Quick answer
Your financial client asks for your LEI because DORA, the EU’s digital resilience law, requires banks, insurers and other financial firms to list their IT suppliers in a register of information. Each supplier is identified there by a code: a company registered in the EU can use an LEI or its free EUID, while a company registered elsewhere needs an LEI. Many clients prefer the LEI because it works for suppliers from any country and is easy to check.
The request usually arrives as one line in a supplier form: please provide your company’s LEI. For a software house, a SaaS start-up or a hosting company, it can look like paperwork meant for someone else. In a sense it is: wherever your company is based, the legal duty lies with your client, and your code is simply how it identifies you in its report to the supervisor. You may see such a code advertised as a “DORA LEI”, although it is an ordinary LEI.
If an LEI turns out to be the easiest answer, you can apply for one online through us, and the code usually arrives within one or two working days.
The DORA Register of Information: What Your Client Reports
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 to banks, payment institutions, investment firms, crypto-asset service providers, insurers and other EU financial firms. Our guide to the DORA regulation explains the framework as a whole.
Article 28(3) of DORA requires every financial firm to keep a register of information listing all contracts with its ICT third-party service providers. These are outside suppliers of ICT (information and communication technology) services, and the definition is broad: cloud hosting, SaaS platforms, software development, data feeds and IT support all count. The Dutch Authority for the Financial Markets (AFM) has said that this can include even digital advertising platforms.
Each year, national supervisors request these registers from financial firms and pass them on to the European Supervisory Authorities (ESAs). The ESAs used this data to name the first 19 critical ICT third-party service providers on 18 November 2025.
The register rules are set by Implementing Regulation (EU) 2024/2956. Under its Article 3, each supplier that is a company must be identified by a “valid and active” LEI or by its EUID, and by both where both exist.
LEI or EUID Under DORA: When Each Code Is Enough
An EUID (European Unique Identifier) is a code that business registers in EU countries give companies automatically and free of charge. It combines a country code, a code for the business register and the company’s registration number. For an Estonian company, it looks like EEARIREG.14164797: EEARIREG, a full stop and the registry code. Our article on the EUID in the Estonian business register shows where to find it, and companies in other EU countries can ask their own business register. An LEI (Legal Entity Identifier) is a 20-character code issued on application and published in the global database of GLEIF (Global Legal Entity Identifier Foundation), which runs the system.
| LEI | EUID | |
|---|---|---|
| Who can have it | Companies from any country, after applying | Companies in EU business registers, automatically |
| Cost and upkeep | Paid, renewed every year | Free, nothing to renew |
| Supplier registered in the EU | Accepted | Accepted |
| Supplier registered outside the EU | Required | Not available |
Under the register rules, either code is enough for a supplier registered in the EU, while a supplier registered outside the EU can only be identified by an LEI. If a supplier has neither code, the AFM, for one, still accepts another number but marks the entry as a data-quality issue.
Why Financial Clients Still Ask ICT Providers for an LEI
The EUID option was added to the register rules at the European Commission’s insistence. The ESAs had wanted the LEI alone, and in October 2024 they asked that it be preferred where both codes exist. Many financial clients take the same view and ask for an LEI, for practical reasons:
- One code for every supplier. A bank also works with companies from the United States, the UK and Asia, which have no EUID, so using the LEI for everyone keeps the register consistent.
- Easy checking. Every LEI record sits in GLEIF’s free database, where the client can confirm your legal name, address and status automatically.
- Group structures. The register also records each supplier’s ultimate parent company. A parent registered outside the EU can only be identified by an LEI, so the client may ask for its code too.
If your client accepts the EUID, the matter is settled. If it insists on an LEI, getting one is usually quicker than negotiating, and the code will serve your next financial client too.
When the LEI Request Reaches Your Subcontractors
The register rules go one step further when your service supports a function that your financial client treats as critical or important, such as payment processing. The client must then also record an LEI or EUID for each subcontractor that effectively underpins the service. It may therefore ask you to gather these codes from your hosting provider or outsourced developers. Supervisors usually request the registers in the first months of the year, so it pays to have the codes ready early.
What to Do When a DORA LEI Request Arrives
These four steps cover most cases:
- Check whether your company already has an LEI. Search the GLEIF database, since an earlier bank or broker may have required one. If its registration status shows LAPSED, the code needs renewing rather than replacing.
- Offer your EUID if your company is registered in the EU. Ask whether the client accepts it, and send both codes if you also have an LEI.
- Apply for an LEI if the client needs one and you have none. You can apply online as a director of the company or under a power of attorney from it.
- Keep the code up to date. Automatic renewal or a multi-year package helps keep it from lapsing, and the record needs updating if your company’s name or address changes.
Getting an LEI for Your IT Company with Eesti Firma
At Eesti Firma, a law and accounting firm in Tallinn, we act as an LEI provider. The code itself is issued by our partner WM Datenservice, a GLEIF-accredited issuer in Frankfurt. Your company needs no connection to Estonia: we arrange LEIs for companies in more than 50 countries.
You fill in the online form, pay and confirm that you may act for the company. For many countries, the form loads the company’s details straight from its business register. We check the application before it goes to the issuer, which helps avoid delays.
If you are unsure what your client needs, forward us its request, and we will check free of charge whether you need a new LEI, a renewal of an existing one or its transfer from another provider.
Frequently Asked Questions
Not always. DORA places the duty on financial firms, which may identify a supplier registered in the EU by an LEI or an EUID. For a supplier registered outside the EU, the register rules allow only an LEI, so in practice such a supplier needs one.
Yes, if your company is registered in the EU. DORA’s register rules let the client use the free EUID from your business register, although some clients still prefer the LEI. If you hold both codes, give both.
DORA does not say who pays. The LEI is issued in your company’s name, so your company applies for it. Whether the client covers the cost is a matter for your commercial agreement.
No. The register rules ask for a valid and active LEI, and a code whose yearly renewal was missed no longer meets that. It needs renewing, and an EU company can give its EUID in the meantime.
