When must DORA be reported on the country and European level?

The Digital Operational Resilience Act (DORA) establishes strict rules for financial institutions in the EU to manage and report ICT risks, starting January 17, 2025. Here's what you need to know:

• Key Deadlines:
  • January 17, 2025: DORA reporting begins for ICT incidents and critical third-party providers.
  • April 30, 2025: National authorities submit consolidated ICT third-party registers to European Supervisory Authorities (ESAs).
• National Reporting:
  • Financial entities report to their National Competent Authorities (NCAs).
  • Deadlines vary by country (e.g., Germany: April 11, 2025; France: April 15, 2025; Italy: April 30, 2025).
• EU-Level Reporting:
  • National authorities compile and submit data to ESAs for EU-wide oversight.
• What to Report:
  • ICT Incident Notifications: Initial (within 24 hours), intermediate (72 hours), and final reports (1 month).
  • Third-Party Registers: Document ICT service providers by Q1 2025.
  • Operational Resilience Assessments: Regular evaluations of risk management systems.
• Tools for Compliance:
  • Use automated tools like DORApp for report generation, third-party monitoring, and audit trails.

These measures aim to strengthen digital resilience across the EU's financial sector. Start preparing now to meet these requirements and avoid penalties.

DORA Is Here: Expert Insights on EU Digital Operational ...

DORA Reporting Basics

DORA introduces a framework that requires financial entities to report on operational resilience and ICT incidents across different jurisdictions, starting January 17, 2025.

Financial entities need to maintain records in three key reporting areas:

These categories aim to ensure swift incident reporting and thorough documentation of ICT risks and third-party relationships.

National and EU Reporting Requirements

National and EU-level reporting processes build upon these categories. At the national level, financial entities report directly to their respective National Competent Authorities (NCAs), including ICT service provider registers by Q1 2025. These national submissions serve as the groundwork for broader European oversight.

The European reporting system follows a hierarchical process:

1. Financial entities submit their reports to national authorities.
2. National authorities review and consolidate these submissions.
3. The European Supervisory Authorities (ESAs) receive the consolidated reports by April 30, 2025.

Reporting rules differ based on the size and classification of institutions. Microenterprises, for instance, have simplified requirements while still contributing to overall resilience.

Key focus areas for financial institutions include ICT risk management frameworks, incident notifications, operational resilience testing, cyber threat information sharing, and third-party risk documentation.

In April 2024, the Eurosystem updated its TIBER-EU framework to align with DORA's requirements, creating a consistent reporting approach across the EU. This dual-level system clarifies obligations for each jurisdiction and highlights national deadlines.

National Reporting Deadlines

Under DORA, financial entities need to meet specific national reporting deadlines that differ by country and report type. These deadlines complement the broader EU framework.

Compliance Report Schedule

Deadlines for submitting the Register of Information (RoI) are set by national authorities to align with European reporting requirements. Here are the confirmed schedules:

Entities must ensure their RoI submissions are accurate and include detailed records of key ICT providers. Some authorities are still in the process of finalizing additional deadlines.

Next, take note of resilience assessment timelines to complete your reporting framework.

Resilience Assessment Timeline

For resilience assessments, financial entities must document their ICT risk management systems and controls. However, specific national deadlines for these reports are still being finalized by individual authorities.

ICT Incident Report Deadlines

ICT incident notifications follow a strict timeline, with national rules dictating the reporting process for major incidents:

If a deadline falls on a weekend or public holiday, reports must be submitted by 12:00 PM on the next working day. ICT providers are expected to provide incident details promptly to ensure the 24-hour classification requirement is met.

sbb-itb-107f699

EU-Level Report Deadlines

The ESAs have outlined deadlines for EU-level DORA reporting to strengthen financial institutions' ability to manage digital risks.

ESA Annual Report Requirements

Financial entities are required to send detailed reports to their national competent authorities. One key deadline is April 30, 2025, when competent authorities must submit registers of information on ICT third-party arrangements received from financial entities. The reporting framework includes:

These annual submissions form the basis for monitoring ICT providers effectively.

ICT Provider Register Updates

The ESAs have introduced a standardized process for updating ICT provider information using the XBRL-CSV standard for data collection. Financial entities must ensure provider identifiers are accurate and that contractual arrangements are well-documented.

To refine reporting practices, a voluntary Dry Run exercise was conducted with around 1,000 EU financial entities. The ESAs plan to release an updated technical package, including validation rules, in December 2024. This approach supports a unified framework for managing digital resilience across the EU.

Critical Provider Reports

Starting January 17, 2025, critical ICT third-party service providers (CTPPs) will face additional reporting requirements. The ESAs will assess and designate CTPPs through a structured evaluation process. Reporting guidelines will outline details such as service classifications, risk assessments, and incident tracking.

Tools for DORA Reporting

Handling DORA reporting efficiently requires reliable tools that simplify compliance and help avoid submission mistakes. The right solutions can make a big difference in managing these processes.

DORApp Reporting Features

DORApp is specifically designed to assist with DORA compliance. Its automated XBRL report generation ensures submissions meet the technical standards required by European Supervisory Authorities. Here’s what it offers:

Pairing these automated features with thorough documentation ensures compliance is maintained.

Documentation Guidelines

Good documentation is critical for effective reporting. Studies show that only 6% of spreadsheet-based submissions are accepted. To improve your documentation:

• Use a centralized knowledge base to store all DORA-related materials.
• Keep detailed incident management records using standardized formats.
• Fully document ICT third-party agreements.
• Maintain clear audit trails for all compliance actions and updates.

Multi-Country Reporting Tips

Organizations operating across multiple jurisdictions need consistent reporting strategies. Here are some practical approaches:

To secure access across regions, use tools like MFA, IP filtering, and geo-fencing. Automated questionnaire validation and efficient supplier discovery tools can also help maintain uniform reporting standards across jurisdictions.

Future DORA Requirements

Get ready for new reporting requirements as DORA implementation moves toward its major deadlines.

Regulatory Update Tracking

Stay on top of updates from the European Supervisory Authorities (ESAs) to maintain compliance. For instance, the European Commission suggests replacing the Legal Entity Identifier (LEI) with the European Unique Identifier (EUID) for identifying ICT third-party service providers.

Here’s a breakdown of key upcoming requirements:

These updates mean internal processes need to be adjusted promptly.

Process Update Planning

Once regulatory updates are issued, adjust your internal procedures to meet the new standards. Use current reporting challenges as a foundation to improve ICT risk frameworks and incident response systems.

To stay ahead, companies should focus on:

• Monitoring and applying regulatory changes
• Using tools for continuous oversight
• Keeping compliance records up to date

Contracts with third-party providers should outline:

• Risk management procedures
• Security protocols
• Resilience standards for operations
• Incident reporting guidelines
• Recovery planning documentation

These steps will help ensure readiness for DORA’s future requirements while maintaining resilience across the financial sector.

Conclusion

Clear reporting deadlines and streamlined processes are key to meeting DORA regulations. DORA requires financial entities to adhere to a set timeline for reporting and improving operational resilience, with major obligations kicking off on January 17, 2025, across both national and EU levels.

Automation tools can cut incident management efforts by up to 50% by using customizable workflows and standardized documentation. This level of efficiency is essential to meet DORA’s strict reporting demands.

DORA doesn’t just enforce compliance - it pushes institutions to use automation to turn regulatory requirements into operational advantages. To stay ahead, organizations need strong reporting systems that guarantee timely submissions and maintain thorough audit trails. By keeping open communication with regulators and leveraging automation, businesses can transform compliance hurdles into opportunities for smoother operations.

Related Blog Posts

• DORA Compliance Checklist: 10 Key Requirements for 2025
• ESA's DORA reporting deadlines you should watch for in 2025
• Overview of DORA’s Draft Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS)
• How to prepare and maintain a DORA ICT third-party provider register?