DORA LEI Requirements for ICT Suppliers in Belgium

A DORA LEI request from a Belgian bank or insurer is usually about that financial entity’s register of ICT contracts, not a direct obligation on its supplier to obtain an LEI. Under Regulation (EU) 2022/2554 (DORA), financial entities maintain the register; the identification rules generally allow a legal-person supplier established in the Union to be recorded by a valid and active LEI or a European Unique Identifier (EUID), while a provider not established in the Union must be identified by an LEI.

What this means in Belgium

Belgian reporting arrangements depend on the financial entity’s supervisor. The FSMA – DORA informatieregister: beperkte update in 2026 notice, issued on 17 February 2026, described a repeat register exercise with a more limited scope. It required a 2026 submission only from market operators, portfolio management and investment advice companies, management companies of UCIs and AIFs, and self-managed UCIs.

Those firms submitted their register through a FiMiS Survey by 20 March 2026 at the latest. A firm with no changes since the previous year could simply confirm that position. The FSMA notice concerns the firms submitting the register; it does not place the submission duty on their ICT suppliers. A supplier asked for its identifier should establish which contracting entity the client needs to record and ask when the client needs its details.

For financial entities supervised by the National Bank of Belgium (NBB), NBB circular NBB_2026_05 of 31 March 2026 provides for submission through OneGate. As a rule, the NBB limits its requests to the highest level of (sub-)consolidation under its supervision. Where a group has a significant credit institution, it submits banking registers to the ECB and sends the NBB only registers for entities supervised by the NBB. An ICT supplier should therefore take its reporting instructions from its financial-entity client rather than assume that every Belgian client submits through the same channel.

DORA LEI requirements: key points

• DORA has applied since 17 January 2025. The register duty belongs to financial entities.
• A provider that is a legal person is identified by a valid and active LEI or an EUID, and both where available. For a provider not established in the Union, only an LEI may be used.
• Relevant subcontractors can also need to supply identifiers when they effectively underpin an ICT service supporting a critical or important function.
• A supplier’s collection deadline comes from its client, not from the deadline for competent authorities to report to the European Supervisory Authorities (ESAs).

Why does a financial entity ask its supplier for an identifier?

Article 28(3) of DORA requires financial entities to maintain and update a register of information covering all contractual arrangements for ICT services provided by ICT third-party service providers. The register forms part of their ICT risk management framework and is maintained at entity, sub-consolidated and consolidated levels. Financial entities make the full register, or requested sections, available to their competent authority on request and report at least yearly on new arrangements.

The ESAs use the registers to designate critical ICT third-party service providers. AFM DORA update 7 (August 2026) reported nineteen designations based on the registers. For a supplier, the immediate issue is whether its client has the identification details needed for an accurate entry.

LEI, EUID and subcontractors: which rule applies?

Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024, published in the Official Journal on 2 December 2024, sets the standard register templates. Article 3(5) tells financial entities to identify ICT providers that are legal persons with a valid and active LEI or the EUID referred to in Article 16 of Directive (EU) 2017/1132, and both where available. Individuals acting in a business capacity are excepted.

The Annex permits only an LEI or EUID for providers that are legal persons; alternative codes are for individuals acting in a business capacity. It also specifies LEI-only identification for a legal person not established in the Union. Thus, an EUID may be an option for an eligible Union-established supplier, but not for an American cloud supplier serving a Brussels insurer.

Article 3(6) extends the identification process down certain subcontracting chains. If a direct provider’s ICT service supports a critical or important function, the financial entity must ensure through that provider that subcontractors recorded in the register which effectively underpin the service use a valid and active LEI or provide their EUID, and both where available. The exception for individuals acting in a business capacity also applies here.

The financial entity’s own identifier follows a different rule. The ESAs RoI reporting FAQ (28 March 2025) confirms that only an LEI can identify a financial entity in templates B_01.01 and B_01.02. An LEI is a 20-character alphanumeric code based on ISO 17442; the supplier’s possible EUID option does not change the client’s own template requirement.

Check identifier status without confusing guidance with the rule

Article 3(5) calls for a valid and active LEI, so a supplier with an existing code should check its status before passing it to a client. The ESAs FAQ says LEIs are checked against the GLEIF database and EUIDs against BRIS reference data. It also says each ICT provider’s ultimate parent must be identified in the register.

Question 44 of that FAQ said strict LEI-status checks would not be enforced during initial reporting stages, particularly in 2025; it did not specify how long that approach would continue. Question 40 separately explains that, if a third-country provider has no available LEI, another identifier can be reported without the file being rejected, but the entry is flagged as a data-quality issue. Neither statement changes the Annex’s LEI-only identification rule for a legal person not established in the Union.

If your contracting entity needs a code, you can apply for an LEI. If its existing LEI has lapsed, check how to renew the LEI before sending the identifier.

Annual register timeline and supplier checklist

According to questions 11-13 of the ESAs FAQ, from 2026 onwards the reference date is 31 December of the preceding year. Competent authorities report to the ESAs by 31 March and set earlier deadlines for financial entities. The Belgian FSMA’s limited 2026 exercise had its own 20 March 2026 submission deadline; a supplier should ask its client for the date on which its details are needed.

Cycle	Reference date	ESA reporting deadline for competent authorities
2026	31 December 2025	31 March 2026
Next cycle	31 December 2026	31 March 2027

The EBA – Preparations for reporting of DORA registers of information page brings together the templates, data model, validation rules and FAQ. Before responding to a client, an ICT supplier should:

1. Identify the legal person contracting with the financial entity and establish whether it is based in the Union.
2. Confirm whether that person has an LEI, an EUID or both, and check the LEI’s active status if one is supplied.
3. Where the service supports a critical or important function, ask the client whether relevant subcontractors must be recorded and obtain their applicable identifiers.
4. Prepare the details needed to identify the provider’s ultimate parent and confirm the client’s collection deadline.

LEI use in another regulatory setting may follow different rules: see the guide to LEIs in Belgian customer identification under AMLR or the LEIFast regulation updates. For this register, confirm your contracting entity and eligible identifier with the financial-entity client; if the arrangement raises a question about your position, check with your regulator or adviser.