3 Steps to obtaining an LEI for ICT Providers under DORA

The Digital Operational Resiliency Act (DORA) comes into force in January 2025. The scope of DORA is undeniably wide, however the requirement on ICT Third Party Providers to obtain a Legal Entity Identifier (LEI) is unambiguous. 

The regulatory scope does not clarify whether the responsibility of securing the LEI falls on the regulated entity, ot the ICT provider itself. In the lack of clear regulation the accountability should be taken by the regulation financial services firm operating under the scope of DORA. 

Here is a simple three step plan to searching, obtaining and uploading LEIs for your providers.

---

How to get a DORA LEI for ICT providers:

1. Identify the providers that require an LEI. Conduct an LEI check for to locate a) their LEI or b) absence of one. Use the watchlist tool to save all of the LEI codes. For a bulk check contact us.
2. Identify the required absent LEIs. Begin the bulk/single application for an LEI under DORA here. Once the application is made and payment is complete the LEI will be uploaded to your platform. You may assume the small cost of €89, or pass to the ICT provider. 
3. Once your new LEIs have been uploaded your My LEIs portal or you have filled the LEI watchlist, download an .xlsx file with all of your LEIs which is DORA ready. These can then be uploaded, or downloaded at any time. Finally, DORA stipulates the LEI must be "valid", ensure to renew the LEI annually. 

Register a new LEI

LEI SEARCH TOOL

USE LEI WATCHLIST

As part of DORA, the Regulation (EU) 2022/2554 on digital operational resilience in the financial, a Technical Implementation Standard has been published in draft status, which recommends ICT service provider identification via a valid Legal Entity Identifier (LEI) for financial entities.

The "Final Report on Draft ITS on Register of Information"
outlines implementing technical standards (ITS) for the register of information templates regarding contracts for the use of ICT services by third party providers in the financial sector. 
The ITS stipulates that the regulated entities must maintain detailed records about their contracts with third party ICT providers at the following levels levels: individual, sub-consolidation and consolidation level. This information is then populated to the Register of Information using templates to encourage standardization.

The LEI code is a globally standardised, publicly available and highly utilised compliance instrument that financial instutions will be familiar with. The LEI accomplishes the goal of identifying the exact entity within a corporate structure the contract has been made with, while also being renewable annualy.

In order to find out more information please see the following links for information on DORA and the LEI:

• https://eur-lex.europa.eu/eli/reg/2022/2554/oj
• https://www.esma.europa.eu/sites/default/files/2024-01/JC_2023_85_-_Final_report_on_draft_ITS_on_Register_of_Information.pdf
• https://www.youtube.com/watch?v=twKfs69O9Uo&t=4s