Can a CMDB for DORA Compliance in Warsaw Banking Shared Services Feed Every Bank’s Register?

A CMDB for DORA compliance that Warsaw banking shared services teams maintain faces its hardest test on a day like 26 February 2026. That Thursday afternoon, the PKO Bank Polski mobile app and its iPKO and Inteligo online services became unavailable for thousands of users, according to Gazeta Prawna’s outage report. The outlet drew on Downdetector user reports and bank information, and it states that systems returned to normal before 19:00. The report leaves the cause open.

Behind every affected channel sits a chain of services, systems and providers, and an operations center has to name that chain quickly. The headline question follows from that. Can the records one center keeps answer it for every bank the center serves?

The answer is yes for the asset and dependency layer. A discovery-sourced CMDB record can supply the assets, relationships, and owners that a bank’s register of information and its Article 8 mapping draw on. Contract fields come from contract tools, and each bank files its own register.

Why a Banking Shared-Services Center Appears in Its Banks’ Registers

DORA’s register templates cover arrangements with intra-group providers. The recitals of the register regulation (Implementing Regulation (EU) 2024/2956) say a financial entity should report its contract with an intra-group ICT provider. They also say the entity should report the provider’s arrangements with external providers as subcontractors. A dedicated template reconciles the two sets of contracts. Recital 2 allows a group to keep one register at entity, sub-consolidated and consolidated levels.

In Poland, the Polish Financial Supervision Authority (KNF) collected the first registers. According to KNF’s reminder to entities, submissions were due by 23 April 2025 through the KNF DORA reporting system on form SPR-PF-18, with data current as of 31 March 2025. A Rzeczpospolita Pro analysis by two Polish lawyers notes that the national act adapting Polish law to DORA appeared in August 2025. DORA itself has applied since 17 January 2025.

The population of affected centers is large. ABSL reports in its Warsaw 2025/2026 sector report that Warsaw hosts 418 business services centers, and 79% are owned by foreign companies. Those centers employed 111,200 people in 2025, and IT centers’ share of that employment grew from 18.7% to 31.6% since 2015.

Whether a given center counts as a financial entity, an intra-group provider, or both is a question for your counsel.

What the Banks You Serve Will Ask Your Center For

Each bank’s DORA team needs specific facts from the center. The table shows which of those facts a center’s record can supply and which come from other tools.

Asset records sit under every row, which makes asset management for financial services the working base. The data hand-off format and frequency need agreement with each bank’s DORA team.

Where Data Quality Is Already Being Measured

Regulators and consultancies have published numbers on register quality. In the 2024 dry run, the European Supervisory Authorities analysed 947 registers, and 6.5% passed all data quality checks, according to the ESAs dry run summary. Half of the remaining registers failed fewer than five of the 116 checks. Missing mandatory fields were the most common error, and invalid LEIs also appeared. The authorities described the results as in line with a best-efforts exercise. They also advised that, where a trade-off arises between data quality and completeness, financial entities should prioritize data quality.

In Deloitte’s European DORA survey of financial entities across 28 countries, 46% named the register of information as the most challenging task. Only 8% of respondents reported full compliance on third-party risk management.

Shared centers face pressure from the other side as well. Deloitte’s 2025 Global Business Services survey ran in the second half of 2024. Respondents prioritized technology investment for process efficiency and cost reduction, and 50% of GBS organizations planned to increase their footprint.

A CMDB addresses asset, dependency, and ownership records. Identifier and format errors such as invalid LEIs belong to contract and reference data.

Four Places a Center’s Records Fall Short of What Banks Need

Each pattern below applies to centers where the stated condition holds.

1. Where each bank is served through its own mix of tools, the same asset can appear twice under different names. Two banks then receive contradictory answers about one asset. Records joined on hostnames drift apart, while serial numbers and cloud instance IDs hold steady.
2. Where the center’s own subcontractors live only in contract files, the system records omit them as relationships. The bank’s register then lacks the data it needs to reconcile against the center’s actual supply chain.
3. Where the answer to which bank a system serves lives in team memory, incident scoping starts by asking colleagues. Each question adds minutes before the bank hears an answer.
4. Where registers are filled only at submission time, the record describes the last reporting date. Changes made since then reach the bank only at the next reporting cycle.

What Discovery-Sourced Records Supply to a Bank’s Shared Center

A CMDB for DORA compliance that Warsaw banking shared services leaders can defend is a record layer fed by discovery. Virima runs high-frequency scheduled discovery across the estate, which keeps IT discovery results current between reporting dates. ViVID™ service mapping builds dependency maps once the center supplies its service definitions.

Discovery fills the assets and relationships columns of the earlier table. The center adds the bank served, the function supported, and the owner as mandatory fields, so one record answers both the register question and the incident question. Serial numbers and cloud instance IDs serve as the join keys that merge one asset, found by several tools, into a single record.

The published integration catalog lists these connections for a typical bank center estate:

Where the CMDB Record Stops and Other Tools Take Over

• Contract fields, LEIs and exit plans live in vendor and contract tools.
• Each bank decides which of its functions are critical or important.
• Obligations, controls and evidence belong in the GRC register, while the CMDB holds configuration items and relationships.
• Policy enforcement and monitoring run in their own tools.
• The CMDB supplies the record that supports a bank’s DORA work, and compliance stays with the bank’s governance.

A Group Provider Failure the Regulator Wrote Up

When a bank depends on a group provider for IT, the first question after an outage is which of its services ran on that provider. One regulator-written case answers that in detail.

The Central Bank of Ireland’s settlement agreement with Ulster Bank records that the bank relied on Royal Bank of Scotland Group for IT services under a 2005 outsourcing agreement. In June 2012, software the group used to process transactions across its businesses failed. The immediate cause was difficulties with a third-party software upgrade that the group had installed days earlier. Full account services returned on 16 July, which was 28 days after the incident began. Approximately 600,000 customers lost essential banking services in that period, and the Central Bank fined the bank €3.5 million.

The case predates DORA by more than a decade. It documents in writing the intra-group IT reliance that a center’s records have to describe today.

What a Maintained Record Cuts, and Where Costs Stay Fixed

Where each bank asks the center separately for the same facts, one maintained record cuts the rework. Vendor fees and spend allocation stay with finance and procurement. Discovery-sourced Trusted Runtime Truth gives each of those requests one answer covering what exists, how it connects, and who owns it.

A practical measure for the CIO is the time needed to answer a bank’s dependency question, recorded before and after records are consolidated. Each center sets its own baseline. When one data hand-off serves several banks, the center maintains one process instead of several parallel ones, and each bank still agrees on its own format.

Five Steps Before the Next Register Cycle

1. Trace one function the center supplies to one bank, including the center’s own subcontractors. Pick the function with the most bank-facing traffic, list the systems behind it, then list the outside services each system uses.
2. Run discovery and compare the result with the bank’s register entries for that function. Differences between the two sources show where the record or the register needs correction.
3. Set mandatory fields for every record: bank served, function supported, subcontractor, and owner. A record missing any of the four goes to its owner for completion.
4. Agree a data hand-off with each bank’s DORA team, covering format and frequency. Write down who sends what, in which format, and how often, separately for each bank.
5. Set a review cadence that matches each bank’s register update cycle. KNF first requested its quarterly key risk indicator survey (SPR-PF-26) for Q3 2025, and Rzeczpospolita Pro notes that supervised entities can expect recurring reporting cycles.

Bring three items to the first meeting with a bank’s DORA team: the traced function, the comparison from step two, and the list of mandatory fields. The comparison gives the team a concrete list of gaps to work through. The field list shows what the center can maintain from that point forward, which sets a realistic scope for the first hand-off.

See How Your Center’s Dependency Records Compare

To see how dependency maps are built from discovered infrastructure, start with Virima’s service mapping overview.

Frequently Asked Questions