Free tool · runs in your browser

Validate your DORA Register of Information
before your supervisor does

Drop the xBRL-CSV zip you are about to submit. We run the EBA technical checks, the DPM business rules and the LEI checksum on all 15 templates and show every finding with template, row and column. The file never leaves your browser.

ITS (EU) 2024/2956 · EBA DPM 4.0 No upload: client-side only Results in seconds

Drop your RoI package here

A .zip named LEI.IND|CON_CC_DORA010100_DORA_yyyy-mm-dd_timestamp.zip, or one or more b_xx.xx.csv files.

Privacy by design: parsing and validation run in this tab with JavaScript. No file content is sent anywhere — you can verify this in your browser's network panel.
Show:

Stop fixing CSVs by hand

DORA GRC keeps the register as structured data — entities, arrangements, providers, functions, supply chains — and generates the submission package with the same validator built in, so every export is checked before you download it.

Start free 14-day trial

What the validator checks

The rule codes are the ones the ESAs return in their feedback files, so you can match findings to the EBA guidance one to one. Errors are checks that lead to rejection; warnings are data-quality findings the file is accepted with.

Package structure103 root folder equals the zip name, only META-INF/ and reports/; 105 file-name convention; 701 report.json, parameters.csv, FilingIndicators.csv present; 720 only lower-case b_xx.xx.csv table files.
parameters.csv & filing indicators723 header is exactly name,value; 714 entityID matches the file name; 320 refPeriod; 702–705 and 808 all 15 templates declared true.
Column headers801 every header is a column the DPM defines for that template (lower case, c0010…, special c0031 in B_03.03, 10 columns in B_06.01); 802 no column twice; 809 rows match the header.
Keys805 key columns never empty; 806 no duplicate keys; 807 every foreign key exists in the template that defines it — arrangement references, provider codes, function identifiers, entity LEIs, ultimate parents, the supply chain.
Values and codes503 closed-list values from the EBA drop-down lists (eba_GA:, eba_CU:, eba_TA:, eba_CT:, eba_ZZ:, eba_BT:, eba_qCO:) with hints when you used a bare ISO code; 330 dates; 331 integers; 332 booleans; 305 numerics; 306 UTF-8 without BOM.
LEI and business rules20-character format and ISO 17442 checksum (the part of VR_2/12/23/71/77 that can be checked offline); EUID shape; e23xxx_e mandatory columns and v88xx_m conditional rules, including the ones the EBA deactivated in March 2025, shown as hints.

Frequently asked questions

What format does the Register of Information have to be submitted in?
A zip file named {LEI}.{IND|CON}_{country}_DORA010100_DORA_{reference date}_{timestamp}.zip. Inside: one root folder with the same name, META-INF/reportPackage.json, and reports/ with report.json, parameters.csv, FilingIndicators.csv and one plain CSV per template, b_01.01.csv to b_99.01.csv, all lower case. Columns are coded c0010, c0020, …; closed-list values use eba_ codes (eba_GA:NO, eba_CU:EUR, eba_TA:S17); dates are yyyy-mm-dd; booleans are true/false in lower case; everything is UTF-8 without BOM.
Why do registers get rejected?
Foreign-key violations (807) top the ESAs' list: a reference in B_07.01, B_02.02 or B_05.02 that is not a key in B_02.01 or B_05.01, a subsequent arrangement whose overarching reference is missing, or an ultimate parent in B_05.01 c0110 that is not listed as its own row. Next come empty keys (805), filing indicators not all true (808), wrong file names (720), an entityID that does not match the file name (714), a wrong folder structure (103) and column codes the taxonomy does not know (801). A file with a BOM or a trailing comma in the header will fail on many rows at once.
Does this tool upload my register?
No. The zip or CSV files are opened and checked by JavaScript in this tab. Nothing from the file is sent to a server; the only network request the page makes after loading is the optional e-mail form, which carries your e-mail address and the summary counts.
Is a clean result the same as acceptance by my NCA?
A clean result means the package is structurally correct under the public EBA checks, DPM rules and LEI checksum. The ESAs additionally look LEIs up in GLEIF and EUIDs in BRIS, and some authorities run their own content checks. Treat a clean run as the necessary first step, not as proof of acceptance.
What are the reference date and deadline for the next collection?
The collection is annual: reference date 31 December, ESA backstop 31 March. The next collection (2027) reports as at 31 December 2026, ESA deadline 31 March 2027; each NCA sets an earlier cut-off — Finanstilsynet (Norway) used 13 March in 2026 via e-Reg and will publish the 2027 date; CSSF (Luxembourg) accepted files 11 February–31 March 2026 via eDesk. The EBA's reporting framework 4.4 (final package September 2026) carries minor technical amendments to the DORA module; this validator implements DPM 4.0 (DORA010100) and will be updated when the 4.4 DORA module is final.
Which templates are there?
B_01.01 entity maintaining the register · B_01.02 entities in scope · B_01.03 branches · B_02.01 arrangements (general) · B_02.02 arrangements (specific) · B_02.03 intra-group arrangements · B_03.01 entities signing for receiving services · B_03.02 providers signing · B_03.03 intra-group providers signing · B_04.01 entities making use · B_05.01 ICT third-party providers · B_05.02 supply chains · B_06.01 functions · B_07.01 assessment of the ICT services · B_99.01 definitions. All 15 must be declared in FilingIndicators.csv even when a table is empty.
Register of Information guideWhat Art. 28(3) requires and how the 15 templates fit together. ICT third-party risk managementArrangements, subcontracting, exit plans and concentration risk under DORA. Free DORA readiness assessment25 questions across the five pillars, scored instantly. DORA GRC platformRegister, contracts, incidents, testing and the xBRL-CSV export in one place.