Once a year your entity has to hand over the list of its IT providers, in a format only a machine can read. Obligia walks you from one end to the other — and tells you, before you send it, what would get it refused.
Built on the files published by the authorities
6.5% of the 947 registers analysed in the ESAs’ 2024 dry run passed all 116 data quality checks. ESAs summary report, Dec. 2024 ›
The same checks, in the same order, run at your end in a few seconds. Every finding says what to fix and where — never an error code.
official checks replayed — including every single rule that decides whether your register is complete and coherent. The 7 remaining are transport rules, or have no subject in a DORA register.
You fill in forms in your own language. The machine file is built at the end, named to the official convention.
Each finding can be assigned. Nobody can declare it settled: it disappears when the data is corrected.
90, 30, 7 then 1 day before. With the real state of your register, not just the date.
From the spreadsheet you already keep, or typed in by hand. Wherever a value is constrained, you pick from a list — the error becomes impossible rather than detectable.
3 rows skipped: unreadable country, empty row, duplicate.
Not an error code: the row concerned, what is missing, and why it is mandatory.
Each point can be assigned and commented on. But nobody can declare it settled: it disappears when the data is corrected, and not before.
That is deliberate. A register showing progress its own validation contradicts is exactly what a compliance tool must prevent.
14 cells filled out of 18
You download the official package, named to the convention, and pass it on as it is. A dated attestation stays with you.
It also states what it is not — an approval by any authority. Nobody can issue one.
Checks applied
113
Rows verified
41
Register fingerprint
a7c028af·e95d4aa2·c8b769d1
Change one cell and the fingerprint no longer matches.
Audit pack · one download
Reviewed one contract at a time, three arrangements with three different providers look like three different risks. Obligia reads the whole of B_05.02 at once and finds the node they converge on — the rank 2 or rank 3 company sitting behind several of your critical chains at the same time.
Convergence, not inventory. The alert fires on a provider at rank 2 or deeper present in two or more chains that support a critical or important function.
Silence is reported too. A critical chain declared at rank 1 only comes back as a finding, not as a flat, reassuring diagram: what has not been declared cannot be assessed.
Drawn on our servers, not by a third party. The diagram is a deterministic SVG built server-side. No chart library, no external call, no script — the page runs under script-src 'self', and the drawing carries nothing that could be blocked or that could phone home.
It counts; you assess. Article 29 asks the entity to assess its concentration risk. This reads what your register declares and adds it up. The judgement stays yours — and the evidence it rests on becomes citable.
Your second filing is your first with a year of drift in it. Obligia carries last year’s validated register forward and tells you what moved — the row, the field, both values.
FUNC-PAIE became critical or important
not_critical→critical_or_important
Nouveau Prestataire SA entered the register
—→B_05.01
Supply chain declared one rank deeper
rank 1→rank 2
Nothing changed? It says so, plainly. That is an answer too.
The reclassifications first. A function that became critical drags its assessments and its supply-chain depth along behind it.
Who arrived, who left. Providers, contracts, a service given an end date, a chain declared one rank deeper than last year.
The answer a committee asks for. A week spent comparing two spreadsheets becomes a screen you read out loud.
A row’s identity comes from the database, not from a list somebody maintains: the comparison cannot fall out of step with the schema, and never reports a removal as an addition.
Obligia is not a GRC suite and does not replace your expert. It does the half of the work that a machine does better than any human, so that the half only a human can do gets the attention it deserves.
Tireless, identical every time, and it does not get bored at line 4,000.
No tool makes these calls for you. One that claimed to would be selling you a liability.
A consultant who arrives to a register that already passes 113 checks spends their days on your risk, not on your spreadsheet. That is the point: we make their hours worth more, we do not replace them.
A posture designed for the financial sector, from the ground up.
Obligia is a tool to assist in building the register. Responsibility for submission remains with the entity, but we do everything we can to make sure your package passes the checks on the first try.
The register is annual, and so is your value. No seasonality: a living register maintained all year.
€1,800 / year
1 filing entity (LEI) · 1 seat · unlimited records
Everything needed to file
€4,900 / year
1 filing entity (LEI) · your whole team
The two readings a spreadsheet cannot produce
And everything Starter has, plus
from €14,000 / year
Several filing entities · scoped with you
Everything in Professional, at group scale
VAT is not applicable — art. 293 B of the French tax code. Secure payment via Stripe. Scoped with you means exactly that: an Enterprise item is delivered under a written scope and a contract, not switched on from a form. Nothing is charged before the scope is agreed.
Every plan exports your whole register in the regulator’s own format, at any time. No plan caps what your register may contain — an incomplete register is a non-compliant one, and that is not something to sell back to you.
It is the structured inventory of all your contractual arrangements with third-party ICT service providers (and their subcontractors), to be submitted annually to your competent authority and kept available for inspection.
Because regulators require it: a machine-readable package (metadata + one CSV per template) complying with the ESA taxonomy. Obligia generates it for you; you never have to handle it manually.
Obligia replays, before submission, checks equivalent to those of the regulators and lists every correction needed. The goal is to pass on the first try, but submission remains your responsibility.
For small and medium-sized financial entities: asset managers, investment firms, payment institutions, CASPs, crowdfunding platforms, small insurers, fintechs.
We follow ESA publications and update the lists and format accordingly. Your register stays compliant with the version in force.
Yes, from the Pro plan. One person submits, another approves, and the approval is tied to the register's content — change a value afterwards and it stops applying, so an export can never carry data nobody reviewed.
Yes, from the Pro plan, if you switch reminders on. Record your deadline — that part is available on every plan — and you are written to 90, 30, 7 and 1 days before it. Each message carries the state of your register at that moment, unresolved errors included, so you learn whether you are ready rather than only that the date is approaching.
Create your register, import your contracts, run the validation. You only pay when you download the file you file.
No card required · no commitment · your data stays exportable