DORA LEI Cyprus: Identifier Rules for ICT Suppliers

A DORA LEI Cyprus request from a financial-entity client is a request for information the client needs in its register, not a direct obligation on the ICT supplier to obtain an LEI. Under Regulation (EU) 2022/2554 (DORA), financial entities maintain that register; an ICT provider that is a legal person is identified by a valid and active LEI or a European Unique Identifier (EUID), and by both where available. A provider not established in the Union must be identified by an LEI.

What this means in Cyprus

For entities regulated by the Cyprus Securities and Exchange Commission (CySEC), the local filing instruction is CySEC Circular C751, dated 19 January 2026. It requires those entities to submit the register of information through the CySEC XBRL Portal. XBRL-CSV is the only accepted format. The submission is annual, due no later than 28 February, and uses a reference date of 31 December of the preceding year.

That instruction concerns CySEC-regulated entities. It does not make their ICT suppliers the parties responsible for filing the register. An IT company in Limassol supporting a Cyprus investment firm (CIF) may nevertheless receive a request for its identifier so the firm can complete its records. The supplier should distinguish its own response to the client from the client’s submission to CySEC: sending an identifier is not the same as filing an XBRL-CSV register.

The establishment of the provider also matters. Consider a non-EU cloud provider serving a Nicosia fund manager: the register identifies that provider by LEI only, rather than treating an EUID as an alternative. Where a Cyprus-based client requests details, the useful first response is to confirm which legal person provides the service and which identifier applies. The client can then tell the supplier when it needs those details for its register. Circular C751 sets the filing method and annual deadline for CySEC-regulated entities; it does not set a separate supplier submission date.

DORA LEI Cyprus: key points for suppliers

• DORA has applied since 17 January 2025. Financial entities maintain registers of their contractual arrangements for ICT services.
• A provider that is a legal person is identified by a valid and active LEI or an EUID, and by both where available. For a provider not established in the Union, only an LEI may be used.
• Relevant subcontractors can also need to provide identifiers when they effectively underpin an ICT service supporting a critical or important function.
• A supplier should obtain its client’s collection deadline. The deadline for a competent authority to report to the European Supervisory Authorities (ESAs) is not the supplier’s deadline.

Why a financial-entity client asks for an identifier

DORA Article 28(3) requires financial entities to maintain and update a register of information on all contractual arrangements for ICT services provided by ICT third-party service providers. It forms part of their ICT risk management framework and is maintained at entity, sub-consolidated and consolidated levels. They must make the register, or requested sections, available to their competent authority on request and report at least yearly on new arrangements.

The registers also support the ESAs’ designation of critical ICT third-party service providers. AFM DORA update 7 (August 2026) reported that nineteen providers had been designated based on register information. For an individual supplier, the immediate task remains supplying accurate details to the financial-entity client, including details needed for a relevant subcontracting chain.

When an LEI or EUID can be used

Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024, published in the Official Journal on 2 December 2024, lays down the standard register templates. Under Article 3(5), financial entities use a valid and active LEI or the EUID referred to in Article 16 of Directive (EU) 2017/1132 to identify ICT providers that are legal persons, and both identifiers where available. Individuals acting in a business capacity are excepted.

The Regulation’s Annex permits only an LEI or EUID for a provider that is a legal person; alternative codes are for individuals acting in a business capacity. It further specifies that only an LEI may identify a legal person not established in the Union. An eligible Union-established provider therefore has an EUID option, while a non-Union provider does not.

Article 3(6) extends the identification process through a direct provider when its ICT service supports a critical or important function. The financial entity must ensure that subcontractors recorded in the register which effectively underpin that service use a valid and active LEI or provide an EUID, and both where available. The exception for individuals acting in a business capacity also applies here. A direct provider may need to request identifiers from those subcontractors before replying to its client.

The financial entity’s own identifier follows a different rule. The ESAs register of information reporting FAQ (28 March 2025) confirms that only an LEI identifies a financial entity in templates B_01.01 and B_01.02. An LEI is a 20-character alphanumeric code based on ISO 17442. The EUID option for certain suppliers does not change the financial entity’s template requirement.

Check LEI status before providing it

Article 3(5) expressly requires a valid and active LEI. If a supplier already has one, it should check its status before sending the code. The ESAs say they check LEIs against the GLEIF database and EUIDs against BRIS reference data; their FAQ also says each ICT provider’s ultimate parent must be identified in the register.

FAQ question 44 says strict LEI-status checks were not to be enforced during the initial reporting stages, particularly in 2025. It gives no end date for that approach. Suppliers should not treat that initial processing guidance as a change to the requirement for an active LEI.

For a third-country provider without an available LEI, FAQ question 40 says a financial entity may report another identifier: the file is not rejected, but the entry is flagged as a data-quality issue. That guidance does not replace the Annex rule requiring an LEI to identify a provider not established in the Union. A supplier without a code can apply for an LEI; one with a lapsed code can renew its LEI.

Register dates and supplier preparation

The ESAs FAQ, questions 11-13, sets 31 December of the preceding year as the reference date from 2026 onwards. Competent authorities report registers to the ESAs by 31 March each year and set earlier deadlines for financial entities. The CySEC filing instruction above gives CySEC-regulated entities their annual submission deadline; suppliers should ask their own client when it needs the underlying information.

Cycle	Reference date	ESA reporting deadline for competent authorities	CySEC-regulated entity filing rule
2026 cycle	31 December 2025	31 March 2026	Annual submission no later than 28 February
Next cycle	Will be 31 December 2026	Will be 31 March 2027	Annual submission will be due no later than 28 February

The EBA preparations for reporting DORA registers of information page brings together the templates, data model, validation rules and FAQ. To prepare a response to a client, a supplier can:

1. Confirm the contracting legal person and whether it is established in the Union.
2. Check which identifier applies, provide both LEI and EUID where available, and verify the LEI’s active status before sending it.
3. Ask relevant subcontractors for their identifiers when they effectively underpin a service supporting a critical or important function.
4. Confirm the information needed to identify the supplier’s ultimate parent and ask the client for its collection deadline.

Other rules may use LEIs differently; the guide to LEIs in customer identification under AMLR in Cyprus addresses a separate use case. Further topics appear in the LEIFast regulation updates. For a DORA register request, confirm the contracting entity and applicable identifier with the client now, and check with your regulator or adviser if the arrangement needs an individual assessment.