What to prepare
Know what information, identifiers, and documents to gather across your entity, providers, and contracts before you start entering data into Copla Registry.
Topics covered on this page
Reporting entity information
Gather your entity's legal registration name, regulatory classification, group position, and the identifier — LEI or EUID — used to identify the entity.
You will also need the country of registration, total assets value from the latest annual financial statements, and the date your entity began formally registering ICT third-party providers.
If your entity is part of a group, identify its position in the hierarchy and the LEI of the direct parent. List any subsidiaries that are financial entities in scope of DORA.
→ See Company details.
Branch information
If your entity has branches, gather the legal name, identifier code, and country of registration for each one. If your entity has no branches, no preparation is needed here.
→ See Branches.
Function information
Identify the functions of your entity that are supported by ICT third-party services.
For each function, gather its internal name, a criticality assessment outcome, and — if the function is critical or important — the date that assessment was last performed, the reason for the assessment, and the recovery time and data loss limits in hours.
Functions must exist in the register before you can assign them to contracts. Define your complete function list before you start entering contracts.
→ See Functions.
Intra-group arrangement information
If your entity uses ICT services provided by another entity within its corporate group, identify those arrangements before entering external provider contracts.
For each one, you will need the contract reference and a decision on whether to include it in the DORA register.
If your entity has no intra-group ICT arrangements, no preparation is needed here.
→ See Arrangements.
Provider information
For each ICT third-party service provider, gather the legal registration name, identifier, registered headquarters country, legal entity type, annual cost across all contracts with this provider combined, and the ultimate parent company's name, identifier, and headquarters country.
→ See Add/Edit Providers.
Contract information
For each contract, gather the internal contract reference, arrangement type, ICT service type, contract dates, notice periods for both sides, governing law country, the business function it supports, data storage and processing countries, whether an exit plan exists, and the annual cost for this specific contract.
If one contract covers multiple functions, ICT service types, or data locations, identify these cases in advance — each combination requires a separate entry.
→ See General Information and Specific Information.
Supporting documents
Gather direct URLs for the following documents where they exist:
-
The ICT service contract
-
Risk assessment
-
Latest information security or penetration test report
-
Provider business continuity plan
-
Provider information security policy
-
Provider disaster recovery plan
-
Provider privacy policy
-
Provider subcontractor list
If a document does not yet exist, no preparation is needed — leave that field empty when you reach it.
→ See Documents.
Required identifiers
For your reporting entity, an LEI is required.
For ICT providers established in the EU, an LEI or EUID is required.
For providers established outside the EU, an LEI is required.
If an LEI is genuinely unavailable for a provider, identify this in advance — you will need to use an alternative identifier and the entry will be flagged as a data quality issue.
Confirm the identifier status for each entity and provider before you start entering data. Missing or incorrect identifiers are the most common cause of validation errors.
→ See When an identifier is not available (What to do when information is missing).
Dates, costs, and reporting values
Before entering data, confirm the currency used in your entity's financial statements, the total assets value from the latest audited annual financial statements, the annual cost per provider across all their contracts combined, and the annual cost per contract for the most recent full financial year.