Ireland’s Pensions Authority has confirmed that it will undertake its next registers of information (ROIs) collection, as specified by the Digital Operational Resilience Act (DORA), in 2028.

In an update on ROIs, set out under article 28(3) of DORA, the authority confirmed the 2028 date was due to changes at a European level.

The European Supervisory Authorities (ESAs) recently introduced simplifications to their processes for the collection of ROIs for the purposes of designating the critical ICT third-party service providers (CTPPs) under article 31 of DORA.

As a result of the simplifications, the ESAs’ 'full-scope’ criticality assessments will now take place every three years, rather than once a year. In each interim year, a simplified process for CTPP designations has instead been introduced, but IORPs are currently excluded from this.

The authority’s next ROI collection in 2028 is expected to include all Irish IORPs in scope of ROI requirement.

It stated: “Those schemes will be required to submit full ROIs to the Pensions Authority using a reference date of 31 December 2027. The Pensions Authority will communicate further details on the timing and format of ROI submissions in advance of this exercise.

“Trustees should ensure they have in place technical infrastructure in line with EBA requirements.”

In the meantime, the authority reminded trustees of the requirement under article 28(3) of DORA for relevant IORPs to maintain and update their ROI.

It advised IORPs in scope of the ROI requirement to update their ROI information immediately in the event of any known change to the information contained in the ROI, as well as annually.

It stated: “Systematic annual reviews are important to allow trustees to assess and record any new information relevant to their contractual arrangements on the use of ICT services, even when there have been no changes to the scheme’s direct contractual arrangements, e.g., changes to any subcontractors used by existing direct service providers.

“The Pensions Authority will look for evidence that such reviews have taken place; therefore, trustees should ensure ROI reviews are recorded appropriately, e.g., in the minutes of trustee meetings.

“Trustees should also note their obligation under article 28(3) of DORA to inform the Pensions Authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions.”

Finally, it said that where an IORP has concluded it does not use ICT third-party service providers as defined under DORA, trustees should notify the authority by emailing DORA_nullROI@pensionsauthority.ie.

---