DORA mapping

Scope

tprm.mlab.sh implements DORA Pillar IV - ICT third-party risk (Chapter V of Regulation (EU) 2022/2554). It covers the governance lifecycle (due diligence, contracts, audits, exit, incidents) and the production of the register of information required by Article 28(3): the 15 EBA ITS templates with controlled codes, integrity validation and the deposit-ready xBRL-CSV package.

Module -> DORA article -> EBA template

ICT and non-ICT arrangements

The outsourcing register (/or/) spans every third-party arrangement, not only the ICT ones. Each arrangement carries its services, and each service declares a nature: ict, non_ict or other.

Only ICT services feed the register of information. Non-ICT outsourcing stays in the outsourcing register and never reaches the EBA templates. This matters for entities whose national regime keeps non-ICT outsourcing under its own rules, and it is enforced at export time rather than left to discipline: an arrangement with no service at all blocks the export until it is classified.

Third-country branches

A branch established in a Member State whose head office sits outside the Union is not a legal entity of its own. Under Q&A DORA102 (ID 3097), DORA applies to such a branch where its head office would qualify as an entity listed in Article 2(1) had it been established in the Union. The branch then has to maintain and file its own register of information.

Declare it on the Entity Information page (/ei/) by answering the branch question, then run the applicability test. The product records the head office alongside the branch and maps them as follows:

Two consequences worth stating plainly:

• The head office is never reported as an entity in scope. It sits outside the Union and is not itself subject to DORA, so it does not appear in B_01.02. Listing it there raises a warning in the validation report.
• The country reported is the branch's, never the third country. The head office country is recorded separately and is used for concentration analysis.

Arrangements used by the branch default to eba_ZZ:x838 (branch of a financial entity) in B_04.01, carrying the branch code and the head office LEI, which is how B_01.03 keys a branch.

Scope of the applicability test

The list of Article 2(1) entity types is shown in full, whatever your authority. Where a competent authority publishes a narrower remit, choosing a type outside it raises a non-blocking warning, and the reminder about the national regime for non-ICT outsourcing is shown with its sources. An authority the product has no entry for behaves generically: the full list, and no warning.

Article 28 - general principles

• 28(3) Register of information. The whole product feeds it; build and export it from /reg/ and /eba/.
• 28(3) Competent authority informed. A contract that supports a critical or important function (a function mapped to it, or one of its ICT services marked critical) shows To inform on its page. Record when, to which authority and under which reference it was informed; it then shows Informed. The notice itself goes through your authority's channel.
• 28(4) Pre-contractual due diligence. The due-diligence checklist (/dd/) records an opinion per item (satisfactory, concerns, blocking, not applicable) with a comment and an owner, and a decision. It covers criticality support, concentration, suitability, information security, continuity, exit strategy and conflicts of interest (28(4)(e)).
• 28(4)(b) Supervisory conditions. A section of the due diligence asks whether anything in the arrangement would stop your authority from supervising you, in six checks: authority access, inspection and audit rights (Art. 30(2)(g), 30(3)(e)); no third-country law preventing supervision; a designated CTPP from a third country used through its EU subsidiary (Art. 31(12)); no Art. 42 measure on that CTPP; the provider's authorisation for a regulated activity; the authority informed under 28(3). Each check comes with a suggestion drawn from your Art. 30 reviews, the provider and data locations, the CTPP list and your notices; you decide, and a verdict sums it up (blocking, reservations, conditions met).
• 28(5)-(6) Audit & access rights. Track audit type, scope, findings (with severity) and corrective actions in /al/.
• 28(8) Exit strategies. Documented, versioned and tested exit plans in /ex/.

Article 29 - concentration risk

Before contracting for a critical or important function, Article 29 asks for an assessment of concentration risk. /ri/ assesses each provider and gives a level (high, medium, low) from:

• the critical or important functions it supports, and how hard it is to replace;
• several arrangements with the same provider, or with related companies under the same ultimate parent (LEI);
• a provider, or data stored or processed, outside the EEA;
• the length of its subcontracting chain;
• its designation as a critical ICT third-party provider (CTPP).

The page also analyses concentration by category and geography. For a third-country branch the head office country is a dimension of its own, separate from the branch country, so a concentration of critical providers in the head office's jurisdiction shows up as third-country concentration.

Subcontracting - RTS 2025/532

Commission Delegated Regulation (EU) 2025/532, in force since 22 July 2025, sets the conditions for subcontracting ICT services that support critical or important functions:

• Article 3 - before allowing subcontracting. Ten conditions to assess, in the Art. 30 review of the contract (/a30/), with a reminder to reassess points (f) to (j) over time.
• Article 4 - contract clauses. The twelve points the contract must carry, in the same review.
• Articles 5 and 6 - material changes. The register of material changes in /sc/ records each change the provider notifies, the notice period, your decision, and that it counts as no objection once the deadline passes. When a change goes ahead despite an objection, or without notice, it shows the termination right of Article 6 that applies.

Designated critical ICT third-party providers (Art. 31, Art. 42)

The platform carries the list of the 19 CTPPs designated by the ESAs on 18 November 2025. The list names entities without identifiers, so their LEIs and groups were checked at GLEIF: 15 LEIs confirmed, 3 entities without an LEI matched through their group, and 1 to confirm. A provider is recognised:

• by LEI - it is the designated entity;
• by group - its LEI or its ultimate parent is the designated entity or its group, such as a local subsidiary;
• by name - only its name matches, so its LEI has to be confirmed.

Recognised providers carry a badge on their page and in the list, and count in the Article 29 assessment. Under Article 42, a competent authority may require you to suspend the use of a CTPP's service or terminate the contract. The readiness view in /ri/ checks, for each CTPP you use, what that would need: an exit plan, a successful test of it, a transition period, alternatives identified, data return, termination rights confirmed in the Art. 30 review, and a notice period.

The list is reference data shipped with the application and updated with each new ESA list.

Incidents involving a provider (Art. 18-19)

Each third-party incident (/ti/) can be classified under Delegated Regulation (EU) 2024/1772:

• the criteria and thresholds (clients, counterparts and transactions, reputational impact, duration and downtime, geographical spread, data losses, economic impact) and the major verdict with its legal basis;
• recurring incidents, which can be major together (Art. 8(2));
• the deadlines of the initial notification, intermediate report and final report under Delegated Regulation (EU) 2025/301, with what was sent and when;
• report drafts laid out as the templates of Implementing Regulation (EU) 2025/302, to transcribe into your authority's channel.

Incidents internal to the entity, with no provider involved, are outside the platform's scope.

GDPR - processors and sub-processors

When a provider processes personal data on your behalf, the contract page records the processor agreement (GDPR Art. 28): its Art. 28(3) clauses (a) to (h), the sub-processors with their authorisation regime and objection period (Art. 28(2) and (4)), and transfers outside the EEA with their mechanism (adequacy decision, standard contractual clauses, binding corporate rules). Sub-processors can be imported from the DORA subcontracting chain.

Article 30 - key contractual provisions

The Article 30 checklist (/a30/) verifies the mandatory clauses:

• 30(2) - all contracts: service description, subcontracting conditions, data location, data protection, data access & recovery, incident support, cooperation with authorities, termination rights, security training.
• 30(3) - critical/important functions: business continuity, participation in TLPT, audit rights, exit strategy.

The contract record itself carries the 30(2)/(3) specific fields (notice periods, applicable-law country, data storage & locations, data sensitivity, dependency level, termination reason) that populate template B_02.02.

Controlled vocabularies

Every typed register field uses a DORA 4.0 controlled vocabulary so the export carries regulator-recognised codes: