Concentration Risk and Critical Third Parties

Concentration risk under DORA is the risk that a single failure, or a single point of weakness, harms several important services at the same time. That weakness might be one provider, one region, one technology, or one chain of sub-providers that many firms rely on without realising how far the chain reaches. The question is therefore not whether a firm uses a well known supplier. The question is how many of its important services would be affected together if that supplier, region, technology, or chain failed, and what would be lost while recovery was under way.

DORA addresses that question in two linked ways. Financial entities must manage third-party risk and understand their dependencies, including concentration. Separately, certain ICT third-party providers can be designated as critical and brought under an oversight framework run by the European Supervisory Authorities. The framework does not replace a firm's own responsibility for its services. It adds a layer of supervision where a provider is important enough that its failure could affect the sector as a whole.

A contract by contract view can look reassuring while hiding the real exposure. A firm might hold separate agreements for payments processing, customer messaging, fraud screening, and data storage, and count four suppliers. If those agreements all depend on the same underlying cloud platform, the same data centre region, or the same subcontractor for a key component, the firm has not diversified its risk in any meaningful sense. It has diversified its paperwork.

The same logic applies across firms. When many financial entities use the same provider for the same kind of service, an incident at that provider can become a sector event rather than a single firm event. Supervisors therefore need a picture that joins up individual firm views. That is why concentration is described in this cluster as a firm-wide and sector-wide measure. It asks what fails together, not merely what is bought from whom.

Concentration can take several forms, and a firm may face more than one at once. Provider concentration arises when important services depend on one provider or on several providers within one group. Geographic concentration arises when services depend on one region, so a local power failure, natural event, or connectivity loss affects them together. Technology concentration arises when services share one platform, one software component, or one way of connecting, so a single defect or outage spreads across them.

Chain concentration is quieter and often harder to see. A direct supplier may itself rely on a small number of sub-providers for hosting, security monitoring, or data processing. The firm may never deal with those sub-providers directly, yet its services depend on them. Mapping that chain is part of understanding concentration, because a contract with a direct supplier alone does not describe the full dependency. Where information about sub-providers is limited, that limit itself is relevant to the risk picture.

The oversight framework is aimed at ICT third-party providers whose services are critical to financial entities. Designation is a supervisory decision based on criteria in DORA, and it brings the provider within oversight led by a Lead Overseer, with joint examination work involving the European Supervisory Authorities. The framework includes information requests, recommendations, and follow-up, and it is designed to address risks that no single firm could manage alone because the provider serves many firms.

For a financial entity, designation does not change the basic point that the entity remains responsible for its own important services. Oversight of a provider can improve information and coordination, but it does not make the provider's service resilient on the firm's behalf, and it does not remove the need for the firm to plan for disruption. The practical value for a firm lies in better visibility of a shared dependency, and in clearer expectations about how findings and recommendations are handled.

Consider an illustrative retail payments service. Customers initiate payments through an app, the payments are checked and routed, and settlement information is recorded. On paper, the firm might use different suppliers for the app hosting, the routing service, and the record keeping. A closer map might show that the routing service and the record keeping both run in the same region, on the same platform, and through the same connectivity provider. A regional outage would then affect both functions at once, even though the contracts look separate.

Once the shared region and platform are visible, the firm can ask useful questions: which customer journeys stop, which payments are delayed, what manual or alternative route exists, and what information customers and staff need during the disruption. They are answered by tracing what the service actually needs in order to run.