> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7098-scope-of-register-of-information-for-contractual-arrangement.md). # Scope of Register of Information for Contractual Arrangem... | | | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Authority** | EBA | | **Q\&A ID** | EBA\_QA\_2024\_7098 | | **Topic** | ICT third-party risk management | | **Legal basis** | [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles) DORA | | **Status** | Final Q\&A | | **Published** | 25/07/2025 | | **Submitted** | 29/05/2024 | | **Answer prepared by** | Answer prepared by the Joint ESAs Q\&A | | **Source** | [EBA Q\&A](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2024_7098) | ## Question According to [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles) of DORA, must an EU parent bank, which has subsidiaries both within and outside the EU, maintain the register of information regarding all contractual arrangements for the use of ICT services only for subsidiaries that are subject to DORA (financial entities established in the EU), or does this requirement extend to subsidiaries established outside the EU for which DORA does not apply? ## Background [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles) of DORA requires financial entities, as part of their ICT risk management framework, to maintain and update a register of information regarding all contractual arrangements for the use of ICT services provided by ICT third-party service providers at the entity level, and at sub-consolidated and consolidated levels. The bank seeks clarification on whether the EU parent bank must maintain this register only for subsidiaries based in the EU that are subject to DORA, or also for subsidiaries based outside the EU for which DORA does not apply. If the parent bank were required to maintain the register for subsidiaries based outside the EU, it would face several challenges. These include increased administrative burden and complexity in managing compliance across different regulatory regimes. In these non-EU countries, ICT service providers are not bound by DORA, which adds another layer of complexity. ## Final answer Answer already provided as part of the frequently asked questions (FAQ) about the preparation and the reporting of the registers of information of contractual arrangements with the ICT third-party providers that financial entities need to maintain in accordance with [Article 28(3)](https://www.mica.wtf/dora/digital-operational-resilience-act/chapter-v-managing-ict-third-party-risk/article-28-general-principles) of Regulation (EU) 2022/2554 (DORA) and as specified in the Commission Implementing Regulation (EU) 2024/2956 (ITS on the registers of information). The scope of the registers of information held at the sub-consolidated and consolidated basis should reflect all financial entities and their branches that belong to their consolidation scope in accordance with both Directive 2013/34/EU and the relevant sectorial Union legislation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/eu-level/q-and-a/eba-qa-2024-7098-scope-of-register-of-information-for-contractual-arrangement.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.