DORA register of information · Luxembourg

Will your DORA register pass the CSSF checks in March 2027?

The CSSF has warned that its checks now cover more data fields, so a register accepted in 2025 can be rejected in 2026. The 2027 filing will be checked at least as strictly. Find out what will fail before the regulator does.

  • Report within 48 hours
  • Handled under NDA
  • Nothing to install, no commitment
Register Health Check Illustrative example
14Mandatory fields missing
6Not assessed
48hTurnaround
  • B_05.01

    ICT third-party provider: identification code missing

    Fails 3 providers affected · fix: add LEI or other registered code
  • B_02.01

    Contractual arrangement: mandatory field left empty

    Fails 7 rows affected · location and fix listed per row
  • B_06.01

    Function supported: data not provided

    Not assessed Missing data is never counted as a pass
  • B_01.01

    Entity maintaining the register

    Complete
Sample layout only. Your report lists every finding, where it sits in the register, and how to fix it.
Why now

Close to the deadline, most entities still hadn't filed.

The CSSF urged the rest to submit as soon as possible, leaving time to find and fix issues. Large entities put consultants on it. A 15-person ManCo usually can't.

~40%

of entities required to file a register had done so as of 16 March

31.03

filing deadline set by the CSSF in 2026 (eDesk opened 11 February)

31.12.26

reference date for the 2027 filing

Sources: CSSF, DORA register submission notice (February 2026); EY, DORA register of information quality checks do not stop at submission, citing supervisory data.

Free Register Health Check

Three steps. One report. No software to install.

Free for the first 20 entities, including everyone we met at Luxembourg Venture Days.

  1. Send last year's register

    The spreadsheet or the package you filed in 2026. We send you a secure upload link once the NDA is signed.

  2. We run it through the validation checks

    Starting with missing mandatory fields, so you can fix them before you file.

  3. Get your report within 48 hours

    Every finding, where it sits in the register, and how to fix it.

Your file is handled under NDA and deleted once the report is delivered.

Book your Health Check
The compliance engine

Then keep it accurate all year.

The register isn't a one-off filing. Providers change, contracts renew, and the rules tighten every year. The compliance engine keeps the register current between filings.

Complete Fails a check Not assessed
  • Evaluates against DORA, with GDPR and EU AI Act catalogs
  • Encryption at rest and role-based access
  • Multi-entity: run many funds or clients from one install
  • Import, don't re-key

    Start from the register spreadsheet you already have. No re-entry and no blank-page migration.

  • See every gap

    Missing data shows as "not assessed", never as a pass. You see your coverage, not a flattering score.

  • Prove it

    Evidence, review and approval, with a full audit log and a PDF readiness report for your board and auditors.

Without adding a new third party

Most compliance tools end up in the register they help you build.

The DORA tool that doesn't create a new DORA problem.
Hosted compliance software compared with the self-hosted compliance engine
 Typical hosted compliance toolNEXOPS compliance engine
Where your register lives On the vendor's cloud In your own environment (Helm chart for Kubernetes)
Your DORA register One more ICT third party to register and assess Ships its own register entry and vendor due-diligence pack
Exit Proprietary, negotiated Open source core (Apache-2.0) and a documented exit plan
Cost Consulting days or an enterprise GRC licence Fixed price, agreed up front

Runs in your own environment

Your register data stays with you. A fully offline demo runs on a laptop with no network connection.

Open source core

Apache-2.0 licensed. Your IT team can read the code, and you're never locked in.

Its own register entry

A vendor due-diligence pack for your DORA file: register entry, exit plan and subprocessors. Available on request.

Built for

Regulated entities without a DORA team

  • Management companiesUCITS ManCos and third-party ManCos running several funds
  • AIFMs and GPsPrivate equity, real estate and alternative fund managers
  • Smaller PSFsSupport PSFs and IT-outsourcing providers in DORA scope
  • Administrators and advisorsOne multi-entity install for every client you file for
Filing Season 2027

Start free. File with confidence. Stay current.

Every engagement is priced up front. No day rates, no surprises at resubmission.

For March 2027

Filing Season 2027

Fixed price, agreed up front

  • Migration of last year's register
  • Validation and the filing package
  • Support through any resubmission
Ask about it
All year

Annual subscription

Per entity, per year

  • Maintained rule catalogs, updated as validation changes
  • Register export, SSO and advanced workflow
  • Runs in your environment
Ask about it
Partners

Channel licence

For ManCos and consultancies

  • One multi-tenant install, many entities
  • Separate data per client
  • Per-entity pricing
Talk partnership
— days

until 31 March 2027, if the CSSF keeps the 2026 timetable (eDesk opened 11 February, deadline 31 March). The 2027 window is not yet published. Five months is one sales cycle for most boards.

What comes after the register

Your register shows what you depend on. NEXOPS ONE shows what that means.

Once your providers are mapped, the next questions come from your board and the regulator: how concentrated are we on one cloud, and what would it take to leave?

  • Cost

    What each critical dependency really costs you.

  • Concentration

    How much of your operations sits with a single provider.

  • Exit

    What an exit or migration would actually take.

NEXOPS ONE™ connects read-only to Azure (via Lighthouse) and AWS. We're opening a design-partner programme for 2027 with a small number of compliance-engine clients.

From register to cloud intelligence The DORA register lists the ICT providers and functions. NEXOPS ONE connects read-only to Azure and AWS to show cost, concentration and exit effort for each dependency. DORA REGISTER Cloud provider A Cloud provider B Fund admin SaaS Market data NEXOPS ONE™ COST CONCENTR. EXIT Read-only · Azure Lighthouse · AWS
Illustrative. Not live client data.
Book your Health Check

Did your register go through cleanly in March?

Tell us a little about your entity. We'll confirm within one business day and send the NDA and a secure upload link.

Nephthali Djabon Tchounda Founder, NEXOPS ONE

Finance-sector IT missions and multi-cloud infrastructure. I understand both the regulatory register and the cloud architecture behind it.

For example: rejected or resubmitted in 2026, deadline concerns.
Free · no commitment · report within 48h
Questions

What compliance officers ask us

Who is liable if the CSSF rejects a filing?

The entity files and remains responsible for its register. The Health Check and the compliance engine are readiness and validation aids, not legal advice or certification. Our job is to catch errors before the regulator does.

What exactly does the Health Check check?

We start with the mandatory-field checks from the ESA validation rules. The report lists each finding, where it sits in your register and how to fix it.

Does our register data leave our environment?

For the Health Check you send us a copy under NDA through a secure link, and we delete it once the report is delivered. The compliance engine itself runs in your own environment, so day to day your register stays with you.

Is this SaaS?

No. The compliance engine is self-hosted. It installs in your infrastructure with a Helm chart, and the core is open source under Apache-2.0. That is the point: it doesn't become another ICT third party you have to register and assess.

We use a consultant or a Big 4 firm. Why change?

You don't have to. Many advisors are stretched by smaller clients, and our channel licence lets a ManCo, fund administrator or consultancy run many entities from one install. Validation-first software makes each filing cheaper to prepare and easier to evidence.

What happens after March 2027?

The register needs to stay accurate all year, and the validation rules change every year. The annual subscription keeps the rule catalogs maintained. Once your dependencies are mapped, NEXOPS ONE™ adds cost, concentration and exit analysis for your cloud providers.

Book a free Health Check