What the primary record establishes

DORA Article 28(3) requires covered financial entities to keep a register of contractual arrangements for third-party ICT services. It distinguishes arrangements supporting critical or important functions. The implementing regulation sets standard templates. DORA Article 28 ↗ EU Implementing Regulation 2024/2956 ↗

What the distinction changes

One provider may host both a public fee page and the infrastructure used for client orders. A list of suppliers alone cannot identify which activity an outage will interrupt. Connect the service to the using entity and supported function.

What to check before drawing a conclusion

Update the register when the dependency changes, such as after a data-center move or a change of backup connectivity provider. In a group, the company signing the contract and the entity using the service can differ, even when payments are centralized.