Germany: Key Insights into BaFin’s Approach to the Information Register Under DORA and Potential Double Reporting

On 15 January 2025, the German Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht – “BaFin”) published a comprehensive article on the new information register required under Article 28 (3) of Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act – “DORA”). The information register (further referred to as the “Information Register”) shall include all agreements with third-party providers supplying Information and Communication Technology (“ICT”) services to the financial institution. The article outlines practical steps that financial institutions under BaFin’s supervision should follow regarding the Information Register required under DORA, as well as addressing potential double reporting.

Our Key Takeaways

Start Now: Prepare Your Information Register

DORA entered into force on 16 January 2023 and applies as of 17 January 2025. Financial institutions should begin compiling information for their Information Registers now. The Information Register must include all agreements with ICT third-party service providers, including subcontractors involved in delivering critical ICT services. Financial institutions should ensure the Information Register is complete and regularly updated.

Deadline for Submission: 11 April 2025

Financial institutions under BaFin’s supervision are required to submit their Information Registers to BaFin by 11 April 2025 at the latest. BaFin is actively assisting financial institutions with questions, offering guidance on the new Information Register and providing information on when to submit the register on its website.

Submission Process: Using BaFin’s MVP Platform

The submission of the Information Register will be conducted through BaFin’s reporting and publication platform (Melde- und Veröffentlichungsplattform – “MVP”). All financial institutions must activate individual users for DORA-related reporting (Fachverfahren „Digital Operational Resilience Act (DORA)“). BaFin has already contacted all financial institutions under its supervision in recent months regarding this process and has published additional information on its website. The Information Registers must be submitted as a structured file in accordance with the European Supervisory Authorities’ (“ESA”) taxonomy. BaFin has published an Excel template to be used for the reporting and to facilitate compliance.

Potential Double Reporting: Material Outsourcing and Use of ICT Services for Critical Functions

BaFin also addressed the potential for double reporting; the use of ICT services for critical functions are likely to be considered as material outsourcing, which could lead to double reporting. To prevent double reporting and alleviate industry burdens, BaFin announced that it will amend the MVP procedure for “Outsourcing Notifications,” which has been in use since late 2022. BaFin is revising the form and expects it to be available by the second quarter of 2025. The new form will be aligned with the current outsourcing notification regulations and supplemented with a DORA-specific field. Financial institutions with dual reporting obligations should prioritise reporting outsourcing agreements and check the DORA box to confirm that both reporting requirements have been met. Between the implementation of the new DORA notification requirement and the update of the MVP form, financial institutions should continue reporting planned outsourcing agreements via MVP and add the DORA notification once the form is updated. BaFin plans to host workshops to clarify the new MVP form.

Regulatory Compliance Roadmap

To read the full BaFin article, visit BaFin Article on Information Register and Reporting Obligations: Identifying Concentrations in IT Services (Informationsregister und Anzeigepflichten: Konzentrationen bei IT-Dienstleistungen erkennen). Please note that the report is only available in German.

How can Zeidler help?

Zeidler Group is here to assist with any questions or support you may need regarding the Information Register and DORA in general, ensuring compliance with both European and German legal and regulatory requirements. We can help you navigate the complexities of regulatory compliance under DORA.

Our dedicated team of professionals is well-versed in DORA and BaFin reporting requirements and standards.

We can assist you in aligning your compliance framework with the expectations outlined by DORA. If you need further information or assistance, please feel free to reach out to us.