Search for Q&As

Enquirers can use various factors to search for a Q&A:

  • These include searching by the Q&A ID; legal reference, date submitted, technical standard / guideline, or by keyword if known.
  • Searches can be extended to more than one legal act, topic, technical standard or guidelines by making multiple selections (i.e. pressing 'Ctrl' on your keyboard, and selecting the relevant ones from the drop-down lists by left mouse-click).

Disclaimer:

Q&As refer to the provisions in force on the day of their publication. The EBA does not systematically review published Q&As following the amendment of legislative acts. Users of the Q&A tool should therefore check the date of publication of the Q&A and whether the provisions referred to in the answer remain the same.

Please note that the Q&As related to the supervisory benchmarking exercises have been moved to the dedicated handbook page. You can submit Q&As on this topic here.

Final Q&As Q&As under review Rejected Q&As Archived Q&As All Q&As

List of Q&A's

Part 2 – Template specific instructions to template B_06.01

Data point B_06.01.0050 is missing from the official ITS templates. Is this data point no longer applicable?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2025_7313
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Regulatory technical standards - subcontracting ICT services supporting critical or important functions

Where and when was the Comission Delegated Regulation (EU) supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards to specify the elements which a financial entity needs to determine and assess when subcontracting ICT services supporting critical or important functions as mandated by Article 30(5) of Regulation (EU) 2022/2554 oficially published? 

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2025_7310
  • Topic: Other DORA topics
  • Date of submission:
  • Published as Rejected Q&A: 17/03/2025

Applicability of Regulation (EU) 2022/2554 (DORA) to ICT services provided by financial entities.

Clarification is needed on whether financial institutions providing ICT services to other financial institutions – regardless of whether these services are ancillary to regulated financial activities – can be qualified as ICT third-party service providers under Regulation (EU) 2022/2554. If they are, must their contractual relationships comply with the mandatory provisions outlined in Article 30 of the mentioned Regulation or are these requirements inapplicable since such entities are already authorised/licenced/registered? 

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_7288
  • Topic: Other DORA topics
  • Date of submission:
  • Published as Rejected Q&A: 17/03/2025

Template specific instructions – primary keys

How to report data fields in case of missing values?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2024_7285
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Template specific instructions – field B_05.02.0060 (Identification code of the recipient of sub-contracted ICT services)

How to report data field B_05.02.0060 if the ICT third-party service provider is a direct provider (rank =1)?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2024_7284
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Template specific instructions – field B_05.01.0020 (Type of code to identify the ICT third-party service provider)

How to report type of identification code in data field B_05.01.0020 when using codes other than LEI or EUID?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2024_7283
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Template specific instructions – field B_02.02.0160 (Location of management of the data)

How to report data field B_02.02.0160 where the ICT service is not based or does not foresee data processing?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2024_7281
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Template specific instructions – field B_02.02.0130 (Country of the governing law of the contractual arrangement)

How to report field B_02.02.0150 where the ICT service is not related to storage of data (B_02.02.0140 = 'No')?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2024_7280
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Template specific instructions – field B_02.02.0130 (Country of the governing law of the contractual arrangement)

How to report field B_02.02.0130 where the ICT service is not supporting a critical or important function considering that according to the data model this data field is a primary key?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2024_7279
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Template specific instructions - field B_01.02.0060 (LEI of the direct parent undertaking of the financial entity)

What should be reported in case the financial entity does not have a direct parent undertaking (for example, is the parent undertaking itself) or reports the register on an individual basis?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2024_7278
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Template specific instructions – field B_01.02.0050 (Hierarchy of the financial entity within the group)

What does ‘where applicable’ mean in the title of data field B_02.01.0050?  What should be reported in this field in case the entity that is being reported in this template is not a financial entity (i.e., option 22, 23, or 24 was selected in field B_01.02.0040 for the entity type)?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Regulation (EU) 2024/2956 - ITS on the register of information
  • ID: 2024_7277
  • Topic: Register of information (DORA)
  • Date of submission:
  • Published as final Q&A: 28/03/2025

Application of DORA Regulation to sub-threshold AIFMs which have chosen to opt-in to the application of the AIFMD (Art. 3(4)), if the thresholds regarding AuM referred to under Article 3(2) of AIFMD are not exceeded

Are sub-threshold alternative investment fund managers (AIFMs) as referred to in Article 3(2) of Directive 2011/61/EU (“AIFMD”), which have chosen to opt-in to the application of the AIFMD according to Article 3(4) of that Directive, captured within the scope of application of Regulation (EU) 2022/2554 (“DORA”) under Articles 2(1)(k) and 2(3)(a) of DORA, if the thresholds regarding assets under management (“AuM”) referred to under Article 3(2) of AIFMD are not exceeded by such AIFM?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_7260
  • Topic: Other DORA topics
  • Date of submission:
  • Published as Rejected Q&A: 18/02/2025

Are trust services under the scope of DORA, whatever the nature of the services

Financial institutions (EEFFs) subject to the DORA Regulation understand that Trust services, whatever they are, are “ICT services” and therefore their providers (Trust Service Providers / TSPs) are included in the scope of the DORA Regulation. However, these Trust services do not always constitute or are part of an essential or important function for the operation of such entities, but serve for auxiliary or internal functions of the entities.  Let's take the case of an electronic signature certificate used by a representative to sign contracts with suppliers or internal legal documents: is it essential for the continued operation of a bank, and would the suspension of the service significantly affect the authorized activity of the entity?  Another example: could the use of a platform that allows the remote management of electronic notifications sent to EEFFs by public administrations thanks to connectors that allow the entity to be identified with electronic certificates be considered essential for the EEFFs' operations? It is really a tool that facilitates the administrative procedures of the entity and is not part of the services it provides to its customers.    

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_7200
  • Topic: ICT third-party risk management
  • Date of submission:
  • Published as Rejected Q&A: 19/02/2025

Scope for dependent financial intermediaries

The dependent financial intermediaries (agents), who acting on behalf of credit institutions, are covered by the DORA Regulation?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_7142
  • Topic: Other DORA topics
  • Date of submission:
  • Published as Rejected Q&A: 15/11/2024

Exemption for Non-EU ICT Intra-group Service Providers

Is it accurate to interpret that an ICT intra-group service provider established outside the EU (non-EU country), providing critical services to an EU-based financial institution (parent undertaking), falls within the exemption outlined in Article 31(8) of DORA, thereby exempting the need for establishing a subsidiary within the EU?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_7096
  • Topic: Oversight framework of CTPPs
  • Date of submission:
  • Published as final Q&A: 11/12/2024

Lex Specialis NIS2 Directive

Are financial entities in scope of DORA required to submit incident reports under the NIS2 Directive ahead of DORA coming into effect in January 2025?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_7060
  • Topic: ICT-related incidents (management / classification / reporting)
  • Date of submission:
  • Published as Rejected Q&A: 18/02/2025

Duplicate ICT Incident Reporting

Is duplicate incident reporting via the ECB SSM Cyber Incident Reporting Framework required, alongside DORA incident reporting under Article 19?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_7050
  • Topic: ICT-related incidents (management / classification / reporting)
  • Date of submission:
  • Published as final Q&A: 11/12/2024

Critical Services Affected

Article 6 of the Delegated Act on the Classification of Major Incidents states that: "For the purpose of determining the criticality of the services affected as referred to in Article 18(1), point (e), of Regulation (EU) 2022/2554, financial entities shall assess whether the incident:(a) affects or has affected ICT services or network and information systems that support critical or important functions of the financial entity;(b) affects or has affected financial services provided by the financial entity that require authorisation, registration or that are supervised by competent authorities;(c) constitutes or has constituted a successful, malicious and unauthorised access to the network and information systems of the financial entity." Can you confirm please that ALL three of the components are cumulatively required to trigger the criteria on Critical Services Affected?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_7047
  • Topic: ICT-related incidents (management / classification / reporting)
  • Date of submission:
  • Published as final Q&A: 11/12/2024

Services of credit registers under DORA

Should public Credit Registers be regarded as providers of ICT services under Article 3(19) of DORA?

  • Legal act: Regulation (EU) No 2022/2554 (DORA Reg)
  • COM Delegated or Implementing Acts/RTS/ITS/GLs: Not applicable
  • ID: 2024_6997
  • Topic: Other DORA topics
  • Date of submission:
  • Published as Rejected Q&A: 19/07/2024