IVASS on DORA, again

On 7 March 2025 the Italian Insurance Regulatory Authority ("IVASS") published a new letter to the market (the "Letter")? titled: DORA Report - transmission of information Register.

The Letter, addressed to (i) insurance undertakings with registered offices in Italy; (ii) reinsurance undertakings with registered offices in Italy; (iii) general representations for Italy of insurance undertakings with registered offices in a third country; (iv) general representatives for Italy of reinsurance undertakings with registered offices in a third country and (v) to intermediaries required to report to DORA, has as its specific object the technical indications relating to the transmission, provided for by Regulation (EU) 2022/2554 ("DORA Regulation"), that the mentioned entities must make once a year to the competent authorities, in the case of Italy, therefore, to IVASS, concerning:

-????????? the number of new agreements for the use of ICT services;

-????????? the categories of ICT service providers; and,

-????????? the type of contractual agreements and the ICT functions and services acquired.

Furthermore, the DORA Regulation also establishes that, as part of this data transmission, the aforementioned entities must make available to the competent authority the information register on all contractual agreements for the use of ICT services provided by third-party suppliers, which they are required to maintain and update.

It should be noted that, pursuant to the Decision of the European Supervisory Authorities of 8 November 2024, the data transmission must be made:

-????????? at an individual level, where the reporting person is not part of a financial group, or is part of a financial group where the parent company is an entity outside the European Union and there is no parent company in the European Union;

-????????? for financial groups, at the highest level of consolidation in the European Union based on the competence of the authorities established by the legal references contained in the DORA Regulation (article 46).

According to the Letter, the transmission of the information register and, in general, of the information listed above, must be made through the DORA survey on the Infostat platform.

As is well known, the Infostat platform, available at the following address https://infostat-ivass.bancaditalia.it/, is the platform used for the transmission of supervisory reports and statistics intended for IVASS. The user manual is available at the following link: https://www.ivass.it/operatori/imprese/raccolta-dati/infostat/manuale_utente_infostat_IT.pdf.

The company authorized user with user management privileges on Infostat will find the survey in question among those available and can delegate other users to send the data, as no new accreditation on the platform is required. On the other hand, entities without authorization to use the platform must first register through the portal's self-registration function, then, fill in the accreditation form which must be sent by electronic certified email to the following address [email protected].

The user delegated to transmit the data can proceed to deliver the requested information and data as described in paragraphs 4 and 5 of the Infostat user manual.

According to the DORA Regulation, the report must be sent in a compressed file (.zip), containing two folders:

-????????? the first, named META-INF, containing the file reportPackage.json;

-????????? the second, named reports, containing a .csv file for each of the 15 tables, as well as the files FilingIndicators.csv, parameters.csv and report.json.

Moreover, the file should be named using this naming convention: ReportSubject.CON/.IND_IT_DORA010100_DORA_ReferenceDate_CreationTimestamp. zip, where:

-????????? ReportSubject is the LEI of the reporter;

-????????? .CON/.IND, to be used alternatively, indicate respectively whether the report is consolidated at group or individual level;

-????????? ReferenceDate indicates the reference date of the report, in YYYY-MM-DD format; and,

-????????? CreationTimestamp indicates the timestamp of message production, in the format yyyyMMddHHmmssSSS.

The first deadline for submitting data, with a reference date of 31 March 2025, is 11 April 2025.

IVASS invites to contact, if any assistance is needed with data transmission procedures, the Data Management and Studies Service – Information Collection and Management Division of the Authority using the following email address: [email protected].

?

Moreover, it is important to point out that the document "Frequently asked question on reporting of the registers of information" is available on the EBA website (link: https://www.eba.europa.eu/sites/default/files/2025-02/5276b0df-4711-443f-a900-61b8a680ff67/20250214%20-%20DORA%20RoI%20reporting%20FAQ.pdf), which answers questions of an operational nature, relating to the compilation of the models and the preparation of abovementioned files to be transmitted.

The Letter is available, only in Italian, at the following link: https://www.ivass.it/normativa/nazionale/secondaria-ivass/lettere/2025/lm-07-03-2025/Lettera_al_mercato_07_03_2025_DORA.PDF

?