Agent Wranglers

CMP-85Recommended EU law

Give financial customers the facts for their DORA register

Keep the facts a financial customer needs for its DORA register of information as one data file. Include your legal identifier, each service, where its data is processed and stored, and every subcontractor.

By Agent Wranglers. Updated .

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

DORA Article 28(3) makes each financial entity keep a register of all its ICT contracts. Implementing Regulation (EU) 2024/2956 fixes its templates, which identify providers by a code such as the Legal Entity Identifier. Customers send the same questions every year, so answer them from one file that you update when a subcontractor changes. Services that support a critical or important function need the full chain of subcontractors. The European Supervisory Authorities may designate large providers as critical under Article 31, with direct oversight. The contract itself follows Decide whether DORA reaches you through financial customers.

Examples

YAML example

dora_register_facts:
  legal_identifier: { type: LEI, value: 5299000EXAMPLE000001 }
  services:
    - id: invoicing-api
      data_processed_in: [SE, DE]
      data_stored_in: [SE]
      subcontractors: [hosting-provider-a, email-provider-b]

How to check

The facts file holds a legal identifier, and one entry per service with data locations and subcontractors. A script fails when a vendor in the vendor register marked as a subcontractor is missing from it.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/security-laws/dora-register-facts">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.