In today’s highly digitised financial ecosystem, resilience is no longer just about internal processes and controls. Increasingly, regulators and risk managers are turning their attention to the extended enterprise — specifically, the vulnerabilities introduced by third-party technology providers.
Outsourcing has delivered clear efficiency gains, enabling financial institutions to scale, innovate, and reduce operational costs. But as reliance on third-party vendors grows, so too does the associated risk. A disruption at a key technology partner — whether from a cyberattack, system outage, or compliance failure — can have immediate and far-reaching impacts.
The Regulatory Spotlight on Third Parties
Regulators are now placing third-party risk front and centre. Nowhere is this more evident than in the EU’s Digital Operational Resilience Act (DORA). Adopted in 2022 and set to apply from January 2025, DORA aims to strengthen the financial sector’s ability to withstand ICT-related disruptions.
Under DORA, financial entities will be required to:
- Identify and classify all ICT third-party providers
- Monitor concentration risk and critical dependencies
- Include specific risk and resilience provisions in outsourcing contracts
- Report major ICT incidents — including those affecting external vendors
This marks a significant shift in accountability. Organisations will be expected not only to manage their own digital resilience, but to ensure their vendors meet the same high standards.
Why Third-Party Risk Is So Complex
Managing third-party risk is inherently challenging. Vendors often operate across borders, use subcontractors, and provide black-box systems that are difficult to audit. In many cases, financial institutions may not have full visibility into how — or where — critical services are delivered.
Common risk drivers include:
- Limited transparency into vendor risk management frameworks
- Overdependence on a small number of large cloud or infrastructure providers
- Gaps in contractual terms related to data protection and incident response
- Slow communication during crises or service disruptions
The consequences of a breakdown in these relationships can range from data breaches to regulatory penalties and reputational damage.
What DORA Requires from Financial Institutions
DORA introduces a consistent set of rules across EU member states for financial firms and their ICT vendors. Among its key third-party provisions are:
- Contractual Clarity: Agreements must include service level expectations, audit rights, data access, and incident reporting procedures.
- Risk Assessments: Regular reviews of critical ICT service providers to assess their resilience posture and risk exposure.
- Exit Strategies: Institutions must have plans in place for disengaging or replacing a vendor without disrupting service delivery.
- Register of Providers: Firms must maintain detailed inventories of their ICT third-party relationships.
Compliance will require close collaboration between risk, legal, procurement, and IT functions — along with a fundamental shift in how vendor relationships are managed and monitored.
The Rise of Critical ICT Third-Party Providers
DORA also introduces a new category: critical ICT third-party service providers (CTPPs). These are external companies whose failure would have a systemic impact on financial services across the EU.
CTPPs will be subject to direct oversight by the European Supervisory Authorities (ESAs), including targeted audits, resilience testing, and mandatory compliance actions. This adds another layer of scrutiny for vendors — and for the firms that rely on them.
Financial institutions will need to track which of their vendors fall into this category and adjust their risk management approach accordingly.
Building a Strong Third-Party Risk Framework
To stay ahead of these requirements — and reduce exposure — many firms are reassessing their entire third-party risk framework. Leading practices include:
- Establishing a centralised third-party risk management (TPRM) function
- Segmenting vendors by criticality and risk profile
- Conducting enhanced due diligence on high-risk providers
- Integrating resilience testing into the procurement lifecycle
- Developing standard contract templates with embedded resilience clauses
Automation tools and third-party risk platforms can also support consistent data collection, workflow management, and reporting across the vendor landscape.
Internal Alignment Is Key
Managing third-party risk is not just a compliance task. It requires clear roles, shared accountability, and cross-functional coordination. Legal teams must ensure contracts are enforceable, IT must assess technical controls, and compliance must align internal policies with external expectations.
Boards and executive teams also need to be engaged — particularly where risk exposure relates to systemic or high-profile providers.
Looking Ahead
The regulatory burden around ICT risk will continue to grow. But beyond compliance, there’s a strategic imperative: third-party resilience is business resilience. Organisations that invest in visibility, accountability, and robust frameworks will be better positioned to mitigate disruption, maintain trust, and scale with confidence.
That’s why many are focusing on addressing third-party risk under the DORA framework — not just to meet legal requirements, but to build a foundation for long-term operational strength.