EnableGRC
Start 14-day trial
Free self-assessment · three to eight minutes

Third-party register readiness.
One reference date, two regulators.

The assessment in 30 seconds. A silent film — the words are on screen.
Read the text of the film

Which of your third-party arrangements actually count? Two regulators, one reference date: 31 December 2026 for the DORA register of information, and 18 March 2027 when the FCA’s material third party reporting is in force from.

It asks where you’re authorised first. Authorised in the UK and the EU; authorised as an EMI or PI; a group across both; 100–500 arrangements. Dual scope: two registers against the same data, and you get the full set. One regime: only the questions that regime asks. Supplier: a short set, because the obligation sits with your clients.

And when it doesn’t apply: nothing to file — and we’d rather tell you than sell you. The rules don’t catch your firm. Here’s what still does, and the inventory template, free.

Your score on screen, the full report by email. An example score of 58, with Intent established and Capability and Assurance developing. The ISO/IEC 27001 Annex A supplier-control alignment is in the full report.

The report outlines your gaps. Audit and access rights absent from four contracts. Sub-outsourcing chain not mapped beyond tier one. Exit plan referenced but never tested. Register fields incomplete — LEI, function identifier.

And each one carries across. Your answers become your workspace tasks: reissue contract schedules (14 Nov), map tier two and three (28 Nov), run and evidence the exit test (5 Dec), complete register fields (12 Dec). Dates counted back from 31 December. Example firm, example answers.

You confirm a few details. You don’t start again. enablegrc.ai/assess/third-party-register

For firms authorised in the UK, the EU, or both. If your firm falls outside the register rules, the assessment tells you so plainly and does not sell to you.

DORA register of information — reference date 31 December 2026
FCA PS26/2 material third party reporting — in force from 18 March 2027
Your score appears on screen. No email needed to see it.
  • Your readiness score, on screen, free — no email needed.
  • A full report naming every gap we find, against the FCA register fields, the DORA register columns and ISO 27001’s supplier controls.
  • The three most urgent fixes, spelled out.

How the score is built

Intent

Is it decided, owned and written down? Policy, methodology, accountability.

Capability

Can the firm actually produce the artefact? Data, structure, coverage.

Assurance

Can the firm evidence it? Testing, audit, currency, point-in-time proof.

Up to twenty-two questions (your profile decides how many — between five and twenty-two), each on the same four-point scale, mapped to the FCA register fields (SUP 15 Annex 16.1R), the DORA register of information columns (ITS (EU) 2024/2956) and the ISO/IEC 27001:2022 Annex A supplier controls that produce them. Your profile decides which questions you see — a firm outside the FCA register population is told so, not sold to.