dora-roi-validator

DORA Register of Information data-quality validator and submission preflight. Runs the 116 ESA data-quality checks locally on your xBRL-CSV before you submit to the national authority. Emits a row-by-row error report with verbatim citations of the EBA validation rule that fired.

Why this exists

In the ESAs' 2024 dry-run exercise, only 6.5% of nearly 1,000 financial entities passed all 116 data-quality checks. The two most common failure categories were missing mandatory information and invalid identifiers. Re-submissions cost real money: each cycle through the national authority eats compliance-engineer days, and Q2-Q3 2026 deadlines (national-supervisor variants of the EBA template) leave no slack.

Existing tooling is enterprise GRC: Workiva, OneTrust, Vendorica — €20K-€100K annual contracts. The SMB tier (banks under €30B assets, payment institutions, asset managers under €5B AUM) is unserved. dora-roi-validator is the OSS that closes that gap.

What it does

1. Reads a Register of Information in EBA-published xBRL-CSV format (DPM 1.6 / RoI 2026 cycle, reference date 31 December 2025).
2. Runs all 116 data-quality checks (mandatory-field, format, cross-reference, LEI validation, parent-undertaking-link, contract-date sanity).
3. Emits a row-by-row error report with the specific EBA validation-rule ID and verbatim text that fired.
4. Optionally produces a remediation-priority report (most-fixable first) so a compliance engineer can triage.

pip install dora-roi-validator

dora-roi check register.xbrl.csv --output errors.json --report-md errors.md
dora-roi check register.xbrl.csv --rule-set 2026  # default: latest published
dora-roi check register.xbrl.csv --strict-lei     # external GLEIF lookup for LEI validity

Scope

• DORA Article 28 (1)(c) Register of Information for ICT third-party arrangements.
• EBA / ESMA / EIOPA joint ITS (Commission Implementing Regulation (EU) 2024/2956).
• 2026 RoI cycle (reference date 31 Dec 2025), national deadlines Q2-Q3 2026.

Limits (what this tool does NOT do)

• Does NOT submit to the national authority. Submission stays in the financial entity's GRC pipeline.
• Does NOT validate the underlying ICT third-party contracts. Only the data-quality / format level.
• Does NOT replace the EBA's official validation tool when published. We aim for "fast offline preflight" not "authoritative validator".
• Does NOT cover the SREP intersection.

Citation

If this saves your firm a re-submission cycle, cite:

@software{dora_roi_validator,
  author = {Pereiro Garcia, Cesar},
  title  = {dora-roi-validator: DORA Register of Information data-quality preflight},
  year   = {2026},
  url    = {https://github.com/plusultra-tools/dora-roi-validator},
}

License

MIT. See LICENSE.