Your DORA Register of Information, prepared by AI.
Papersmith reads your ICT contracts and fills the register in the EBA's exact format. Your team reviews, your compliance officer signs off, and you upload to CySEC.
For CySEC- and CBC-regulated firms in Cyprus, and the compliance firms that serve them.
| Provider | Arrangement ref. | ICT service type | Notice period | Governing law |
|---|---|---|---|---|
| Trading platform | PLT-2024-07contract p. 1 | S13 Software licensingp. 3, §2.1 | 90 daysp. 11, §14.2 | CYp. 12, §17 |
| Cloud hosting | HST-2023-11order form p. 1 | S17 Cloud services: IaaSp. 2, §1 | 30 daysterms §9.3 | IEterms §22 |
| CRM | CRM-2025-02contract p. 1 | S19 Cloud services: SaaSp. 2, §1.2 | not statedto the compliance officer | CYp. 8, §11 |
- 15EBA templates make up the Register of Information
- 19ICT service types every contract is classified into
- 40–80 hof manual work for a typical register, done by hand*
- 28 Feb 2027full re-filing in xBRL-CSV through the CySEC XBRL Portal
One part of DORA, done properly
Papersmith covers the register of your ICT contracts (third-party risk, Article 28), not the IT-security side of DORA. You have a pile of contracts with your IT providers:
- trading platform, liquidity bridge, market data
- hosting, cloud, telecoms
- CRM, back office, custody, payments
Turning them into the register means reading every contract, extracting dozens of fields per provider and producing the file in the EBA's specific format, without tripping the filing rules. That is the manual work Papersmith does.
How it works
- Your ICT contracts
- AI agents read and extract
- Register in the EBA's templates
- Compliance officer signs off
- You upload to CySEC
Upload your ICT contracts
And last year's register, if you have one. Contracts stay where you put them; nothing is shared with anyone.
AI agents read every contract and fill the register
Field by field, in the EBA's templates. Every value shows the page it was read from, and a second pass checks it.
The register is checked against the latest EBA filing rules
What your contracts are missing comes back as a list: LEIs, notice periods, governing law, data locations. Anything not confirmed goes to your compliance officer, not into the register.
Your compliance officer reviews and signs off
You download the validated xBRL-CSV package and upload it to the CySEC XBRL Portal under your own credentials.
Why now
- 28 February 2027Every entity under DORA files its full Register of Information again, in xBRL-CSV, through the CySEC XBRL Portal (CySEC Circular C751).
- Since the 2026 filingsThe EBA has tightened its filing rules. A package that was accepted last year is not guaranteed to pass this year's checks.
- First registersFirms authorised under MiCA this year prepare their first register: typically 20–40 ICT providers, many without an LEI yet.
Free: what your 2026 register fails today
Send us the register you filed in 2026, under NDA if you prefer. We run it through today's EBA filing rules and tell you exactly which checks it fails, with the rule IDs, before you decide anything.
For compliance firms and fund administrators
Papersmith runs under your brand. Your team reviews each client's register, your compliance officer signs it off, and you charge your clients as you see fit. The platform does the reading and the XBRL; the relationship stays yours.
We will check the 2026 registers of your five most exposed clients for free, so your first conversation with each of them starts with a list of what fails today.
After February: DORA watch
The rules moved between the 2026 and 2027 filings, and the EBA has already scheduled the next move: reporting goes to taxonomy 4.4 for the register with reference date December 2027.
DORA watch monitors CySEC circulars, EBA releases, validation-rule changes and the LEI status of your providers, re-validates the register we hold for you against each change, and tells you in plain language whether anything needs attention. Whether to re-file is always your decision. February stops being a project.
Your data
- Contracts and registers are stored and processed in the EU (AWS, Stockholm), encrypted at rest and in transit.
- The AI runs in the same region. The model provider keeps nothing: no prompts, no documents, no training on your data.
- You can delete everything at any time and receive a certificate of deletion. The data processing agreement lists every sub-processor.
Who's behind it
Papersmith is built in Cyprus by Mark Pesah, a technology executive with over 25 years of experience taking products from concept to market: bootstrapping, growth, market expansion and exits.