DORA Article 28(3): First Reporting Arrangements for Pension Schemes - Pension Update March 10 2025

Patrick McKenna • 13 March 2025

On March 10, 2025, the Pensions Authority released details about the first reporting arrangements for the Registers of Information (ROI) required under Article 28(3) of the Digital Operational Resilience Act (DORA).

DORA Article 28(3): First Reporting Arrangements for Pension Schemes


On March 10, 2025, the Pensions Authority released details about the first reporting arrangements for the Registers of Information (ROI) required under Article 28(3) of the Digital Operational Resilience Act (DORA). This new requirement strengthens digital operational resilience within the financial sector, particularly pension schemes.


What is DORA and Article 28(3)?


DORA (Regulation (EU) 2022/2554) aims to improve digital operational resilience across financial institutions in the European Union (EU). Article 28(3) specifically requires financial entities, including pension schemes with 16 or more active and deferred members, to maintain and regularly update a register of information (ROI) regarding their contractual agreements with ICT third-party service providers.


The purpose of the ROI is:

  1. Risk Management – Helping pension schemes track and manage risks associated with third-party ICT service providers.
  2. Regulatory Compliance – Providing authorities with a clear record of ICT-related risks in the pension sector.
  3. Oversight of Critical ICT Providers – Supporting European Supervisory Authorities (ESAs) in identifying key service providers that require closer monitoring.


How Pension Schemes Must Report Their Registers of Information


To comply with DORA Article 28(3), pension schemes must submit their Register of Information (ROI) to the Pensions Authority, which will then forward the data to the European Supervisory Authorities (ESAs).

The reporting process includes the following steps:


1. Secure Submission

  • Pension schemes must obtain a secure link, username, and password from the Pensions Authority to submit their ROI.
  • Only schemes invited by the Pensions Authority should submit their ROI at this time.


2. What if a Scheme Has Not Been Contacted?

  • Pension schemes that have not been contacted by the Pensions Authority by March 14, 2025, must still prepare their ROI.
  • Even if submission is not yet required, schemes must keep their ROI updated and make it available upon request to comply with Article 28(3).


3. Null ROI Confirmation

  • If a scheme does not use any ICT third-party service providers, it must confirm this by emailing DORA_nullROI@pensionsauthority.ie.
  • The email should include the scheme name and PB number.


Additional Considerations for Pension Schemes


Legal Entity Identifier (LEI) Requirement

  • The Register of Information (ROI) must include a Legal Entity Identifier (LEI), a 20-character alphanumeric code that identifies financial entities.
  • Pension schemes can apply for an LEI through an authorized issuer in Ireland.


Compliance Deadlines

  • While specific reporting deadlines apply to schemes already contacted, all pension schemes should ensure their ROIs are updated by March 31, 2025.
  • This aligns with the reference date outlined in the European Supervisory Authorities' decision (Ref: 2024 22).


Future Updates

  • The Pensions Authority will provide additional guidance on its DORA webpage.
  • Pension schemes are encouraged to check for updates regularly to ensure full compliance.


Conclusion


The Digital Operational Resilience Act (DORA) represents a major shift in how financial institutions, including pension schemes, manage digital risks. The first reporting of the Registers of Information (ROI) is an essential step in ensuring compliance with Article 28(3).


Pension schemes must:

  • Prepare and maintain their ROIs with up-to-date information.
  • Submit their ROI only when invited by the Pensions Authority.
  • Confirm non-use of ICT third-party providers, if applicable.


By following these steps, pension schemes will not only meet regulatory requirements but also strengthen their digital resilience.

For the latest updates, visit the Pensions Authority’s DORA webpage:
🔗 www.pensionsauthority.ie



References

Ireland Pensions Guide 2025: A Simple Overview for Employees, Self‑Employed and Retirees

22 April 2025
A Guide To Irish Pensions 2025

Understanding the Pensions Authority Register of Administrators: How It Differs from Financial Services Firms and Independent QFAs

by Patrick McKenna • 13 March 2025
The Pensions Authority Register of Administrators is a crucial resource for anyone managing or overseeing an occupational pension scheme in Ireland. But what exactly does this register contain, and how does it differ from financial services companies that help facilitate pension cash withdrawals and independent Qualified Financial Advisors (QFAs)?

Irish Pension News - March 12th - 2025

by Patrick McKenna • 11 March 2025
March 12 2025 - Irish Pension Update

State Pension Age and Entitlement Reforms (2022–2024)

by Patrick McKenna • 12 March 2019
Over the past five years, Ireland’s pension landscape has undergone significant reforms affecting both the State pension and private retirement savings. Below are three of the biggest updates, each summarized with key details, dates, and their impact on those nearing retirement, along with relevant official statements.

Introduction of Automatic Enrolment (“My Future Fund”) for Private Pensions (2024–2025)

by Patrick McKenna • 12 March 2019
Ireland is rolling out a new Automatic Enrolment (AE) retirement savings system – a long-awaited scheme to boost private pension coverage. Legislation for AE was published in April 2024, with the first enrollments set to begin in late 2025