European financial institutions face compliance pressure as deadlines for the Digital Operational Resilience Act (DORA) Register of Information (RoI) submissions arrive this month. DORA has applied since January 17, 2025, and the RoI has proved one of its most demanding requirements. Banks, payment providers, and insurers across the EU now face supervisory penalties set under national law if they fail to deliver accurate inventories of their ICT third-party contracts.
In Luxembourg, the CSSF deadline for most entities is March 31. These dates mark the second annual RoI filing under Article 28 of DORA, requiring every in-scope entity to catalog all contractual arrangements with ICT vendors as of December 31, 2025. National competent authorities then forward the registers to the European Supervisory Authorities (ESAs), which run further quality checks in April.
DORA'S BROAD REACH
DORA targets over 22,000 financial entities including banks, insurers, payment institutions, e-money providers, crypto-asset service providers, and investment firms—plus their critical ICT suppliers. The regulation sets requirements in five areas: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management and information sharing. The ESAs have already designated 19 providers as "critical," granting powers for general investigations, on-site inspections, and joint examination teams with national regulators.
Survey data underscores the gap. A 2024 McKinsey survey of European financial institutions found only about a third confident of meeting the original January 2025 deadline. Deloitte found that 46% of financial entities consider the register of information the most challenging task, reflecting the complexity of multi-jurisdictional vendor mapping.
FILING PROGRESS
Supervisory data cited by EY showed that, as of 16 March, only around 40% of entities required to submit a register to Luxembourg's CSSF had done so. If the ESAs' checks find deficiencies, registers can be rejected and must be corrected and resubmitted before the end of April 2026.
THIRD-PARTY RISK
Third-party risk management (TPRM) is one of DORA's five pillars. Before entering into contracts with ICT providers, firms must assess them, including through due diligence. The management body bears ultimate responsibility for managing the firm's ICT risk.
PATH FORWARD
The ESAs update and publish the list of critical ICT third-party providers annually. The registers also feed the ESAs' assessment of which ICT providers to designate as critical.
Bank news that matters, every weekday.
Follow The Global Banker on LinkedIn