Which service arrangements belong in the register?.

The scope rule

Article 28(3) of Regulation (EU) 2022/2554 requires a register covering all contractual arrangements on the use of ICT services provided by ICT third-party service providers. There is no materiality threshold and no value floor. The common assumption that only critical or important arrangements belong is the single largest source of understated registers.

What criticality changes is the depth of what must be recorded — particularly how far the supply chain is documented and which assessments are attached — not whether the arrangement appears at all.

What counts as an ICT service

ICT services are digital and data services provided through ICT systems on an ongoing basis, including hardware as a service and hardware support. Two boundaries recur:

• Software is in scope where it is provided as a service. A perpetual licence with no ongoing provision sits differently from a subscription that includes hosting, updates and support — but support and maintenance are themselves ongoing provision, so few arrangements fall outside on this ground alone.
• Business process outsourcing is in scope to the extent it is delivered through ICT. A service that is substantively a digital service does not leave scope because the contract describes it in business terms.

Genuinely outside are non-digital services, and financial services received from a regulated entity that are not ICT services in themselves.

What counts as a third-party provider

An ICT third-party service provider is an undertaking providing ICT services. The status is defined by what is provided, not by the commercial relationship, which produces two results firms often resist:

Where criticality actually bites

The critical-or-important determination governs how much has to be documented: the depth of supply chain disclosure, the assessments of substitutability and exit, and the level of scrutiny the supervisor will apply. Doing it after the arrangement inventory is complete is the efficient order, because it can then be applied to a known population rather than used to filter one.

The edge cases

• Arrangements with no written contract. Absence of a document is a contract-management finding, not an exclusion. The arrangement exists.
• Arrangements signed by another group entity but used by yours. Recorded, with the signatory and the using entities distinguished — that distinction is exactly what the party templates exist for.
• Arrangements expiring during the period. Governed by the reference date; an arrangement in force at the reference date belongs in that register.
• Free or zero-value services. No value threshold applies. If it is a contractual arrangement for an ICT service, it is in.

Official sources

Primary instruments only. Each is named in full so the reference remains traceable even if a link moves.

1. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), in particular Articles 3 and 28EUR-Lex · Regulation · definitions and the register obligation
2. Commission Implementing Regulation (EU) 2024/2956 laying down implementing technical standards with regard to standard templates for the register of informationEUR-Lex · Implementing Regulation · templates, ranking of providers and completion instructions
3. European Banking Authority — frequently asked questions on the reporting of registers of informationEBA · interpretation of scope and completion · consult the current release

Questions, answered

Do intragroup arrangements really belong in the register?

Yes, where they are contractual arrangements for the provision of ICT services. The intragroup character is recorded as an attribute; it is not a basis for exclusion. Group shared-service entities are among the most commonly missed entries.

We have a perpetual software licence with no support. Is that an ICT service?

A one-off licence with no ongoing provision is the strongest case for being outside, but it is rare in practice: maintenance, updates, hosting or support all constitute ongoing provision. Assess the arrangement as delivered rather than as titled, and record the reasoning.

Can we leave out arrangements that do not support a critical or important function?

No. The obligation covers all contractual arrangements for ICT services. Criticality determines the depth of documentation required, particularly for the supply chain and the assessments, not whether an arrangement is included.

What about an arrangement where no signed contract can be located?

Record the arrangement. The register describes the arrangements in force, and an unlocatable contract is a contract-management issue to escalate rather than a reason to omit a live dependency from a supervisory dataset.

REGREP is an independent software provider. This record explains a reporting framework in plain language and is not legal, tax or regulatory advice. Confirm scope, thresholds and submission dates with your competent authority before you file.