Outsourcing to Group Entities

Outsourcing to group entities means a financial entity obtains an ICT function from another company in its own group, such as a shared technology company or a service company owned by the parent. Familiarity can make such arrangements feel lower risk, because the provider is known, governed within the same group, and unlikely to disappear as an external vendor might. DORA does not treat that familiarity as a substitute for governance. The financial entity still keeps responsibility for the service, still needs a clear contractual and oversight arrangement, and still needs to show how the group provider will support tolerance and recovery. A group relationship changes how oversight is organised. It does not remove the need for it, and in some respects it makes independent challenge harder, because the parties share management, incentives, and assumptions.

The central risk of group outsourcing is blurred accountability. When the same senior managers oversee both the firm and its group provider, a service problem can be discussed as an internal matter rather than examined as a provider failure affecting a regulated service. Decisions about prioritisation, investment, or remediation may favour group convenience over service need, without anyone intending to weaken resilience. A treasury operations service illustrates the point: if a group technology company supports payment processing for several group firms, a capacity or change decision taken for the group as a whole can affect each firm's service differently. The firm receiving the service needs its own voice in that decision, its own service measures, and its own escalation route, even when the provider sits within the group.

Written terms matter inside a group for the same reasons they matter outside it. An arrangement documented only through group policies, service catalogues, or informal understandings may leave gaps on service scope, performance expectations, information rights, audit access, sub-contracting, location, and exit or continuity if the group structure changes. Those gaps become visible during a disruption, when the firm needs a specific provider action at a specific moment, or during a supervisory examination, when the firm needs to show what was agreed. Formal terms do not imply distrust within a group. They create clarity about what the provider will do, what the firm will do, and what happens when either side cannot meet its part. That clarity protects both parties when pressure is high.

Concentration is a further group-specific concern. A shared group provider often supports many firms, services, or jurisdictions at once, so a single failure, change, or security event can affect a wide set of services simultaneously. That concentration can be efficient, because specialist knowledge and investment are pooled, but it also means that recovery priorities must be agreed in advance. If several group firms need the same provider resource during a disruption, the firm needs to know where its service stands in that queue and what interim measures are available. Without that understanding, a firm may assume priority it does not have, or discover during a disruption that group recovery is sequenced for the group rather than for its own service.

Oversight of a group provider needs deliberate independence. The firm should monitor service outcomes, review provider performance, and challenge gaps through a forum that can act even when the provider is a group colleague. That forum needs information that is not filtered by the provider alone, such as the firm's own service measures and incident experience. It also needs a record of decisions, so that challenge and remediation can be shown over time. Where oversight is folded into general group governance without a service-specific view, it can become a discussion of group technology strategy rather than an examination of whether a particular service is resilient. The distinction matters, because strategy discussions do not recover services.

Continuity planning for group arrangements should consider group change as well as provider failure. A reorganisation, a sale, a change in group strategy, or a decision to centralise or decentralise technology can alter the provider, its location, or its priorities. An arrangement that depends on an informal group understanding may not survive such a change intact. A firm therefore benefits from terms and plans that address continuity through group change, including notice, transition support, and access to data and knowledge. The aim is not to plan for group failure. It is to ensure that a service owned by the firm does not become hostage to a group decision taken for reasons unrelated to that service.