> ## Documentation Index > Fetch the complete documentation index at: https://docs.coverbase.com/llms.txt > Use this file to discover all available pages before exploring further. # The DORA Register of Information > Build the DORA Register of Information from the contracts, vendors and services already in Coverbase: set up your group entities and business functions, decide which contracts are in scope, fix what blocks the filing, and download the Excel workbook and the xBRL-CSV package for your competent authority. For AI agents: a documentation index is available at [https://docs.coverbase.com/llms.txt](https://docs.coverbase.com/llms.txt). This page is also available in markdown by appending .md to the URL. > [!NOTE] > > This guide is part of the [User Guides](https://docs.coverbase.com/user-guides/overview.md) collection. It covers the **DORA Register** entry in the left navigation and the **DORA** sections on vendor, contract, service and assessment records. For the contract record itself, see the [Contracts workspace guide](https://docs.coverbase.com/user-guides/contracts-workspace.md). For how a contract's annual value is worked out, see [The contract Spend tab](https://docs.coverbase.com/user-guides/contract-spend.md). For subprocessors, which feed the supply chain, see the [Vendor record guide](https://docs.coverbase.com/user-guides/vendor-record.md). > [!NOTE] > > The DORA Register is in beta. If you do not see **DORA Register** in the left navigation, ask your Coverbase account team to turn it on. Under the Digital Operational Resilience Act (DORA), every EU financial entity keeps a Register of Information on its ICT third-party arrangements and files it once a year with its competent authority. The register has 15 templates, from **B\_01.01** (the entity that keeps the register) to **B\_99.01** (your own definitions of Low, Medium and High). Coverbase fills them from the records you already keep: contracts, vendors, services, assessments, subprocessors and continuity plans. You add only what Coverbase cannot know, such as which of your entities signed a contract and which business functions depend on a service. The mistake people make most often is filing a package that still has blocking issues. The authority rejects the whole upload when a key value is missing or does not match across templates, most often a provider without an LEI. Clear every blocking issue on the **Readiness** tab before you prepare the submission. ## Where to find it Click **DORA Register** in the left navigation. Five tabs run across the top: | Tab | What it is for | | - | - | | **Readiness** | What still blocks the filing, what will be flagged back, and which contracts still need a scope decision | | **Register** | Each of the 15 templates exactly as it will be filed | | **Functions** | Your business functions and whether each is critical or important | | **Entities** | The reporting entity, your competent authority, and every group entity and branch the register covers | | **Submissions** | Every package you have prepared, frozen so you can download it again | **Download draft** and **Prepare submission** sit to the right of the tabs on every tab. The same data appears on the records it comes from: * A vendor has a **DORA** tab with its provider identity, its ICT services in the register, and each service's supply chain. * A contract has a **DORA** tab with its register entry, or a prompt to include it. * A service has a **DORA register** card in its sidebar. * An assessment has a **DORA register** card listing the ICT services it covers. ![Left navigation with DORA Register selected between Risk and Radar](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-left-nav.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=3bcd3980ea04d27057b6b174ec4a663b) The DORA Register in the left navigation. ## Setting up the register The first time you open **Readiness**, a **Set up the register** card lists three steps. Each one disappears into a green check as you finish it. ![Set up the register card with three steps: name the reporting entity, identify business functions, and decide which contracts are in scope](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-setup.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=db0fcd16454a463dc58edc692ecd0804) The setup card on a first visit, with one step left. ### Step 1: name the reporting entity Open **Entities**. **New entity** adds a group entity: its registered name, its LEI, its country, the type of entity (for example a credit institution or an insurance undertaking), where it sits in the group, its direct parent, and its total assets. Total assets are required for financial entities and not for an intra-group ICT provider. Add each branch outside the head office's country under **Branches** in the same dialog. Then click **Edit** on the **Reporting entity** card. Pick the entity that keeps and files the register, enter your competent authority (for example the Central Bank of Ireland), and choose **Individual entity** or **Consolidated group**. The package is named after the reporting entity's LEI, so you cannot file without one. ![Entities tab with the reporting entity, its LEI, the competent authority, the register scope, and a table of four group entities](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-entities.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=c647bbd7564a75786bc9afa7955e332d) Entities: the reporting entity card and every entity in scope. ### Step 2: identify your business functions Open **Functions** and click **New function**. A function is something one of your entities does under its licence, such as claims handling or payment execution. Give it a name, the entity that performs it, its licensed activity, whether it is critical or important and why, when you last assessed that, how long it can be down (RTO) and how much data it can lose (RPO), and the impact of losing it. Then pick the ICT services it depends on. Coverbase numbers functions **F1**, **F2** and so on. Whether a function is critical or important decides how much the register asks for: notice periods, governing law, data locations, reliance and the supply chain are required only for services that support one. ![Functions tab listing five functions F1 to F5 with their entity, criticality badge, RTO and RPO, impact, service count and last assessed date](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-functions.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=2fb03e2126c5f8f3ad2db17d786a945a) Functions: each function's entity, criticality, recovery objectives and the ICT services behind it. ### Step 3: decide which contracts are in scope Click **Awaiting scope review** on **Readiness**. Every active contract without a decision is listed with its annual value and why it is likely ICT. **Include** puts a contract in the register; **Exclude** keeps it out of every filing. Tick several rows to include or exclude them together. You can also decide from the contract itself: its **DORA** tab offers **Include in register** and **Not ICT, exclude**. An included contract can be taken out again from the actions menu on its register entry. ![Scope review table with two contracts ticked and a floating bar offering Exclude and Include selected](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-scope-review.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=c850a4fb47a40ce5baaf8740ee158fee) Scope review: tick contracts and include or exclude them together. ## Reading the Readiness tab Four tiles sit across the top. Click one to change the list below it. | Tile | What it counts | | - | - | | **Blocking issues** | Values the authority rejects the upload for | | **Data quality** | Values the authority accepts and then flags back to you | | **Awaiting scope review** | Active contracts with no scope decision | | **Contracts in the register** | Included contracts in force on the reference date, with the number of providers in their supply chains | Each row is one record (a contract, an ICT service, a provider, an entity or a function), the values it still needs, and the templates they appear in. Narrow the list with the record type filter. **Templates** on the right shows every template with its row count and a dot for its state: red when it has a blocking issue, yellow when it has a data quality finding, green when it is complete. Click a template to open it on **Register**. The line under the tabs gives the reference date (December 31 of the current year), the reporting entity, and the filing deadline (March 31 of the following year). ![Readiness tab with four tiles, a list of records with blocking issues, and the template list on the right](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-readiness.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=ada1fe49a197645a4aa3503614ae9d30) Readiness, showing what blocks the filing. ## Fixing a record Click a row to open the record in a drawer. Every field names the template it is filed in, and a missing value says what happens if you leave it: * **Blocks submission**: the authority rejects the upload until you fill it. * **Missing; flagged after filing**: the upload is accepted and the value is reported back as missing. Where Coverbase already holds a likely answer, the field shows it with its source and a **Use this** button. Suggestions come from the contract summary (governing law), the vendor risk profile (data locations, substitutability, alternative providers), the provider's headquarters, the contract's spend category (the ICT service type), GLEIF (the provider's legal name and ultimate parent), and the vendor's subprocessors (the supply chain). Nothing is written until you click **Use this** and save. **Save and open next** saves and moves to the next record with an open issue, so you can work through the list without going back to it. **Open record** takes you to the contract, vendor or service itself. ![Drawer for an ICT service with classification, data and assessment sections, two fields marked Blocks submission and others marked Missing, flagged after filing](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-drawer-service.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=5d2a29ffb1481a225320d8b73cbe4764) An ICT service in the drawer: two values block the filing. ### What each record holds | Record | Values | Templates | | - | - | - | | Contract | Which entities signed it and which use it (with branch), notice periods for you and for the provider, governing law, and an annual expense if the contract's own value is wrong | B\_02.01, B\_02.02, B\_03.01, B\_04.01 | | ICT service | Service type, the functions it supports, reliance, country of provision, whether it stores data and where, data sensitivity, substitutability, exit plan, reintegration, impact of losing it, alternative providers, last audit, and its supply chain | B\_02.02, B\_05.02, B\_07.01 | | Provider | LEI or EUID, legal name, type of person, headquarters, ultimate parent and its LEI, and whether it is part of your group | B\_05.01, B\_03.03 | Several values come from Coverbase without you entering them: * **Annual expense** is the contract's yearly value, worked out the same way as on the [Spend tab](https://docs.coverbase.com/user-guides/contract-spend.md). A provider's expense is the sum across its included contracts. * **Arrangement type** is **Overarching** when other included contracts sit under this one, **Subsequent or associated** when this one sits under another, and **Standalone** otherwise. * **Exit plan** reads **Yes** when the vendor has a submitted continuity plan. * **Last audit** is the date of the vendor's last completed assessment. * A provider's LEI comes from the vendor record or from its GLEIF match. A lapsed LEI is flagged so you can ask the provider to renew it. ### The supply chain The **Supply chain** section of an ICT service lists the subcontractors behind the direct provider, each with its rank: rank 1 is the provider you contract with, rank 2 its subcontractor, and so on. Add a subcontractor with its name, LEI or EUID and country, and choose which provider it works for. When the vendor lists subprocessors that are not in the chain yet, a banner offers to add them in one click. ![Vendor DORA tab showing provider identity with LEI and legal name, a table of ICT services in the register, and a supply chain with two ranks](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-vendor.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=12fbcdc73dd6676b60df380172ca6c4d) A vendor's DORA tab: its identity, its ICT services, and one service's supply chain. ## Reading the Register tab **Register** shows one template at a time, exactly as it will be filed. Choose a template in the list on the left; the dot beside it is its state. Each column shows its EBA column code (`c0010`, `c0020`, ...). A cell shows the readable value with the code that will be filed under it, for example **LEI** over `eba_qCO:qx2000`. A red cell blocks the filing, a yellow one will be flagged, and **Not applicable** is filed as the placeholder the authority expects. Click a row to open the record that owns it. **B\_99.01 Definitions** is a form rather than a table. Write what your organization means by each level: Low, Medium and High sensitivity and impact, each substitutability level, and each reintegration level. **Save definitions** stores them for every filing. ![Register tab showing template B\_02.02 with the template list on the left and rows of contract references, entity LEIs and provider codes](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-register-b0202.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=e80784617d5d5389c13731e67c1cbba5) Template B\_02.02, one row per contract, entity, function, service type and country. ## Downloading and filing **Download draft** offers two files built from the register as it stands now: * **Excel workbook (15 templates)**: one sheet per template, with the column names and codes in the header rows. Use it to review the register with colleagues. * **Submission package (xBRL-CSV)**: the file the authority accepts. It is a zip whose name starts with the reporting entity's LEI, and it holds one CSV per template plus the files the reporting format requires. > [!WARNING] > > Do not rename the submission package or the folder inside it. The authority checks that the zip and its folder share the name Coverbase gives them and rejects the upload when they differ. **Prepare submission** freezes the register as of the reference date with the checks it passed. If blocking issues remain, the dialog says how many and offers **Prepare anyway** for a draft you want to share internally. Every prepared submission is listed on **Submissions** with its reference date, who prepared it, its checks and its row count, and you can download its Excel workbook and package again at any time. A frozen submission does not change when you edit the register afterwards. ![Prepare Submission dialog warning that seven issues will get the package rejected, with Cancel and Prepare anyway buttons](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-prepare.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=75a523a84bcde00a7ea573121f0f69dc) Prepare submission, with blocking issues still open. ## The DORA sections on other records ### On a contract The contract's **DORA** tab shows its register entry: the reference number filed for it, its arrangement type and annual expense, the signing and using entities, governing law and notice periods, and the ICT services under it. **Edit** opens the drawer. A contract that is not in force on the reference date says so at the top of the tab, and that year's register leaves it out. ![Contract DORA tab with the register entry card and the ICT services under the contract](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-contract.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=c353bdca4a38fa7807e63eacbc16796f) A contract's DORA tab. ### On a service The service's sidebar has a **DORA register** card with its service type, functions, reliance, data storage countries, substitutability, exit plan and supply chain size. The pencil opens the drawer. ### On an assessment The assessment's sidebar has a **DORA register** card listing the ICT services the assessment covers. Completing the assessment sets the last audit date for those services. A service still missing its substitutability or exit plan is marked **Needs answers**; click it to answer in the drawer while you have the assessment open. ![Assessment sidebar card saying the completion date is filed as the last audit, with one service marked Needs answers](https://mintcdn.com/coverbase/4hX8QWPJcJ_hn5rv/images/user-guides/dora-assessment.png?fit=max\&auto=format\&n=4hX8QWPJcJ_hn5rv\&q=85\&s=b728fd951e9638bf6f249d01c4e558da) The DORA register card on a completed assessment. ## Troubleshooting | Symptom | Cause | Fix | | - | - | - | | **DORA Register** is missing from the left navigation. | The beta is not turned on for your organization, or your role cannot read every contract in the organization. The register covers all of them, so access to assigned contracts only is not enough. | Ask your Coverbase account team, or an admin to give you organization-wide contract access. | | **Prepare submission** says there is no reporting entity LEI. | The reporting entity is not set, or it has no LEI. | On **Entities**, add the LEI to the entity and pick it under **Reporting entity**. | | A provider shows **Identification code** under **Blocks submission**. | Coverbase has no LEI or EUID for it, from the vendor record or from GLEIF. | Open the provider and enter its LEI, or its EUID if it is an EU company without one. | | A contract I included is not in any template. | It is not in force on the reference date (it starts later or has ended). | Check its effective and expiration dates on the contract. | | **Annual expense** shows **Missing** on a provider. | None of its included contracts has a value, or the values have no currency. | Record the contract value with its currency, or enter an annual expense in the drawer. | | Notice periods or governing law are not asked for on a contract. | No service under it supports a critical or important function, so they are optional. | Nothing to do. Link the service to a critical function if it supports one. | | The supply chain banner offers subprocessors I already added. | The subcontractor was added with a different name or code than the subprocessor. | Remove the duplicate, or add the subprocessor from the banner and remove your own entry. | | A value I changed did not reach a prepared submission. | A submission is frozen when it is prepared. | Prepare a new submission. | ## Related > **[Contracts workspace](https://docs.coverbase.com/user-guides/contracts-workspace.md)** > > The contract record, including the dates and value the register reads. > **[The contract Spend tab](https://docs.coverbase.com/user-guides/contract-spend.md)** > > How a contract's annual value is worked out, which becomes its annual expense. > **[The vendor record](https://docs.coverbase.com/user-guides/vendor-record.md)** > > Subprocessors, the risk profile and continuity plans that feed the register. > **[Corporate registrations](https://docs.coverbase.com/user-guides/corporate-registrations.md)** > > How a vendor is matched to its registry record and LEI. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.