DORA LEI Requirements for ICT Suppliers in Estonia

A DORA LEI request from an Estonian financial-entity client does not, by itself, mean that your ICT company has a direct legal duty to obtain an LEI. Financial entities must identify ICT providers that are legal persons in their registers using a valid and active LEI or a European Unique Identifier (EUID), and both where available; a provider not established in the Union must be identified by LEI.

What this means in Estonia

The Estonian Financial Supervision Authority (Finantsinspektsioon) describes how registers of information are collected in Estonia. In the annual collection by the European Supervisory Authorities (ESAs), the register for a consolidated undertaking is submitted jointly at the highest level. The register reflects the position at the end of the preceding calendar year. According to the Estonian Financial Supervision Authority (Finantsinspektsioon), registers will be collected at the beginning of 2027 with information as at 31 December 2026.

Registers are submitted through the Eesti Pank and Finantsinspektsioon data collection portal, aruandlus.eestipank.ee. That is the submission route for the register, not a date by which an ICT supplier must send its identifier to a client. The financial entity needs supplier information in time to prepare its submission, so an ICT provider should confirm the client’s collection deadline directly.

Consider a Tallinn IT company managing a payment institution’s system: its contracting entity needs to know which identifier it can provide to the financial-entity client. For a US cloud provider serving an Estonian insurance company, the relevant distinction is that a provider not established in the Union is identified by LEI only. These examples do not change who maintains the register: that responsibility belongs to the financial entity.

For an Estonian client preparing the next register, the practical questions are which legal person provides the service, which identifier applies and whether the client also needs details from a relevant subcontracting chain. A supplier should answer those questions against its actual arrangement rather than assume that a request for an LEI rules out an EUID.

DORA LEI requirements: key points

• DORA has applied since 17 January 2025. Financial entities maintain registers of their ICT service arrangements.
• A provider that is a legal person is identified by a valid and active LEI or an EUID, and by both where available. A provider not established in the Union is identified by LEI only.
• The identifier rules also cover recorded subcontractors that effectively underpin an ICT service supporting a critical or important function.
• The 31 March deadline is for competent authorities to report to the ESAs. Financial entities have earlier deadlines set by their competent authorities.

Who maintains the register of information?

Regulation (EU) 2022/2554 (DORA), Article 28(3), requires financial entities to maintain and update a register covering all contractual arrangements for ICT services supplied by ICT third-party service providers. The register forms part of their ICT risk management framework and is maintained at entity, sub-consolidated and consolidated levels.

Financial entities must make the full register, or requested sections, available to their competent authority on request. They also report at least yearly on new arrangements. The ESAs use register information to designate critical ICT third-party service providers; AFM DORA update 7 (August 2026) reported that nineteen providers had been designated based on registers.

An ICT supplier’s role is different: it supplies accurate details so its financial-entity client can complete the register. A request may concern the direct provider or a subcontractor in the relevant service chain.

Which identifier can a financial entity use?

Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024, published in the Official Journal on 2 December 2024, sets the standard register templates. Under Article 3(5), a financial entity uses a valid and active LEI or the EUID referred to in Article 16 of Directive (EU) 2017/1132 to identify an ICT provider that is a legal person. It uses both where available; the provision excepts individuals acting in a business capacity.

The regulation’s Annex allows only an LEI or EUID for a provider that is a legal person. Alternative codes are reserved for individuals acting in a business capacity. For a legal person not established in the Union, only an LEI may be used, so the EUID option cannot replace that provider’s LEI.

Article 3(6) extends the identification requirement down the chain when a direct provider’s ICT service supports a critical or important function. Through the direct provider, the financial entity must ensure that subcontractors recorded in the register which effectively underpin the service use a valid and active LEI or provide an EUID, and both where available. The exception for individuals acting in a business capacity applies here too.

The financial entity’s own identifier follows a different rule. The ESAs RoI reporting FAQ (28 March 2025) confirms that only an LEI can identify a financial entity in templates B_01.01 and B_01.02. An LEI is a 20-character alphanumeric code based on ISO 17442.

Check status as well as the identifier

Because Article 3(5) specifies a valid and active LEI, a supplier should check an existing code’s status before providing it. The ESAs say they check LEIs against the GLEIF database and EUIDs against BRIS reference data. Their FAQ also says the ultimate parent of each ICT provider must be identified in the register.

FAQ question 44 says strict LEI-status checks, including active or lapsed status, would not be enforced in the initial reporting stages, particularly in 2025. It does not say how long that approach will last. It should not be treated as a change to the requirement for a valid and active LEI.

For a third-country provider whose LEI is unavailable, FAQ question 40 says a financial entity may report another identifier: the file is not rejected, but the entry is flagged as a data-quality issue. That processing guidance does not change the Annex rule requiring an LEI to identify a provider not established in the Union. A supplier without an LEI can apply for an LEI; one with a lapsed LEI can renew its LEI.

Annual reporting dates and supplier steps

The ESAs FAQ, questions 11-13, says that from 2026 the register’s reference date is 31 December of the preceding year. Competent authorities report to the ESAs by 31 March each year and set earlier deadlines for financial entities. A supplier should ask its client when the client needs its details.

Register cycle	Reference date	Competent authority deadline for reporting to the ESAs
2026 cycle	31 December 2025	31 March 2026
Next cycle	31 December 2026	31 March 2027

The EBA – Preparations for reporting of DORA registers of information page brings together the templates, data model, validation rules and FAQ. Financial entities should check their competent authority’s instructions for their own deadline.

1. Identify the legal person contracting with the financial entity and whether it is established in the Union.
2. Check which identifier applies, verify any LEI’s active status and provide both LEI and EUID where available.
3. If the service supports a critical or important function, identify recorded subcontractors that effectively underpin it and request their applicable identifiers.
4. Confirm the information needed to identify the supplier’s ultimate parent, then ask the client when it needs the completed details.

An LEI question under another rule may have a different answer; see the guide to LEIs in customer identification under AMLR in Estonia or the LEIFast regulation updates for other topics. For this register, confirm the contracting entity, its eligible identifier and the client’s collection deadline. If the answer depends on the arrangement’s details, check with your regulator or adviser.