DORA LEI Requirements for ICT Suppliers in the EU

A DORA LEI request from a bank or insurer does not mean DORA directly obliges your ICT company to obtain an LEI. The duty falls on financial entities, which must identify ICT providers that are legal persons in their register of information using a valid and active LEI or a European Unique Identifier (EUID); providers not established in the Union must be identified by an LEI.

DORA LEI requirements: key points

• DORA has applied since 17 January 2025. Financial entities maintain a register of their contractual arrangements for ICT services.
• For an ICT provider that is a legal person, the register uses a valid and active LEI or an EUID, and both where available. A provider not established in the Union is identified by LEI only.
• The identification requirement also reaches subcontractors recorded in the register that effectively underpin an ICT service supporting a critical or important function.
• Competent authorities set financial entities’ reporting deadlines before their own 31 March deadline to report registers to the European Supervisory Authorities (ESAs).

What is the DORA register of information?

Regulation (EU) 2022/2554 (DORA), Article 28(3), requires financial entities to maintain and update a register of information on all contractual arrangements for ICT services provided by ICT third-party service providers. They do so at entity level and at sub-consolidated and consolidated levels as part of their ICT risk management framework.

Financial entities must make the full register, or requested sections, available to their competent authority on request and report at least yearly on new arrangements. The ESAs also use registers to designate critical ICT third-party service providers. AFM DORA update 7 (August 2026) reported that nineteen providers had been designated based on the registers.

For a supplier, the practical effect is a request for accurate identification details from a financial-entity client. The client needs those details for its own register, whether the supplier provides services directly or sits in a relevant subcontracting chain.

Which identifier does ITS 2024/2956 require?

Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024, published in the Official Journal on 2 December 2024, sets the standard register templates. Its Article 3(5) requires financial entities to use a valid and active LEI or the EUID referred to in Article 16 of Directive (EU) 2017/1132, and both where available, for ICT third-party providers that are legal persons. The provision excepts individuals acting in a business capacity.

The distinction between an LEI and an EUID matters. The ITS 2024/2956 Annex says only those identifiers may be used for providers that are legal persons, while alternative codes are reserved for individuals acting in a business capacity. For a legal person not established in the Union, only an LEI may be used. An EUID is therefore an option for an eligible Union-established supplier, not a substitute for a non-Union provider’s LEI.

Article 3(6) addresses subcontractors. Where a direct provider’s ICT service supports a critical or important function, the financial entity must ensure through that direct provider that subcontractors in the register which effectively underpin the service use a valid and active LEI or provide their EUID, and both where available. Individuals acting in a business capacity are again excepted. A direct supplier receiving a client’s request may therefore need to collect identifiers from relevant subcontractors as well as provide its own.

Financial entities themselves are treated differently in the templates. The ESAs RoI reporting FAQ (28 March 2025) confirms that only an LEI can identify a financial entity in templates B_01.01 and B_01.02. An LEI is a 20-character alphanumeric code based on ISO 17442. Supplier flexibility to use an EUID must not be confused with the financial entity’s own identifier requirement.

Why does a valid and active LEI matter?

Article 3(5) expressly calls for a valid and active LEI. A supplier that already has an LEI should check its status rather than assume that supplying the code is enough. The ESAs say they check LEIs against the GLEIF database and EUIDs against BRIS reference data; their FAQ also says each ICT provider’s ultimate parent must be identified in the register.

The ESAs RoI reporting FAQ, question 44, said strict LEI-status checks, such as checks for active or lapsed status, would not be enforced during the initial reporting stages, particularly in 2025. It did not say how long that approach would last. A supplier that keeps its LEI active does not depend on how strictly status checks are applied in a given cycle.

If your LEI already shows LAPSED status, renew the existing registration rather than applying for a new code. Our guide to what a lapsed LEI means and how to renew it explains how to check its status and renew.

There is a separate reporting point for third-country providers. Under question 40 of the FAQ, if an LEI is unavailable, a financial entity may report another identifier; the file is not rejected, but the entry is flagged as a data-quality issue. That processing guidance does not replace the Annex rule that a provider not established in the Union is identified by LEI only. If your company does not have an LEI yet, you can apply for an LEI; if it has lapsed, renew an LEI.

Annual register timeline

The ESAs RoI reporting FAQ, questions 11-13, says that from 2026 onwards the reference date is 31 December of the preceding year. Competent authorities report registers to the ESAs by 31 March of each calendar year and set earlier deadlines for financial entities. A supplier should ask its client for its collection deadline rather than treating the ESA deadline as the date for supplying data.

Register cycle	Reference date	Deadline for competent authorities to report to the ESAs	Financial entity deadline
2026 cycle	31 December 2025	31 March 2026	Set earlier by the competent authority
Next cycle	31 December 2026	31 March 2027	Will be set earlier by the competent authority

The EBA – Preparations for reporting of DORA registers of information page collects the ITS, data model, validation rules and FAQ. Financial entities should check their competent authority’s instructions for the deadline that applies to them.

Checklist for ICT suppliers

1. Confirm which legal person contracts with the financial entity and whether that person is established in the Union. This determines whether an EUID is an available identification option or an LEI is required.
2. Provide the identifier your client requests and, if both an LEI and EUID are available, be ready to provide both. Check the LEI’s active status before sending it.
3. Identify any subcontractors in the register that effectively underpin a service supporting a critical or important function. Ask those subcontractors for the applicable identifier so the direct provider can pass it through to the financial entity.
4. Confirm the information needed to identify your ultimate parent and ask the client when it needs the completed supplier details.

Do not assume an LEI requirement in another compliance context follows the same supplier rules: the related guide to LEIs in customer identification under AMLR addresses a different use case. For other regulatory topics, see the LEIFast regulation updates. For this register, the immediate next step is to confirm your contracting entity, its eligible identifier and your financial-entity client’s collection deadline; check with your regulator or adviser if your position depends on the details of the arrangement.