Bite Apps › SafeDORA › Validation rules

DORA register of information — validation rules and error codes

Every check a DORA register of information has to pass before it is accepted: the file name and xBRL-CSV package checks, empty and duplicate keys (805, 806), the 22 references between templates behind check 807, date, number and closed-list formats, mandatory fields, and the LEI and consistency rules — what each one means and how to fix it.

• How a register is checked
• File name and package checks
• Keys: checks 805 and 806
• References between templates: check 807, R1–R22
• Dates, numbers and closed lists
• Mandatory fields
• LEI and EUID checks
• Consistency rules
• SafeDORA’s own hints
• Test files

How a register is checked

A register of information goes through several layers of checks after you upload it to your competent authority. The first layer is technical and is applied on reception: if the file name, the package structure, a filing indicator, a column code, a key field or a reference between two templates is wrong, the whole file is rejected and nothing is loaded. Files that pass are then checked for data types and allowed values, against the EBA validation rules, and against LEI and EUID registers; those findings come back as data-quality feedback, and the authority can ask for a corrected file.

When the ESAs tested the process in their 2024 dry run with 1,039 financial entities, only 6.5% of the registers passed every data-quality check, and missing mandatory information made up 86% of the data errors (ESAs dry run summary report, December 2024). The dry run was a voluntary, best-effort exercise, but the same kinds of mistakes are still the usual reason for a resubmission.

The tables below list every check SafeDORA runs, with the level it reports: Blocking for problems that make the ESAs reject the file, Error for values that fail a technical data check, and Warning for validation rules and plausibility checks. Check numbers such as 805 and 807 follow the ESAs’ numbering of technical checks; v…, e…, VR_… and DOR_… are identifiers of EBA validation rules; SD-… are SafeDORA’s own hints.

File name and package checks

These 25 checks look at the ZIP file itself, before any register data is read. They only apply to the xBRL-CSV package, not to an Excel workbook.

Keys: checks 805 and 806

The key of each template, from the EBA data model:

References between templates: check 807

The data model defines 22 references (R1–R22). For each of them, the value — or combination of values — in the left column must exist as a key in the template on the right. One mistyped LEI or contract reference number is enough to break every reference to it, which is why a single typo can produce many 807 findings.

The ones that fail most often in practice: a function identifier used in B_02.02 that is missing from B_06.01 for the same entity (R7); a contract and provider pair in B_02.02 without a row in B_03.02 (R17); an entity LEI that is not listed in B_01.02 (R1–R6); and the ultimate parent of a provider in B_05.01.0110 that is not itself a row of B_05.01 (R18) — if a provider has no parent, report its own code there.

Dates, numbers and closed lists

SafeDORA accepts the usual Excel spellings when it reads a workbook (a real date cell, 31.12.2026, the label “Germany”) and writes the correct form into the package. When it checks a finished package, the values must already be in the exact form below.

Mandatory fields

Besides the key columns, the EBA existence rules require these fields in every row of a template. An empty one is reported under the rule shown.

Two conventions from the ESAs’ FAQ avoid most of these findings: report 9999-12-31 as the end date of an open-ended contract (B_02.02.0080) and as the date of deletion of an entity that is still in scope (B_01.02.0090); and for the ultimate parent undertaking, report the entity’s own LEI as its parent (B_01.02.0060).

LEI and EUID checks

An LEI is 18 letters or digits followed by two check digits (ISO 17442, the same mod-97 scheme as an IBAN). A wrong check digit means a typing mistake. An EUID starts with the two-letter country code, then the register code, a dot and the registration number. SafeDORA checks the form and the check digits; it does not look identifiers up in the GLEIF database, which the ESAs do.

The LEI in the file name is checked the same way (VR_2). Legal persons are identified by LEI or EUID; the other code types of the closed list are meant for individuals acting in a business capacity.

Consistency rules

SafeDORA’s own hints

These are not ESA or EBA rules. They flag things that are usually a mistake, or that differ from the ESAs’ sample package.

Test files

A filled-in Excel register and an xBRL-CSV package, each in a clean version and a version with documented mistakes (empty and duplicate keys, a broken reference, a false filing indicator, a wrong date format), are free to download from github.com/ekiedev/fix-iso20022-samples. Or open SafeDORA with its built-in sample register.

FAQ

Last updated 2026-11-10. Something wrong or missing? Email support@biteapps.cc.