The DORA register

If you’re a regulated financial entity, DORA requires a Register of Information about your ICT third-party providers and the contracts behind them. Regixo drafts the parts it can trace from your data map and marks the rest — contract and vendor facts a scanner can’t know — as yours to supply.

Declare DORA scope when you scan (or turn it on later):

$ regixo start --dora

Regixo asks whether you’re a financial entity, then drafts the register alongside the RoPA. Re-generate any time with regixo report --dora.

The 15 tables

The Register of Information is a fixed set of templates. Three of them start from your map — B_05.01 and B_99.01 auto-filled, B_07.01 in part; the other twelve are contract and vendor facts you provide.

The register arrives with all 15 sections on one page, each badged auto-filled / partly auto / needs you. Four of them are below — one per badge state. Reading needs no account: a cell you would have to fill reads sign in to fill, a call only an approver may make reads sign in to rule, and an empty table reads No rows yet — sign in to add.

What Regixo fills, and what it can’t

The map can trace ICT providers — a Stripe integration, a managed warehouse — so Regixo seeds B_05.01 with candidate providers (name, a service-type guess, and country from the source region), starts B_07.01 (service + provider), and fills B_99.01 (the standard definitions). Everything a scanner can’t see — contract references, dates, values, LEIs, subcontractors, functions — is marked needs you. You forward an honest, mostly-empty register; you’re not the bottleneck.

Filling the tables

Three surfaces fill the register — pick whichever fits the row:

$ regixo dora import B_02.01 contracts.csv

Here is the portal register surface itself — B_05.01 mid-fill. Auto-started rows carry quiet auto markers; the details a scanner can't see are inline add… boxes; the in/out-of-scope ruling is approver-only:

An upload never saves straight away — it lands on a preview so you can check each row before you commit it:

However you fill it: CSV headers match either the column IDs or the human column labels (case-insensitive); the first cell of each row is the row key; unknown columns are surfaced back to you, never silently dropped.

Ruling a provider in or out of scope

Whether a provider is an “ICT third party” under DORA is a legal judgment, so Regixo’s auto-started B_05.01 rows begin as candidates. You rule on each:

$ regixo dora set B_05.01 <rowKey> inScope confirmed
$ regixo dora set B_05.01 <rowKey> inScope excluded

Excluded rows are left out of the filing; candidates you haven’t ruled on are flagged.

LEIs

An LEI (Legal Entity Identifier) is 18 alphanumeric characters plus 2 check digits (ISO 17442). Regixo validates the checksum (mod-97-10), so a plausible-looking but invalid code — including all-zeros — is rejected at entry. Look providers up at the GLEIF register if you don’t have theirs.

How complete the package is — honestly

The regulation’s templates have more columns than Regixo models. Every export carries a structural coverage report — “this package models X of Y principal columns for each table” — so you (and your authority) are never told the package is more complete than it is.

The submission package

When the register is filled and signed, regixo dora export builds the EBA report package: a META-INF/ manifest, a reports/ folder with the report descriptor, a parameters.csv and a FilingIndicators.csv, one DPM-coded CSV per template (needs-you cells written empty), and a README that states the filing boundary — plus the seal.