YTYK You think you know

Card 12 of 15 Third-party risk — the register and the overseer ●○○ Foundational

The register of information

Entities must maintain and keep updated a register of information on all contractual arrangements for the use of ICT services, at entity, sub-consolidated and consolidated level, distinguishing those supporting critical or important functions, and report it to the competent authority at least yearly.

Why it is like this

Supervisors could not see concentration risk because no two firms described their suppliers the same way. A standard register, filed annually, is what makes "how many banks depend on this one provider" an answerable question.

Not to be confused with

A vendor list. It is a structured filing with prescribed fields, covering every ICT contractual arrangement and not only the critical ones — and the critical/important classification you assign is itself the thing supervisors read.

In practice

In practice this is the single largest piece of work DORA creates for most firms, because the information is spread across procurement, legal and engineering and has never had to agree before.

Source: Regulation (EU) 2022/2554 (DORA) — Art. 28(3). Read on .

Predict Check yourself

Does the register of information cover only ICT services supporting critical or important functions?

  1. No — it covers all ICT contractual arrangements, with those supporting critical or important functions distinguished within it.
  2. Yes — only critical or important functions are in scope.
  3. Yes, plus any contract above a value threshold.
  4. No, but non-critical arrangements are reported every three years rather than yearly.
Show the answer

No — it covers all ICT contractual arrangements, with those supporting critical or important functions distinguished within it.

"All", with a flag. Scoping the register to the critical list is the most common way firms under-build it and then have to start again.