Analytics Ascent
Contact us

Guide · as of 18 October 2026

When is the DORA Register of Information due to your regulator?

Each national authority sets its own window, and only the window matters. For the 2026 collection BaFin opened 9 to 30 March, DNB closed on 20 March, the NBB on 13 March, the CSSF ran 11 February to 31 March, the Central Bank of Ireland 2 to 31 March, the ACPR 1 January to 31 March, the MFSA 1 January to 21 March and the FMA 18 February to 18 March. All eight used 31 December 2025 as the reference date, and every one that names a format accepts the ESAs’ xBRL-CSV zip. Those windows have closed; the table gives each authority’s standing rule for the next cycle where it has published one, with the official page and its date in every row.

Eight regulators, one table

Every cell is a paraphrase of the authority’s own page. The source link in each row opens that page; the hover text shows the document and its date. Cells say “not published” where we found nothing.

Regulator2026 windowRule for every yearReference datePortalAccepted formatIf it fails
BaFinGermanysource, Stand 4 March 2026 · source, read 18 October 2026 · source, read 18 October 20269 to 30 March 2026. A complete register filed in that window meets it even if it has not yet passed every check; corrections to registers filed in time until 24 April 2026. Test submissions from 4 February 2026.Annually; the process must be completed “vollständig und fehlerfrei” by 31 March. BaFin announces the opening date on its website at the start of each year.31 December 2025 (31 December of the previous year, every year).MVP-Portal, Fachverfahren “Digital Operational Resilience Act (DORA)”; test environment “TEST: Digital Operational Resilience Act (DORA)”.Either a zip with the xBRL-CSV package matching the ESAs taxonomy, or the BaFin Excel template (current version only; the beta is no longer accepted).BaFin validates first, then the ESAs. BaFin’s DORA page says this can take up to 48 hours; its submission notes say the ESAs’ response can take several days. An error log (Fehlerprotokoll) means fix and resubmit. The obligation is met only when the ESAs have validated the register.
DNBNetherlandssource, 3 February 2026Request available from 2 March 2026; report by 20 March 2026.Not published as a standing rule; DNB announced the 2026 window on 3 February 2026.31 December 2025.MyDNB, via the Reporting Service.xBRL-CSV with a table-oriented layout, or DNB’s standardised Excel template, which DNB converts to xBRL-CSV; responsibility for accuracy and completeness stays with the institution. DNB says taxonomy and template are unchanged from 2025.Technical and validation checks after 20 March; DNB informs you of the result and, where necessary, asks you to rectify and resubmit.
NBBBelgiumsource, 28 January 2026Production environment open from 16 February 2026; deadline 13 March 2026. Test environment from 2 February 2026.Not published as a standing rule on the OneGate page.31 December 2025.OneGate, report DORA_ROI. The reporting entity is identified by its company number (CBE) with an .IND or .CON extension.XBRL CSV or XBRL XML upload, or manual data entry in OneGate.Submit in OneGate TEST/UAT first, and in production only once the register passes all NBB and European validation checks there.
CSSFLuxembourgsource, 11 February 2026 · source, 17 March 2026 · source, 17 February 202611 February to 31 March 2026. Third-country branches of credit institutions with a third-country head office: extended to 30 June 2026, best-effort.Annually, under Circular CSSF 25/882. The CSSF communiqué of 17 February 2026 refers to “the submission of 31 March 2027” for third-country branches.31 December 2025: all contractual arrangements contracted until that date.eDesk, procedure “Submission of the Register of Information”. The entity’s LEI must be on file with the CSSF and the “DORA Reporting” role assigned to at least one employee first.Plain-CSV files in a zip with the ESAs’ folder structure and file-naming convention. No Excel route is mentioned.CSSF checks the upload; if errors are found you are invited to fix and resubmit before 31 March. The ESAs then run further checks throughout April 2026; a register they refuse is fixed, resubmitted to the CSSF and forwarded again before the end of April. The 2025 rules are unchanged but applied to more fields, so a register accepted in 2025 can be rejected in 2026. On 16 March 2026 only 40% of entities due to file with the CSSF had done so.
Central Bank of IrelandIrelandsource, updated 29 January 20262 to 31 March 2026, with EBA technical feedback addressed and the register resubmitted before 31 March. (The same page’s note on the April review says 1 to 31 March; its “Upcoming Submission Date” section says 2 March.)The page describes the 2026 window as the same process as 2025; no standing rule is stated.31 December 2025 (“reference/reporting date”).Central Bank Portal. Multiple errors are now displayed at once; the naming requirement for the zip is shown on the upload screen.XBRL OIM-CSV in accordance with EBA DPM 4.0, saved as a zip. The ESAs provide no template or conversion tool for the official submission.Portal errors must be fixed and the file resubmitted inside the window. In April 2026 the EBA runs data-quality checks on all registers, which can trigger a further resubmission request.
ACPRFrancesource, 23 January 2026 · source, read 18 October 2026Platform open from 1 January 2026; deadline 31 March 2026.Annually, under ACPR instruction no. 2025-I-12 and the ESAs’ decision of 8 November 2024: reference date 31 December of year N-1, submitted no later than 31 March of year N.31 December 2025 (“date d’arrêté”).OneGate, domain DRB (banking) or DRA (insurance); accreditation with the entity’s LEI via the SURFI or SOLVA collection, separately for production and test.Plain CSV (xBRL-CSV) in a .zip, base64-encoded inside an XML envelope for upload.Check the processing report (compte rendu de traitement) in OneGate for each upload. The ACPR may chase missing or failed registers after 31 March. First on its list of main technical rejections: the deadline (31/03/2026) entered as the reference date instead of 2025-12-31.
MFSAMaltasource, 3 November 2025 · source, 5 March 20261 January to 21 March 2026 (both days included).1 January (or next working day) to 21 March (or next working day) of every reporting year, from 2026 onwards.31 December of the calendar year before the reporting period (31 December 2025 for 2026).LH Portal, RoI project. Access is requested by e-mail to the MFSA with the person’s name, designation and portal e-mail.DORA-compliant plain-csv package; the MFSA states it is not an XBRL provider and cannot convert or alter submissions.Only the status “Accepted” on the LH Portal counts as compliant. Failure to reach it inside the period “may result in regulatory action” under L.N. 166 of 2024 and the MFSA Act. Even an Accepted register can fail the ESAs’ April 2026 data-quality checks; resubmission is then expected by 30 April 2026.
FMALiechtensteinsource, 20 February 202618 February to 18 March 2026.Not published as a standing rule.31 December 2025 (“cut-off date”).FMA e-Service Portal.Not stated on the support page; the FMA points to the ESAs’ information-register pages for format.Data-quality tests by the ESAs and the FMA after the deadline “may lead to cancellations and new submissions of reports in April 2026”.

Not on this page: authorities whose 2026 page we have not read ourselves. We add a row only when we have the official text. If your regulator is missing, expect the same frame, since the ESAs’ decision has authorities forward registers by the end of March with a 31 December reference date, but take the window from the authority’s own DORA page.

Before the window: run the EBA rules on your file

BaFin’s February 2026 workshop slides say several attempts per register were the norm in 2025, and that, according to the EBA, 70% of German registers were error-free, 28% had possibly minor errors and 2% were rejected as “not OK”. Most technical rejections are mechanical, so they can be found before the upload. Our checker runs the EBA’s key, cross-reference and closed-list rules, plus LEI check digits, on your zip, CSVs or Excel template in your browser, with nothing uploaded, and exports its findings in the layout of the ESAs’ detailed-feedback.csv.

Check a register of information

What is being asked for, and by whom

The obligation. Article 28(3) of Regulation (EU) 2022/2554 (DORA) requires every financial entity to maintain a register of information on all contractual arrangements for ICT services, at entity level and at sub-consolidated and consolidated level, and to make it available to its competent authority. The templates are set by Implementing Regulation (EU) 2024/2956. The CSSF, BaFin and MFSA pages all open with this article.

Why there is a date at all. The ESAs use the registers to designate critical ICT third-party providers each year. The MFSA circular of 3 November 2025 cites the ESAs’ decision of 8 November 2024: competent authorities forward the full registers to the ESAs by the end of March of every reporting year. The ACPR’s FAQ cites the same decision for annual submission with a 31 December reference date, and BaFin’s FAQ states the 31 March forwarding date from 2026, with a reference date of 31 December of the previous year. Each national window is set to land before that. MFSA, 3 November 2025 · ACPR FAQ · BaFin FAQ

What changed from 2025. The 2025 collection used 31 March 2025 as the reference date and a 30 April 2025 forwarding date; 2026 moved both earlier. The taxonomy and the validation rules did not change: BaFin’s workshop slides say the EBA changed neither the data model nor the file structure, and the CSSF says the April 2025 rules are unchanged but now applied to more fields. BaFin FAQ · BaFin, February 2026 · CSSF, 11 February 2026

No empty register. BaFin states that an empty submission is not technically possible, because operating without any ICT third-party service is practically impossible; an entity convinced it has none is told to inform its supervisor proactively. BaFin, February 2026

What happens if you get it wrong

None of the eight authorities prints a fine amount for a late register on these pages, and we do not invent one. What they do say is precise about what counts as submitted.

A rejected upload is not a submission
BaFin: “Erst, wenn auch die ESAs Ihr Register validiert haben, sind Sie Ihrer Meldepflicht ordnungsgemäß nachgekommen.” MFSA: a submission is DORA-compliant only once it shows “Accepted” on the LH Portal; a fully validated register not accepted inside the reporting period “may result in regulatory action by the Authority by virtue of the L.N. 166 of 2024 and the MFSA Act”. source · source
The ESAs can reject what your authority accepted
CSSF: registers it accepts are sent to the ESAs, who run additional checks; if the ESAs refuse, you fix, resubmit to the CSSF, and the CSSF forwards again. BaFin: the ESAs’ rule set is larger than BaFin’s, so a file BaFin passed can still come back REJECTED (NOK) with a detailed-feedback.csv listing the errors. source · source
Last year’s accepted file can fail this year
CSSF: the same rules are applied to more data fields in 2026, “therefore, in certain cases, a register of information which was accepted last year, may be rejected this year”. BaFin lists the date fields that must be refreshed before re-use. source · source
April brings a second, content-level round
Central Bank of Ireland: the EBA announced in the week of 16 February 2026 a data-quality review in April 2026, producing additional feedback on register content. MFSA: resubmission expected by 30 April 2026, even after an Accepted status. CSSF: ESAs checks throughout April, refused registers back to the ESAs before the end of April. BaFin: corrections until 24 April 2026, and the EBA production systems close on 30 April 2026. FMA: possible “cancellations and new submissions” in April. source · source

How to get it accepted, step by step

  1. 1

    Work out which authority, and at which level

    The register goes to the authority that supervises the reporting entity. DNB’s rule is typical: a stand-alone entity reports at entity level; a group reports at the highest EU consolidation level. Banks directly supervised by the ECB are outside these national collections: DNB says they report at consolidated level to the ECB, the MFSA says they are guided by the ECB, and the CSSF and ACPR exclude them from their own collections. In Luxembourg, third-country branches now report too, following ESAs Q&A DORA102 (3097) (CSSF, 11 and 17 February 2026).

  2. 2

    Get portal access before the window opens

    CSSF needs your LEI on file and a “DORA Reporting” role assigned in eDesk. BaFin needs MVP registration and the DORA Fachverfahren approved; test submissions were open from 4 February 2026. MFSA needs the RoI project on your LH Portal account, requested by e-mail. ACPR needs OneGate accreditation to the DRB or DRA domain. NBB wants the register through OneGate TEST/UAT before production. The CSSF and the Central Bank of Ireland both tell entities to submit as early as possible, and BaFin reports that in 2025 several attempts per register were the norm.

  3. 3

    Set the reference date everywhere it appears

    A 2025 register re-used in 2026 fails if the dates are not moved. For an xBRL-CSV package that means parameters.csv and the reference date in the zip and folder name; for an Excel template it is the header tab. BaFin also lists date fields inside the tables to refresh (B.01.01.0060, B.01.02.0070, B.06.01.0070, B.07.01.0070 among them). The ACPR’s first-listed rejection is the deadline entered in place of the reference date.

  4. 4

    Run the EBA validation rules before you upload

    The EBA’s overview of checks was last updated on 28 April 2025, and the CSSF says the rules have not changed but are now applied to more fields. Among them: missing or duplicate keys (805, 806), broken cross-references between tables (807) and values outside a closed list (503). Our checker runs these rule families in your browser, with nothing uploaded, adds LEI check-digit tests, and exports a findings file laid out like the ESAs’ detailed-feedback.csv. Run the checker.

  5. 5

    Submit early in the window, then watch for two rounds of feedback

    The first round is technical, from the authority and then the ESAs; BaFin quotes up to 48 hours on its DORA page and several days for the ESAs in its submission notes, the CSSF says “in due time”. The second round is the April data-quality review announced by the EBA in the week of 16 February 2026, which looks at content; the Central Bank of Ireland’s examples are a dummy LEI for an ultimate parent and “not applicable” as a provider name. Both rounds can require a resubmission. The CSSF asks for the eDesk tracing code in any helpdesk query about a submitted register, so keep it.

  6. 6

    Close the process, not just the upload

    BaFin: the obligation is met when the ESAs’ instance-status.csv reads “No findings found”, or only findings the EBA FAQ treats as immaterial remain (the MVP status stays blue, it never turns green). MFSA: the LH Portal status must read “Accepted”, and the April checks can still ask for a resubmission by 30 April. CSSF: an ESAs refusal after CSSF acceptance still requires a fix and a fresh submission before the end of April. ACPR: read the processing report in OneGate for every upload.

Worked example: a BaFin-supervised entity in the 2026 cycle

Every date and file name below is taken from BaFin’s own submission guidance and workshop slides, so the example can be checked line by line.

Reference date
31 December 2025. The entity re-uses its 2025 register, so parameters.csv, the zip and folder names and the in-table date fields are moved from 2025-03-31 to 2025-12-31.
File name
BaFin’s example for an individual-level xBRL package is DUMMYLEI123456789012.IND_DE_DORA010100_DORA_2025-12-31_20260318121215010.zip, with parameters.csv inside the Reports folder. The Excel route uses the same stem with .xlsm.
Test
From 4 February 2026 the file is uploaded to “TEST: Digital Operational Resilience Act (DORA)” in the MVP-Portal. BaFin offers the test procedure so entities can prepare for the 2026 submission; the formal filing goes through the production procedure.
Submission
Between 9 and 30 March 2026 the file goes to the production Fachverfahren. Status “In Verarbeitung”, then “In Verarbeitung (extern)” once forwarded to the ESAs. BaFin’s DORA page says validation can take up to 48 hours; its submission notes say the ESAs’ response can take several days. A complete register filed in the window meets the deadline even if it has not yet passed every check.
Feedback
The ESAs return a zip with instance-status.csv and detailed-feedback.csv. REJECTED (NOK) means at least one technical error: fix and resubmit. A Validation Result with findings usually also means resubmit, unless the only findings are ones the EBA FAQ treats as immaterial, such as a provider that has no LEI and is identified by another code.
Close-out
A Validation Result whose instance-status.csv reads “No findings found” ends the process. Corrections to registers filed in the window are accepted until 24 April 2026; the EBA systems close on 30 April 2026. The MVP status remains blue; it does not turn green.

BaFin, Hinweise für die Einreichung, Stand 4 March 2026 · BaFin workshop slides, February 2026

The next cycle

As of 18 October 2026 no authority on this page has published a complete window for the next collection. What is already on record: BaFin will announce its opening date at the start of the year, requires the process to be complete and error-free by 31 March, and plans no taxonomy changes for the 2027 cycle; the MFSA’s standing period is 1 January to 21 March of every reporting year; the ACPR’s FAQ says no later than 31 March of each year; the CSSF’s 17 February 2026 communiqué refers to “the submission of 31 March 2027” for third-country branches. The reference date rule, 31 December of the previous year, comes from the ESAs’ decision and is stated as a standing rule by BaFin, the ACPR and the MFSA. We update this page when the authorities publish; the “as of” date at the top is the day we last checked.

Sources, all official, all dated

We read each of these on 18 October 2026. Nothing on this page comes from a law-firm note or a vendor blog. If a cell above disagrees with the document, the document wins; tell us and we will fix it.

Questions people ask

When is the DORA Register of Information due in 2026?
It depends on the national competent authority. For the 2026 collection the published windows were: BaFin (Germany) 9 to 30 March 2026, with corrections until 24 April; DNB (Netherlands) by 20 March 2026, request open from 2 March; NBB (Belgium) by 13 March 2026, production open from 16 February; CSSF (Luxembourg) 11 February to 31 March 2026, and 30 June 2026 for third-country branches of credit institutions; Central Bank of Ireland 2 to 31 March 2026; ACPR (France) 1 January to 31 March 2026; MFSA (Malta) 1 January to 21 March 2026; FMA (Liechtenstein) 18 February to 18 March 2026. All eight used 31 December 2025 as the reference date. Under the ESAs’ decision of 8 November 2024, as the MFSA cites it, authorities forward the registers to the ESAs by the end of March; BaFin’s FAQ gives the same 31 March date from 2026.
What is the reference date for the DORA register of information?
From 2026 onwards the reference date is 31 December of the previous calendar year, so the 2026 submission covers contractual arrangements as at 31 December 2025. BaFin, the ACPR and the MFSA state this as a standing rule; the ACPR attributes it to the ESAs’ decision of 8 November 2024 (ESA 2024 22) and its own instruction 2025-I-12. The other authorities state 31 December 2025 for 2026. The 2025 collection was different: its reference date was 31 March 2025, according to BaFin’s FAQ.
Which file format does the register of information have to be in?
The package the ESAs define is a zip of plain CSV files in the xBRL-CSV (XBRL OIM-CSV) layout of the EBA DPM 4.0 taxonomy; BaFin’s slides show report.json, parameters.csv, FilingIndicators.csv and one CSV per table inside a root folder named like the zip. The CSSF, the Central Bank of Ireland and the MFSA name only that package. The ACPR wants the same zip, base64-encoded inside an XML envelope. BaFin and DNB also accept their own Excel template and convert it; DNB states that the institution stays responsible for the converted content. The NBB also accepts XBRL XML and manual entry in OneGate.
What happens if the register of information is submitted late or rejected?
A rejected register does not count as submitted. BaFin states the reporting obligation is fulfilled only once the ESAs have validated the register; MFSA states that only an “Accepted” status on its portal is DORA-compliant and that failing to reach it inside the reporting period may result in regulatory action; CSSF asks for a fixed register before 31 March and again if the ESAs refuse it afterwards. DNB, the Central Bank of Ireland and the FMA all describe a request to rectify and resubmit; the ACPR says it may chase missing or failed registers after 31 March. None of the eight authorities publishes a fixed fine amount for a late register on these pages.
Is there a second validation round after the deadline?
Yes, from 2026. The Central Bank of Ireland reports that the EBA announced, in the week of 16 February 2026, an additional data-quality review of register content in April 2026. MFSA’s circular of 5 March 2026 says the ESAs will run these checks during April 2026 and that resubmissions are expected by 30 April 2026, even for registers already marked Accepted. The CSSF says the ESAs check throughout April and refused registers go back to them before the end of April. BaFin allows corrections until 24 April 2026 and FMA warns of “cancellations and new submissions” in April 2026. The Central Bank of Ireland’s examples: a dummy LEI such as 9999999DUMMY99999999 for an ultimate parent, or “not applicable” as a provider name.
Do ECB-supervised banks submit the register to their national authority?
No. DNB states that banks under the direct supervision of the ECB report their register at consolidated level to the ECB. MFSA says significant credit institutions under Article 6(4) of Regulation (EU) No 1024/2013 are guided by the ECB, and the CSSF communiqué and the ACPR FAQ both exclude entities under the direct supervision of the ECB from their own collections.
Has any authority published the 2027 window yet?
As of 18 October 2026, no authority on this page has published a full 2027 window. BaFin says it announces the opening date at the start of each year, that the process must be completed by 31 March, and that no taxonomy changes are planned for the 2027 cycle. MFSA’s standing rule is 1 January to 21 March of every reporting year, and the ACPR’s is no later than 31 March of each year. The CSSF communiqué of 17 February 2026 refers to “the submission of 31 March 2027” for third-country branches. We will update the table when the authorities publish.

Try it on your own file first

Every tool here runs in your browser and uploads nothing, so you can see what we would see before telling us anything at all. When it is worth a conversation, send the real extract and the question you actually need answered.

Start a conversation