Question ID: DORA 217 - 3302
Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Topic: Reporting Templates
Status: Final
Date of submission: 24 Mar 2025
Question
We have a question on FAQ#74 in the DORA preparations document "Frequently asked question on reporting of the registers of information (updated on 19 March 2025)". FAQ 74 is very helpful in understanding how to complete B.02.01, B.02.03, B.05.02 for the mentioned situation. However we are unclear what should be included in B.02.02. We see there is a mention of examples being available (FAQ#35 for dry run) but the link doesn't appear to work (just goes back to the overall EBA preparations page, within which we don't see an examples file). Can you clarify whether for example both contracts mentioned in FQA 74 that are to be included in separate rows in B.02.03 should also be reported as two separate row in B.02.02, and if not which contract arrangement number should be used etc.?
EIOPA answer
As a reminder, both the main intra-group contract and the contract with the external ICT TPP should be reported in template B_02.01: • Field B_02.03.0010 should be filled in with the reference number of the contractual arrangement reference number of the contractual arrangement between the entity making use of the ICT service(s) provided and the ICT intra-group service provider (main intra-group contract).
- Field B_02.03.0020 should be filled in with the contractual arrangement reference number of the contractual arrangement between the ICT intra-group service provider of the contractual arrangement in B_02.03.0010 and its direct ICT third-party service provider (contract with external third party and the intra-group provider).
Concerning how to fill template B_02.02 relating to “Contractual arrangements -Specific information”:
- If the register of information is kept at legal entity level, the financial entity should include the contracts in two (or more) separate rows when the ICT services included within the contracts are used directly by the financial entity itself.
- If the register of information is kept at sub-consolidated and consolidated level, the financial entity should include both contracts in two (or more) separate rows in any case as both those contracts are used by group entities.
When filling in the register of information, according to Article 4(2) of Commission Implementing Regulation (EU) 2024/2956, financial entities shall complete each data field with a single value. Where more than one value is valid for a specific data field, financial entities shall add an additional row in the corresponding template for each additional valid value.