DORA LEI Ireland: ICT Supplier and Register Rules

A DORA LEI request in Ireland usually comes from a financial-entity client preparing its register of information. Regulation (EU) 2022/2554 (DORA), Article 28(3), places the register duty on the financial entity, not directly on its ICT supplier. A supplier that is a legal person may be identified by a valid and active LEI or a European Unique Identifier (EUID), and both where available; a provider not established in the Union must be identified by an LEI.

What this means in Ireland

The Central Bank of Ireland – Reporting Registers of Information page sets out how financial entities submitted their Registers of Information for the reference date of 31 December 2025. The submission window ran from 2 March to 31 March 2026 through the Central Bank Portal. Those dates describe the completed Irish submission window, not a deadline for an ICT supplier to send details to a client.

For those submissions, the Central Bank said financial entities submitting registers must have a valid LEI code. It also said ICT third-party providers listed need a valid LEI or EU-ID for the files to pass validation. An Irish supplier receiving a request should therefore establish which legal person the client needs to identify and provide its available identifier. The EU rules still govern which identifier applies: a provider not established in the Union must be identified by an LEI.

Consider a Cork software house supplying a credit union’s core system: the credit union may ask for the software house’s identification details for its register. For a US cloud provider serving a Dublin fund administrator, the relevant identifier is an LEI, not an EUID. In either case, the supplier should confirm the client’s collection deadline rather than infer it from the Central Bank’s submission window.

The Central Bank also reported that, in the week commencing 16 February 2026, the EBA announced an additional data-quality review of submitted registers in April 2026, which could require resubmission. That announcement concerned submitted registers; it did not create a separate supplier reporting deadline.

DORA LEI Ireland: key points

• DORA has applied since 17 January 2025. Financial entities maintain the register of their ICT service arrangements.
• For ICT providers that are legal persons, the register uses a valid and active LEI or an EUID, and both where available. A provider not established in the Union is identified by LEI only.
• Relevant subcontractors underpinning a service that supports a critical or important function are also covered by the identification rules.
• The next register reference date will be 31 December 2026. Competent authorities will report registers to the European Supervisory Authorities (ESAs) by 31 March 2027.

Why does a financial entity ask its ICT provider?

Regulation (EU) 2022/2554 (DORA), Article 28(3), requires financial entities to maintain and update a register of information on all contractual arrangements for ICT services provided by ICT third-party service providers. This forms part of their ICT risk management framework and applies at entity, sub-consolidated and consolidated levels. Financial entities must provide the full register, or requested sections, to their competent authority on request and report at least yearly on new arrangements.

The register depends on identification data supplied by providers, including providers in relevant subcontracting chains. The ESAs also use register data to designate critical ICT third-party service providers. AFM DORA update 7 (August 2026) reported that nineteen providers had been designated based on the registers.

Which identifier belongs in the register?

Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024, published in the Official Journal on 2 December 2024, sets the register templates. Under Article 3(5), financial entities use a valid and active LEI or the EUID referred to in Article 16 of Directive (EU) 2017/1132 to identify ICT third-party providers that are legal persons, and both identifiers where available. Individuals acting in a business capacity are excepted.

The regulation’s Annex permits only an LEI or EUID for providers that are legal persons; alternative codes are for individuals acting in a business capacity. For a legal person not established in the Union, only an LEI may be used. An EUID option for an eligible Union-established supplier does not extend to a non-Union provider.

Article 3(6) addresses a further link in the supply chain. Where a direct provider’s service supports a critical or important function, the financial entity must ensure through that provider that subcontractors recorded in the register which effectively underpin the service use a valid and active LEI or provide their EUID, and both where available. Individuals acting in a business capacity are excepted. A direct provider may therefore need to obtain identifiers from relevant subcontractors before replying to its client.

The financial entity’s own identifier follows a different rule. The ESAs RoI reporting FAQ (28 March 2025) says only an LEI can identify a financial entity in templates B_01.01 and B_01.02. An LEI is a 20-character alphanumeric code based on ISO 17442.

Check the LEI before supplying it

Article 3(5) specifies a valid and active LEI. The ESAs say they check LEIs against the GLEIF database and EUIDs against BRIS reference data; they also say each ICT provider’s ultimate parent must be identified in the register. A supplier should check its LEI status and the parent details requested by its client, rather than sending an existing code without review.

The ESAs’ FAQ says strict LEI-status checks were not to be enforced during initial reporting stages, particularly in 2025, but gives no end date for that approach. Its separate guidance on a third-country provider without an available LEI says a financial entity may report another identifier: the file is not rejected, but the entry is flagged as a data-quality issue. This processing guidance does not change the Annex rule requiring an LEI for a provider not established in the Union.

If an LEI is needed and your company does not have one, you can apply for an LEI. If its LEI has lapsed, you can renew the LEI before providing the details to your client.

Annual timeline and supplier checklist

The ESAs’ FAQ says that, from 2026 onwards, the register reference date is 31 December of the preceding year. Competent authorities report to the ESAs by 31 March each year and set deadlines for financial entities. The EBA – Preparations for reporting of DORA registers of information page collects the ITS, data model, validation rules and FAQ.

Cycle	Reference date	ESA reporting deadline for competent authorities	Supplier action
2026 cycle	31 December 2025	31 March 2026	The Irish submission window ran from 2 March to 31 March 2026.
Next cycle	31 December 2026	31 March 2027	Ask your client when it will need your details.

1. Identify the legal person providing the service and whether it is established in the Union.
2. Confirm whether that person has an LEI, an EUID or both, and check the LEI’s active status where applicable.
3. If a critical or important function is supported, ask which subcontractors effectively underpin the service and are recorded in the register.
4. Prepare the applicable identifiers and ultimate-parent information, then confirm the client’s collection deadline.

LEI rules in other contexts differ; the guide to AMLR LEI rules in Ireland covers customer identification rather than this ICT register. Other topics appear in the LEIFast Ireland articles. For this request, confirm the contracting entity and identifier with your client; if the arrangement makes the rule unclear, check with your regulator or adviser.