A register accepted last year may be rejected this year.
Those are the CSSF's words, February 2026.1 The validation checks did not change — they now apply to more fields. RegisterProof runs your register against the published ESA rules and hands back the rejection list your competent authority would send you, keyed to the template, the column and the row.
No system access. No OAuth. Deleted on request.
Sample output is illustrative. Rule IDs follow the ESAs' DOR_#### convention; the templates, columns and failure categories are the ones the ESAs name.45
Failure anatomy
Your register does not fail on judgment.
It fails on empty cells.
The ESAs published the breakdown.5 Two templates account for the overwhelming majority of missing mandatory information — and within them, a handful of named columns.
ESA_2024_35
§§ 30–33
| Template | Where it goes wrong | Share of missing |
|---|---|---|
| B_02.02 | Contractual arrangements — specific information. provider code type c0030 · provider code c0040 · function identifier c0050 · ICT service type c0060 | 60%5 |
| B_05.01 | ICT third-party service provider. head-office country c0050 · ultimate parent code c0080 · parent code type c0090 | 17%+5 |
| others | Spread across the remaining 13 templates. | the rest |
Identifiers are the second front
LEI validity for your own entity is checked against the GLEIF register.4 Provider and parent codes matter more than they look: they drive the critical ICT third-party provider designation,3 which is why the ESAs singled them out.5
None of it is interpretive
Every one of these is a deterministic check against a published rule. Worst register in the dry run: close to 50,000 failing data points. The most distinct checks failed by a single entity was 43 of 116.6
Since the dry run
The register stopped being a form and became supervisory input
The 2024 dry run was voluntary and best-effort. Two mandatory cycles have run since, the ESAs have used the data, and the bar has moved.
primary
sources
“A register of information which was accepted last year, may be rejected this year.” CSSF, February 2026 — the checks did not change; they now apply to more data fields
- Dec 2024 The ESAs publish the dry-run findings: 6.5% of 947 processed registers pass all 116 data-quality checks; 86% of errors are a mandatory field left empty. ESAs · ESA_2024_35
- Apr 2025 First mandatory cycle. Competent authorities report their registers to the ESAs by 30 April 2025. ESAs · collection timeline
- Nov 2025 The ESAs designate the first critical ICT third-party providers. “First, the ESAs collected data from the Registers of Information maintained by financial entities.” Your provider and parent codes are what that designation runs on. EBA · EIOPA · ESMA · 18 Nov 2025
- Feb 2026 The CSSF opens the window and warns that the same validation checks now run against more data fields — and that last year's acceptance is not a defence. Scope widens to third-country branches. CSSF · 11 Feb 2026
- Mar 2026 Two weeks before the deadline, only 40% of entities required to file with the CSSF had done so. The regulator urges entities to submit early “so that potential issues can be addressed in a timely manner.” CSSF · 17 Mar 2026 · Luxembourg figure, not EU-wide
- Next cycle Registers are reported by competent authorities to the ESAs by 31 March of each calendar year. Your own window opens earlier and is not the same everywhere — in 2026 the CSSF's entity deadline was 31 March; DNB's was 20 March. Whether you file in full this cycle is also a question for your authority.108 CSSF · 11 Feb 2026 · DNB · 3 Feb 2026
Method
Find out before your NCA does
Three steps. No integration, no access to your systems, nothing for your security team to review.
5 business days
-
Send the register you already have
Excel, CSV, or a full xBRL-CSV report package. If your register is still a spreadsheet a consultant handed you, that is exactly the input we want.
-
We run the published checks
Structural and naming checks first — the layer that discarded 92 submissions outright4 — then the data-quality rules, LEI validity against GLEIF, and the relational keys between templates.
-
You get a fix list, not a score
Every finding names the template, the column, the row and the rule it breaks. Forward it to whoever owns that contract and it closes.
The offer
A dry run of your register, by hand, before you file
You send the register you intend to submit. You get back every finding the published ESA checks would raise.
1 register
1 entity
1 cycle
- 01Findings in 5 business days, each naming the template, the column, the row and the rule it breaks.
- 02Structural checks first — naming and packaging, the layer that discarded 92 of 1,039 submissions before a single value was read.4
- 03LEI and identifier validation for your entity and every ICT provider, including the parent-undertaking codes the ESAs flagged as most often missing.5
- 04Relational keys across templates — the references between B_02.02, B_05.01 and B_06.01 that must resolve before anything else is judged.
- 05Any format. Excel, CSV, or a full xBRL-CSV package.
No system access. No OAuth. Deleted on request.
Redact anything you like — commercial terms, spend, contract references. The checks run on identifiers, codes and completeness, not on what you pay your providers. Your file goes to no one else and is deleted on request.
Alternatives
Three ways to learn your register is wrong
Only one of them happens while you can still do something about it.
| RegisterProof | Submit and wait | Advisory engagement | |
|---|---|---|---|
| When you find out | Whenever you ask, as many times as you want | After your NCA validates, inside a fixed window9 | After scoping, procurement and a kickoff |
| What you get | Template, column, row and rule ID for every finding | A feedback file, and a resubmission to turn around | A populated register, and the same problem next year |
| Cost to try | €750, credited to year one. One file, no onboarding | Your remaining days before the deadline | A budget line you defend before anyone reads a cell |
In scope
Everyone in this table files a register
The ESAs have not published a breakdown by entity type for either mandatory cycle. This is the most recent one that exists — and it is from the 2024 dry run. It is here for scope, not for currency.7
| Type of financial entity | Submissions | Data points | Error rate |
|---|---|---|---|
| Credit institutions | 260 | 2,931,767 | 1.9% |
| Insurance & reinsurance undertakings | 225 | 2,935,579 | 3.3% |
| Investment firms | 122 | 248,988 | 2.4% |
| Asset management companies | 86 | 209,306 | 1.0% |
| Payment institutions | 50 | 63,318 | 3.0% |
| Managers of alternative investment funds | 40 | 90,016 | 1.2% |
| Institutions for occupational retirement provision | 36 | 344,283 | 3.0% |
| Electronic money institutions | 30 | 42,320 | 2.5% |
| Insurance & reinsurance intermediaries | 17 | 49,906 | 2.8% |
| Central securities depositories | 7 | 38,150 | 1.2% |
Ten entity types with the highest number of data points submitted.7 The dry run was voluntary and best-effort, so these are not a census of entities in scope and the error rates are not a verdict on any sector today. We publish them because they are the only figures of their kind an authority has put out — and we would rather date them plainly than dress up something newer that nobody published.
References
Every number on this page, and where it came from
We publish no regulatory value we have not verified at the source. Where a value depends on your competent authority, we say so rather than guess.
8 verified
2 deferred
- Verified“A register of information which was accepted last year, may be rejected this year” · the checks are unchanged but apply to more data fields · 2026 reference date 31 December 2025
- Verified“As of 16 March, only 40% of financial entities required to submit their register of information to the CSSF have done so”CSSF, DORA — Register of Information collection — Update, 17 March 2026. This is a Luxembourg figure. We have not found an equivalent EU-wide number published by any authority, so we do not present one.
- VerifiedThe ESAs designated the first critical ICT third-party providers using register data: “First, the ESAs collected data from the Registers of Information maintained by financial entities”EBA, EIOPA and ESMA, The European Supervisory Authorities designate critical ICT third-party providers under DORA, 18 November 2025
- Verified6.5% passed all checks · 93.5% had at least one failure · 116 checks · 1,039 received, 92 discarded, 947 processed
- Verified86% of errors were missing mandatory information · B_02.02 accounted for 60% of it · B_05.01 for over 17%ESAs, ESA_2024_35, §§30–33
- VerifiedWorst register ~50,000 failing data points · most distinct checks failed by one entity: 43 of 116 · 235,000+ failed checks over 9,275,000 data pointsESAs, ESA_2024_35, §§26–28
- VerifiedThe register templates, fields and submission formatCommission Implementing Regulation (EU) 2024/2956, and the EBA's DORA reporting preparation materials, which publish the applicable validation rules
- VerifiedEntity deadlines are not uniform: for the 2026 cycle the CSSF's was 31 March and DNB's was 20 March. DNB also accepts a standardised Excel template it converts to xBRL-CSV.De Nederlandsche Bank, Reporting DORA registers of information in March 2026, 3 February 2026, read against the CSSF's window
- Confirm with your NCAYour submission window and channelEntity-level deadlines, portals and packaging are set by each competent authority and differ across member states. We will not print a date for your jurisdiction that we have not read on your NCA's own page.
- Confirm with your NCAWhether you file in full this cycleSome authorities have applied proportionality between cycles, with reduced or confirmatory submissions for entities without material change. Check your NCA's guidance for the current reference date.
Who is doing this
A person reads your register. That is the point.
review
Bitgen Labs
Tier2Flow
ForwardCerts
- Nothing to onboard
- No connector, no OAuth scope, no read access to a production system. One file, reviewed, returned. There is no integration for your security team to assess because there is no integration.
- Nothing retained
- Your register is read, the findings are written, and the file is deleted on request. It is never pooled, never used to train anything, never shown to another client.
- Nobody else in the room
- No junior staffed to your engagement, no offshore processing centre. One reviewer, the published ESA rules, your file — and a findings list you can check line by line.
I am Jerusan. I build small, exact software for regulatory filings — a Tier II EPCRA filing service and an ACORD 25 certificate checker are the other two. RegisterProof is the third, and it starts the way the other two did: by hand, on real files, before a line of product code.
That is deliberate, and I will not dress it up. The validation rules are published; running them against your register carefully is the whole job, and doing it by hand first is how I find out which parts are worth automating. The software follows the demand, not the other way round. You are buying the findings, and the findings are real either way.