.0030), VR_2, VR_12, VR_23 (entities)No (business check)EBA rule list; observations: “Wrong LEI reported”, leads to reject: NO
LEI lapsed in GLEIFnone publishedNo; status “not enforced strictly” in 2025FAQ Q44
EUID not found in BRIS, or not in EUID formVR_72 (B_05.01.0010), VR_78 (B_05.01.0030)No (business check)EBA rule list; observations: 58,170 invalid format, 258 not found, 2,717 found
Legal person identified by CRN, VAT or another national codev8817_mNo; rule deactivated March 2025EBA rule list; FAQ Q40 says other identifiers are highlighted as a data-quality issue
Country code in B_01.02 not valid according to GLEIFVR_16No (business check)EBA rule list

Two details from the rule list matter in practice. The LEI and EUID checks are marked “do not run rule” when the value is missing, so they never fire on an empty cell; rule 805 has already rejected the file by then. And the EBA says it keeps a cache of the GLEIF database; it does not publish how often that cache is refreshed, so do not count on a renewal made the day before submission showing in the feedback.

“Does not reject” is not “does not matter”. The FAQ (Q40) says whether the ESAs can use an entry with a missing or invalid LEI “will depend on the overall quality of the relevant entries”, and those entries are what the ESAs use to designate critical providers. The Central Bank of Ireland's guidance for the 2026 round (page marked updated 29 January 2026) puts it as: providers “will need to have either a valid LEI code or EU-ID” to pass validation, with a footnote allowing “other valid code for third country providers according to EBA FAQ”. A national portal can be stricter than the ESAs' engine, and the EBA's observations say the authorities' own checks “may differ”.

From 2026 there is also a step after acceptance. The same Central Bank of Ireland page says the EBA announced, in the week commencing 16 February 2026, an extra review of data content: registers are filed in March, then in April the EBA runs data-quality checks on all of them. Its examples include “An Invalid value reported for the Identification code of a TPP’s ultimate parent: 9999999DUMMY99999999”. The CSSF (17 March 2026) says that if the ESAs detect errors in April “and consequently refuse the register of information on their side”, the entity must fix and resubmit before the end of April. So a bad identifier does not bounce the file on receipt, but it can still bring it back to you.

On timing: ESAs Decision ESA 2024 22 makes the collection annual, with a reference date of 31 December of the preceding year and competent authorities submitting by 31 March. For the 2026 round that meant data as at 31 December 2025, a filing window of 2 to 31 March 2026 in Ireland and a 31 March 2026 deadline in Luxembourg, followed by ESAs quality checks through April 2026 with resubmission before the end of April (CSSF, 17 March 2026). The next reference date is 31 December 2026. A lapsed code renewed well before then should show as ISSUED when the ESAs check it.

Fixing the identifiers, step by step

  1. 01Sort providers into three groups.

    Legal person inside the EU, legal person outside the EU, individual acting in a business capacity. The third group is the only one that may carry a CRN, VAT, PNR or NIN (FAQ Q39).

  2. 02Look every LEI up in GLEIF, not in your vendor master.

    Check the check digits first; then existence, then registration status and NextRenewalDate, then the legal name and legal-address country against what the register says. The legal name to report is the one in the business register (FAQ Q120); where GLEIF shows something different, find out which is current.

  3. 03Lapsed: ask the provider to renew; keep the code.

    Renewal is the registrant’s act, not yours, and the code does not change. Record the request and the NextRenewalDate. Do not swap the LEI for an EUID or a national number to make the warning go away; an EU provider may carry both, and a third-country provider may carry only the LEI.

  4. 04Retired, merged, annulled, duplicate: find the real counterparty.

    A retired code means the entity has ceased operation. The contract is with someone, and that someone has an identifier; report that one and put the former entity nowhere.

  5. 05No LEI, provider in the EU: find the EUID.

    Search the company on the e-Justice portal, one at a time. Report it as country code, register identifier, dot, registration number, with the dot (FAQ Q45), and type EUID. Do not report an LEI under type EUID; that was the EBA’s most common EUID error.

  6. 06No LEI, provider outside the EU: fill the key and flag it.

    Leaving the cell empty rejects the file (805). The FAQ (Q40) says to populate it with any relevant value, in practice another identifier you hold, and accept the data-quality finding. Use a real code, not a placeholder: a dummy parent code is one of the examples the April 2026 data-quality review flags. Then get the provider an LEI before the next reference date; the ITS obligation to use one does not lapse because the ESAs did not enforce it.

  7. 07Make the parent rows close.

    Every code in B_05.01.0110 must appear as a B_05.01.0010 row for that parent, with the same type in 0120 as that row’s 0020. A provider with no group repeats its own code (ITS Annex I). This is rule 807, listed first among the most common errors in the EBA’s 2025 observations.

  8. 08Run the checker, then the GLEIF step.

    The first pass runs the package and key rules that reject, plus the closed-list and mandatory-field checks that come back as findings. The optional second pass sends the LEIs, and nothing else, to GLEIF and returns status, name and parent for each. EUIDs are checked for structure only, because BRIS cannot be queried.

A worked example: five providers, five outcomes

A fictional bank's B_05.01 has five providers. The identifiers below are shaped like real ones but only the GLEIF row is a real record; the rest are patterns, not codes to copy.

ProviderWhat the register saysWhat the checks sayOutcome
A Swiss foundation (GLEIF itself, as the one real row)LEI 506700GE1G29325QX363, type LEICheck digits pass. GLEIF, 18 October 2026: Global Legal Entity Identifier Foundation, ISSUED, next renewal 15 March 2027, country CH.Accepted; nothing to do.
A Dutch software companyType EUID, value NL + register identifier + dot + company numberStarts with an EEA country code and contains a dot: passes the two easy checks the EBA suggests. Existence in BRIS can only be checked by hand on the e-Justice portal.Accepted; VR_72 may still warn if BRIS does not know the number.
A US cloud providerType LEI, value with status LAPSED since last springCheck digits pass; GLEIF resolves it to the right name; status is not ISSUED.Not a reject: no published rule tests status, and FAQ Q44 said status would not be strictly enforced in 2025. Renewal requested from the provider; not a reason to change the code.
An Indian outsourcing firm with no LEIType CRN, value a national registration numberA legal person outside the EU with a non-LEI code. v8817_m would have flagged it but is deactivated; the ITS still requires an LEI.Accepted with a data-quality finding (FAQ Q40), and open to a resubmission request in the April review. Get the firm an LEI before 31 December 2026.
The US provider’s parentB_05.01.0110 holds the parent LEI, but there is no B_05.01 row for the parentForeign key from 0110 to 0010 fails.Rule 807: the whole file is rejected. Add a B_05.01 row for the parent under the same code and type.

Four of the five rows get through on receipt. The one that fails the file has nothing to do with LEI versus EUID: it is a parent code with no row behind it. That is the pattern in the EBA's 2025 observations, where foreign-key violations (807) are listed first among the most common errors and lead to a reject, and wrong LEIs are marked as not leading to one. Rows three and four can still come back in the April data-quality review.

Sources, with dates

Each fact above comes from one of these. If a document here is superseded, the page is out of date; the ESAs' FAQ in particular has not been reissued since 28 March 2025 as of 18 October 2026.

Questions people ask

Is an EUID accepted instead of an LEI in the DORA register of information?
Yes, for a legal person established in the EU. Article 3(5) of Implementing Regulation (EU) 2024/2956 says financial entities shall use a valid and active LEI or the EUID, and both where available, to identify ICT third-party service providers that are legal persons. The ESAs’ FAQ of 28 March 2025 (Q39) and EBA Q&A 2024_7283 repeat it: for legal persons only an LEI or EUID can be used. Where a provider has both, one goes in B_05.01.0010 and the other in the additional-code field B_05.01.0030; the ESAs asked in October 2024 that the LEI be preferred where both exist. The financial entities themselves, in templates B_01.01 and B_01.02, are identified by LEI only.
What identifier does a non-EU ICT provider need in the DORA register?
An LEI. Recital 9 of the ITS says ICT third-party service providers established in third countries should be identified with LEI only, the ITS fill-in instruction for B_05.01.0020 says "Only LEI shall be used for legal persons that are not established in the Union", and the ESAs’ FAQ (Q39) and EBA Q&A 2024_7283 say the same. The EUID is the identifier of the EU business registers, and the ITS reserves national registration, VAT, passport and identity numbers for individuals acting in a business capacity.
What does LEI status lapsed mean?
GLEIF’s data format defines LAPSED as an LEI registration that has not been renewed by its NextRenewalDate and is not known from public sources to have ceased operation. The code still belongs to that entity and still identifies it; GLEIF has written that an LEI with the status lapsed remains a valid LEI and that the status simply indicates the entity is behind schedule with its annual re-validation. What has lapsed is the yearly check of the reference data, not the identifier.
Will a lapsed LEI get our DORA register rejected?
Not on receipt, by the validations the ESAs have published. The GLEIF checks (VR_71 and VR_77 for provider codes in B_05.01, VR_2, VR_12 and VR_23 for the reporting entities) are business checks that run after the file has been accepted for further validation; the EBA’s April 2025 observations list "Wrong LEI reported" as an error that does not lead to a reject. On status specifically, the ESAs’ FAQ Q44 says the ITS requires the LEI to be active, and that in the initial stages, in particular in 2025, the ESAs would not enforce strict checks of the LEI status. We have not found a later ESAs document that says what applies from 2026, and since 2026 the ESAs also run an April data-quality review that can lead to a request to resubmit. Treat a lapsed code as an obligation you still owe and a finding you may be asked to fix.
What do we report if a third-country provider has no LEI at all?
The identifier is a key, so it cannot be left empty: an empty key fails rule 805 and the whole file is rejected. The ESAs’ FAQ (Q40) says that where no LEI is available for a third-country provider or its ultimate parent, the financial entity should populate the field with any relevant value so the file is not rejected on referential integrity, for example another identifier it has; the ESAs will highlight it as a data-quality issue but the file will not be rejected. Use a real identifier the provider holds, not a placeholder: the Central Bank of Ireland lists "9999999DUMMY99999999" as a parent code as an example of what the April 2026 data-quality review flags. The obligation under Article 3(5) of the ITS to use an LEI remains, so the practical step is to ask the provider to obtain one before the next reference date.
How is the EUID written in the register?
Country code, then the register identifier, then a dot, then the company’s number in that register, with the dot included as part of the code (ESAs FAQ Q45). The structure comes from section 9 of the Annex to Implementing Regulation (EU) 2021/1042, which also allows an optional verification digit. The EBA’s April 2025 observations name two avoidable EUID mistakes, an LEI reported with type EUID and a value that does not follow the EUID pattern, and give the BRIS results: 58,170 values with an invalid EUID format, 2,717 found and 258 not found.

Try it on your own file first

Every tool here runs in your browser and uploads nothing, so you can see what we would see before telling us anything at all. When it is worth a conversation, send the real extract and the question you actually need answered.