DORA reporting process

The Digital Operational Resilience Act (DORA) shall apply as from the 17^th of January 2025 and with its implementation financial entities take onboard and make effective all requirements imposed by DORA.

One of such requirements is the Register of Information (hereinafter “RoI”) and in light of this the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA), and the European Securities and Markets Authority (ESMA), collectively referred to as the European Supervisory Authorities (ESAs) have conducted a dry run exercise to allow for the testing of the reporting processes in an environment designed to mimic the first iteration of the official reporting in 2025.

Following the completion of this exercise, the ESAs have drawn a summary to analyse the findings and allow the improvement of data quality whilst preparing financial entities and competent authorities for the official reporting which will soon be in place.

An objective which this exercise aimed to achieve was to test the reporting process and the accuracy of such testing; this was done by virtue of allowing the financial entities to carry out this exercise on a best-effort basis meaning that they are to submit the RoI based on the draft templates and guidelines provided by the ESAs.

1039 financial entities participated in this exercise, spread over the 27 Member States. The entities involved were also diverse with the participating entities being credit institutions, insurance/reinsurance undertakings, investment firms, and electronic money institutions.

The generated results out of the registers which passed the data integration checks yielded a small number of registers which successfully passed all data checks; however, over half of the remaining registers had less than 5 failed data quality checks.

The most frequent issues were:

1. missing mandatory information – which was to be expected considering that this exercise was being conducted on a best effort basis;
2. use of an invalid Legal Entity Identifier (LEI) codes – results yielded the conclusion that there were more incorrect LEI references for financial entities than for third party service providers; and
3. invalid Data Point Model (DPM) value.

One of the lessons learnt by the ESAs was on the required improvement in the data validation process to be applied in the official reporting. Hence, why the data quality assurance process will be designed in 2 main stages:

1. The technical layer – whereby in this stage of assessment, and prior to the data being integrated to the EBA’s systems, there will be an assessment over the data received and submissions not respecting these technical checks will be rejected; and
2. The validation layer – whereby data quality checks include DPM automatic, business, and data model checks, along with external validation. Errors will be flagged to submitters, who must correct and resubmit within the specified timeline.

On the other hand, financial entities are to acknowledge and be aware that submitting registers with missing information will result in rejections; it is thus crucial that financial entities adopt robust systems to comply with such requirements.

The recommendations being made to the financial entities following this dry run exercise are:

1. to further familiarise themselves with the Implementing Technical Standards (ITS);
2. to ensure that all third-party service providers and related entities are correctly identified in accordance with their respective LEIs; and
3. to be prepared to convert their data into the required formats for reporting purposes.

The exercise aimed to successfully prepare stakeholders for the DORA reporting process. The feedback shared will surely be of help to financial entities and authorities to address deficiencies before official reporting begins in 2025.

For any information or assistance, please contact our team at info@gtg.com.mt

Author: Neil Gauci