How to report intra-group ICT service providers in your register of information

when a group entity purchases ict services and provides them to your financial entity, your reporting approach depends entirely on whether you report individually or at consolidated level this distinction fundamentally changes how you structure your register of information the problem same setup, different reporting consider this common scenario group holding owns 100% of financial entity group holding contracts with external cloud provider for cloud infrastructure services and makes these services available to financial entity how do you report this arrangement in your register of information? the answer depends on your reporting level individual reporting group holding outside reporting scope when financial entity reports individually, group holding falls outside your organization perspective but is included in your ict provider landscape this distinction shapes how you populate templates across both perspectives your organization perspective (templates b 01 and b 02) template b 01 02 contains only financial entity group holding is not included because individual reporting captures only the reporting entity itself, as stated in https //www eba europa eu/activities/direct supervision and oversight/digital operational resilience act/preparation dora application template b 02 01 lists one contractual arrangement the contract between financial entity and group holding this is the only direct contract relevant to financial entity template b 02 03 remains empty according to the instructions for b 02 03, this template links intra group contractual arrangements only when the intra group provider appears in template b 01 02 since group holding is not in b 01 02, no linking occurs here ict provider landscape (templates b 05) template b 05 01 lists group holding as an ict service provider alongside the external provider group holding (as intra group service provider at rank 1) external cloud provider (as subcontractor at rank 2) ultimate parent undertakings for group holding if group holding is itself the ultimate parent, its own identification code is repeated in the ultimate parent fields per https //www eba europa eu/activities/direct supervision and oversight/digital operational resilience act/preparation dora application for external cloud provider its ultimate parent undertaking group holding appears in b 05 01 because it falls outside the organization scope defined in b 01 02 from the ict landscape perspective, group holding is treated as an ict service provider template b 05 02 shows the supply chain structure group holding rank 1 (direct provider to financial entity per https //eur lex europa eu/legal content/en/txt/html/?uri=oj\ l 202402956 ) external cloud provider rank 2 (subcontractor to group holding per https //eur lex europa eu/legal content/en/txt/html/?uri=oj\ l 202402956 ) the contract between group holding and external cloud provider does not appear in template b 02 01 under this interpretation, as group holding falls outside the b 01 02 scope individual reporting structure financial entity (reporting entity) ↓ \[contract in b 02 01] group holding (rank 1, intra group provider) ↓ \[not in b 02 01, tracked via b 05 02] external cloud provider (rank 2, subcontractor) consolidated reporting group holding inside reporting scope when group holding reports at consolidated level on behalf of financial entity, the reporting structure changes completely group holding now falls inside your organization perspective and moves out of your ict provider landscape this fundamental shift reverses how you populate templates across both perspectives your organization perspective (templates b 01 and b 02) template b 01 02 now contains both group holding and financial entity, showing their parent subsidiary relationship via field b 01 02 0060 template b 02 01 includes two contractual arrangements contract between financial entity and group holding contract between group holding and external cloud provider both contracts appear in b 02 01 because https //www eba europa eu/activities/direct supervision and oversight/digital operational resilience act/preparation dora application explicitly states that both the intra group contract and the external contract should be reported template b 02 03 links these two contracts b 02 03 0010 contract reference financial entity ↔ group holding b 02 03 0020 contract reference group holding ↔ external cloud provider this linking enables traceability of how ict services flow through the group structure, as explained in https //www eba europa eu/activities/direct supervision and oversight/digital operational resilience act/preparation dora application ict provider landscape (templates b 05) template b 05 01 now lists only the external provider external cloud provider (as subcontractor at rank 2) ultimate parent undertaking of external cloud provider group holding no longer appears in b 05 01 because it is now part of the reporting organization itself (included in b 01 02) the shift from individual to consolidated reporting moves group holding from the ict landscape perspective (b 05 01) to the organization structure perspective (b 01 02) template b 05 02 shows a simplified supply chain structure external cloud provider rank 1 (now the direct provider to the consolidated group) the ranking changes because group holding is no longer counted as an ict provider in the supply chain external cloud provider becomes rank 1 as it is the direct external provider to the reporting organization consolidated reporting structure group holding (in b 01 02, part of organization) ↓ \[internal service provision] financial entity (in b 01 02) group holding (no longer in b 05 01) ↓ \[contract in b 02 01, linked via b 02 03] external cloud provider (rank 1, only external ict provider in b 05 01) key insight b 01 02 determines the perspective shift the presence or absence of group holding in template b 01 02 determines a fundamental shift in how you view your organization when group holding is not in b 01 02 (individual reporting), group holding is treated as an ict service provider in the ict landscape (b 05 01) you report only your direct contract in b 02 01 and track group holding as rank 1 in the supply chain through b 05 02 when group holding is in b 01 02 (consolidated reporting), group holding becomes part of your organization structure and no longer appears in b 05 01 you report both the internal arrangement and the external contract in b 02 01, link them via b 02 03, and track only external cloud provider in b 05 01 as rank 1 the critical shift group holding moves from being an ict supplier (outside organizational scope) to being part of the organization itself (inside organizational scope) this distinction follows from the https //eur lex europa eu/legal content/en/txt/html/?uri=oj\ l 202402956 definition of direct ict third party service provider and the consolidation instructions in template b 01 02 where to find official guidance the reporting requirements for intra group arrangements are specified in https //eur lex europa eu/legal content/en/txt/html/?uri=oj\ l 202402956 https //eur lex europa eu/legal content/en/txt/html/?uri=oj\ l 202402956 https //www eba europa eu/activities/direct supervision and oversight/digital operational resilience act/preparation dora application access the latest technical package and faq updates through the https //www eba europa eu/activities/direct supervision and oversight/digital operational resilience act/preparation dora application