Upload your XBRL-CSV or Excel package. We show you every error in the EBA rejection classes we cover (805, 807, 808, 809) plus our warning-level checks, in plain English — for free. Then repair those in one click — whether you are preparing this cycle's filing or correcting a register you already submitted. See what we do and don't check before you rely on it.
The Register of Information is not a one-off project that ended in March. It is a legal cycle that repeats, and it follows up on what you filed last time.
Decision ESA 2024/22, Arts. 4 and 5: the reference date is 31 December of the preceding calendar year, and every NCA must deliver its register data to the ESAs by 31 March. The deadline that binds you is the one your own NCA sets, on or before that date — in the 2026 cycle those ran from 13 March (Austria, Norway) to 31 March (Luxembourg, Ireland, Netherlands AFM). Check your NCA's published date.
The CSSF states that the validation checks “have not changed” but “will be applied to more data fields”, with the explicit consequence that “a register of information which was accepted last year, may be rejected this year.”
Decision ESA 2024/22 Arts. 7(3)(b) and 7(4) require NCAs to have entities submit revised registers “without undue delay”. The CSSF requires errors to be corrected and resubmitted — and corrected again if the ESAs later find more. In the 2026 cycle the AFM reopened the reporting obligation once EBA feedback was uploaded and took corrections until 30 April (Dutch national practice, that cycle).
New since the 2026 cycle: the ESAs now collect structured master data from NCAs (Decision ESA 2024/22 recital 7, Art. 8(3)), and the EBA can identify entities whose data is missing and have the NCA follow up (Art. 7(4)). Filing nothing is now visible at EU level, not only at national level.
Synthetic examples, built from the EBA rule definitions and from our own test fixtures — not from customer packages. These are the classes the engine checks and repairs.
Two rows in the same template carrying the same primary key, or a key left blank. DoraFix deduplicates and fills missing keys with traceable synthetic IDs you then replace with real identifiers.
One template references an arrangement or entity that does not exist in the template it points at. DoraFix reports the broken reference and can create the required stub rows for you to fill in.
A template contains rows while its filing indicator says reported=false, or indicators are missing entirely. DoraFix regenerates all 15 filing indicators.
Your ZIP is missing one or more of the 15 templates, or a required parameter. All 15 must be present, even when empty. DoraFix adds the missing files with correct headers and resolves the parameters.
Excel exports commonly carry a local date format. DoraFix normalizes every date it finds across all templates in one pass.
One digit off in a 20-character LEI and the value fails its checksum. DoraFix validates LEIs against the ISO 17442 MOD 97-10 checksum and flags the ones that do not pass. Warning-level: it is reported, not silently rewritten.
From a broken report to a pre-submission draft package in one pass.
Drag and drop your .xlsx, .csv, or .zip. Your file stays in your browser — nothing is uploaded until you choose to repair.
Every violation of the rules we cover, listed with the template name, row number, and a plain-English fix suggestion. No more cryptic error codes.
One click: duplicates removed, missing templates added, dates normalized, filing indicators regenerated. Download the XBRL-CSV package draft.
Whether you're a one-person compliance team or a Big Four consultant managing 50 entities.
You inherited the DORA RoI file. Your NCA's deadline comes round every year in the weeks before 31 March, and your data lives in several different spreadsheets. Upload them all — DoraFix merges, validates, and repairs.
You manage RoI submissions for multiple clients. Use batch validation to process all their packages at once. White-label the audit reports with the Pro plan.
Your GRC system exports XBRL-CSV and it keeps coming back. DoraFix tells you exactly which rows and columns fail the rules it covers — no more guessing.
Use DoraFix as a DORA RoI validation and repair assistant, not as a substitute for compliance review.
Illustrative example, not a customer package: this is what the two screens look like for a file carrying one of each error class.
The Register of Information (RoI) is required under DORA Article 28(3). Financial entities must maintain a register of all ICT third-party service provider arrangements, reported via 15 DPM templates in XBRL-CSV format to their National Competent Authority (NCA).
There is no single one-off deadline. Reporting runs on a permanent annual cycle set in Decision ESA 2024/22, Articles 4 and 5: the reference date is 31 December of the preceding calendar year, and every NCA must deliver its register data to the ESAs by 31 March.
The deadline that binds you is the one your own NCA sets, on or before that 31 March date. In the 2026 cycle those ranged from 13 March (Austria, Norway) to 31 March (Luxembourg, Ireland, Netherlands AFM), so “the March deadline” means a different day depending on where you file — and in some countries it is 31 March itself. The next cycle runs off a 31 December 2026 reference date, with entity filings due in the run-up to 31 March 2027. Check your own NCA's published date — it is the one that binds you.
Because filing and being finished are not the same thing. Decision ESA 2024/22 Arts. 7(3)(b) and 7(4) require NCAs to have entities submit revised registers “without undue delay”. The CSSF requires errors to be corrected and resubmitted — and corrected and resubmitted again if the ESAs later identify further errors. In the 2026 cycle the AFM reopened the reporting obligation once EBA feedback was uploaded, and accepted corrections until 30 April — Dutch national practice for that cycle, not an EU deadline.
The CSSF has also stated that the validation checks “have not changed” but “will be applied to more data fields”, so that “a register of information which was accepted last year, may be rejected this year.” If you filed something you know was patched together, run it through the free diagnosis and see what the next cycle will catch.
Rejection class: Rule 805 (primary key completeness and uniqueness), Rule 807 (foreign key referential integrity), Rule 808 (filing indicators), Rule 809 (structural completeness).
Warning class — reported, not blocking: VR_71 (LEI checksum, ISO 17442 MOD 97-10), VR_12 (date formats), VR_68 (country codes), VR_73 (currency codes), v88xx_m (mandatory fields), plus further advisory checks.
That is the covered set, not the whole EBA rulebook. We do not run full official XBRL taxonomy/formula validation (Arelle or the EBA Filing Rules Engine), so a package that passes DoraFix can still fail checks at the NCA portal. See What We Cover & What We Don't.
Validation and repair run in your browser. The engine is compiled to WebAssembly (Pyodide) and loaded into a web worker on your machine, so the register file itself does not need to leave your computer to be diagnosed.
All transport is over HTTPS/TLS. Where a request does reach the server, package assembly happens inside a temporary directory that is removed when the request finishes, and download links are signed and time-limited.
We are a small vendor and we would rather you check than take our word for it: our privacy notice sets out what we process and on what basis, and we will answer a DORA Art. 28/30 third-party due-diligence questionnaire in writing on request. We do not hold an external security certification (no ISO 27001, no SOC 2) today, and we will not claim one.
We accept XBRL-CSV packages (.zip), Excel workbooks (.xlsx, .xls), and raw CSV files. You can also start with our blank Excel template and fill in your data using human-readable column headers.
Yes. Production workloads run on EU-region infrastructure (Hetzner, Helsinki / Falkenstein); the contracting entity is Xolo Go OÜ, an Estonian EU company. Server-side package assembly uses a temporary directory that is removed when the request finishes. Note that the in-browser engine loads its WebAssembly runtime from a public CDN (jsDelivr), so the page does make outbound requests for the runtime itself — your register data is not part of them.
Different job. A consultancy sells you interpretation — which arrangements are in scope, how to classify them, what your ICT risk position is. That is work we do not do and do not replace.
DoraFix does the mechanical layer: upload, validate against the rejection-class checks, repair, download a draft package — the same day, self-service, from €999 with no onboarding project. Keep your consultant for judgement; use us so the file itself is not the thing that bounces. We do not publish comparative pricing for named competitors, because we have not verified their current rates.
The validator runs on standard XBRL-CSV ZIP packages and Excel workbooks — whatever your GRC platform already produces. Repaired output is a clean XBRL-CSV draft you submit to your NCA through the existing channel. Season Pass and Pro tiers include API keys for programmatic batch validation. No platform replacement required.
Quick Fix: email support, business-hours response. Season Pass: priority email and multi-subsidiary support. Pro: dedicated account manager, SLA, and SSO/integration help. All tiers include the printable audit report so your compliance function has a paper trail for the NCA review.
Yes, validation and diagnostics are completely free. You only pay €999 when you want the auto-repaired XBRL-CSV package for NCA submission. Upload as many files as you want to check compliance. The Season Pass (€3,490/year) gives you up to 5 repairs per year — enough for a filing plus any corrections your NCA or the ESAs require.
Built For
EBA ITS 2025-02
DORA Article 28(3) RoI
Data Residency
EU-only (Hetzner)
Operated by Xolo Go OÜ, EE
Validation Coverage
15 DPM templates
EBA rules 805 / 807 / 808 / 809
Stage
Founding-customer slot open
New product, no customers yet
Get ahead of the next filing cycle
The RoI repeats every year off a 31 December reference date, and the CSSF has said the same validation checks will be applied to more data fields. DoraFix is new and has no customers yet — so if you are the first, you get me directly, and you shape what gets built next.
Upload Your First Package FreeValidation is always free. Pay only when you need the auto-repaired package. One-off from €999, no subscription required.
Important compliance disclaimer
DoraFix validates against supported EBA ITS technical rules and generates a pre-submission draft package. Repaired outputs must be reviewed by your compliance function before NCA submission. DoraFix does not guarantee regulatory acceptance.
Validation & diagnosis are always free. You only pay for the auto-repaired package. All prices ex. VAT.
Upload your package for free validation. The engine tells you which of the rules it covers your file fails, and repairs those in one pass.
The RoI comes round every year — reference date 31 December, and an entity deadline set by your own NCA on or before 31 March. And a register you already filed with errors still has to be corrected and resubmitted (Decision ESA 2024/22, Art. 7(3)(b)).