How to Get Valid LEIs for DORA Reporting (And Avoid the #1 Error)

In the ESA's DORA dry run exercise, 32% of submissions had Legal Entity Identifier (LEI) errors—making it one of the most common reasons for validation failure. These weren't obscure technical issues. They were preventable mistakes that cost firms resubmission cycles and compliance delays.

This guide explains what LEIs are, why they matter for DORA, and exactly how to avoid the errors that tripped up nearly a third of participants.

What Is an LEI and Why Does DORA Require It?

A Legal Entity Identifier (LEI) is a unique 20-character alphanumeric code that identifies legal entities participating in financial transactions. Think of it as a global ID number for organizations—like a passport, but for companies.

LEIs are managed by the Global Legal Entity Identifier Foundation (GLEIF), which maintains a public database at gleif.org.

DORA requires LEIs for:

• Your own financial entity (the reporting entity)
• Parent companies and group entities
• Ultimate parent undertakings
• ICT third-party service providers (when they have one)

The LEI requirement isn't optional. Template B_01.01 requires the reporting entity's LEI in a mandatory field. Templates B_02, B_03, and others reference LEIs for related parties and providers.

The 32%: What Went Wrong in the Dry Run

The ESA dry run report identified several categories of LEI errors:

1. Invalid LEI Format

LEIs follow a strict structure: 20 alphanumeric characters. Characters 1-4 are the Local Operating Unit (LOU) prefix, 5-18 are entity-specific, and 19-20 are check digits calculated using the ISO 17442 algorithm.

Common format errors:

• Wrong number of characters (19 or 21 instead of 20)
• Lowercase letters (LEIs use uppercase only)
• Invalid characters (spaces, hyphens, special characters)
• Incorrect check digits

2. Expired or Lapsed LEIs

LEIs must be renewed annually. A lapsed LEI is still a valid identifier, but its status shows as "LAPSED" rather than "ISSUED" or "PAID."

Many entities discovered their LEI had lapsed months or years ago. Some ICT providers had never renewed since initial registration.

3. LEI Doesn't Match the Entity

Some submissions contained LEIs that belonged to different entities—typically due to copy-paste errors, confusion between parent and subsidiary LEIs, or using test/placeholder values.

GLEIF's database stores the legal name associated with each LEI. Mismatches are detectable and will trigger validation errors.

4. Missing LEIs for Required Entities

Not all entities have LEIs—they're primarily required for those engaged in financial transactions. But many ICT providers serving financial entities do have LEIs, and submissions failed because these weren't included when they should have been.

How to Verify an LEI: Step-by-Step

Step 1: Go to GLEIF's Search Tool

Visit search.gleif.org (the official GLEIF LEI search).

Step 2: Search by LEI or Entity Name

You can search by:

• The 20-character LEI code (exact match)
• Legal name of the entity
• Country of registration

Step 3: Check These Fields

For each LEI you verify, confirm:

Step 4: Download the Record

GLEIF provides downloadable records in multiple formats. Keep these for your compliance documentation.

How to Obtain a New LEI

If your entity or an ICT provider doesn't have an LEI, obtaining one is straightforward:

For Your Own Entity

1. Choose a Local Operating Unit (LOU). LOUs are accredited organizations that issue LEIs. Major options include Bloomberg, London Stock Exchange, and national providers. Compare pricing—fees typically range from €50-150 for initial registration plus annual renewal.
2. Prepare your documentation. You'll need:
   • Legal entity name (exactly as registered)
   • Registered address
   • Country of registration
   • Registration authority and number
   • Parent company information (if applicable)
3. Submit your application. Most LOUs offer online applications with turnaround times of 1-3 business days.
4. Renew annually. Set a calendar reminder. Lapsed LEIs create compliance issues.

For ICT Providers

You can't obtain an LEI on behalf of another entity—they must apply themselves. However, you can:

• Request they obtain one. Explain that DORA requires LEI identification and provide GLEIF application links.
• Use alternative identifiers. When a provider legitimately doesn't have an LEI (and isn't required to), DORA allows EUID, national registration numbers, or other identifiers. Document why an LEI isn't available.
• Check if they already have one. Search GLEIF by company name—some providers have LEIs they haven't communicated.

LEI Renewal: Don't Let It Lapse

LEI renewal is the silent compliance killer. Your entity obtained an LEI in 2019, it worked fine, and no one thought about it again—until you try to submit your DORA register with a lapsed identifier.

Set Up Renewal Reminders

Most LOUs send renewal reminders, but don't rely on them. Create your own:

• Calendar reminders 60 and 30 days before expiry
• Annual compliance checklist item
• Automated monitoring (some tools do this)

Renewal Process

Renewal is simpler than initial registration:

1. Log in to your LOU's portal
2. Confirm entity information is still accurate
3. Pay the annual fee (typically €50-100)
4. LEI status updates within 24-48 hours

What If You Discover a Lapsed LEI?

Renewing a lapsed LEI is possible but takes longer than routine renewal. The LOU may require updated documentation to verify entity details haven't changed. Budget 3-5 business days for reactivation.

DORA-Specific LEI Requirements

Template B_01.01: Entity Identification

Your entity's LEI appears in the first template and propagates throughout your register. Get this wrong, and cross-template validation fails.

Required LEI fields include:

• Reporting entity LEI
• Parent undertaking LEI (if applicable)
• Ultimate parent undertaking LEI (if applicable)

Template B_03: ICT Third-Party Service Providers

For each ICT provider, you must provide identification. The priority order is:

1. LEI (if available)
2. EUID (European Unique Identifier)
3. National registration number with country code

Cross-Template Consistency

The same entity must have the same LEI across all templates where it appears. A mismatch between B_01 and B_03 triggers validation errors. This sounds obvious, but copy-paste errors and manual data entry make it a common failure point.

FAQs

Conclusion: Verify Before You Submit

LEI errors cost 32% of dry run participants a clean submission. These weren't complex technical failures—they were basic validation issues: wrong format, lapsed status, mismatched entities, missing identifiers.

The fix is straightforward:

1. Verify your own LEI at gleif.org (check status and renewal date)
2. Verify LEIs for all group entities
3. Collect and verify LEIs from ICT providers
4. Use the same LEI consistently across all templates
5. Set up renewal reminders to prevent lapse

Do this before you start building your register, and you've already eliminated one of the top three failure categories.