Single-Provider Concentration

Single-provider concentration arises when one provider, or one provider group, supports so many important services that its failure, withdrawal, or serious deterioration would affect the firm broadly rather than in one corner. The risk is not that a supplier is large or successful. The risk is that the firm's ability to keep important services running, and to recover them, depends heavily on one external organisation whose problems become the firm's problems at the same time.

That breadth is what distinguishes concentration from ordinary dependence. Almost every firm depends on suppliers. Concentration describes the case where dependence is so widespread, or so deep in critical functions, that disruption cannot be contained to one service. Planning then has to consider the provider as a whole, including its group, its own suppliers, and its capacity to support recovery, rather than treating each contract as a separate relationship.

Provider groups create a particular trap. A firm may contract with different legal entities, under different brand names, for different services, and reasonably believe it has spread its risk. If those entities share ownership, leadership, platforms, support teams, or financial strength, a problem in the group can affect them together. A decision to withdraw a service, a restructuring, or a serious incident in a shared platform may reach all of them, even when the contracts were negotiated separately.

The same point applies to resold services. A supplier may present a service as its own while relying heavily on another provider for a core part of it. In that case the firm has two layers of dependence: on the direct supplier for the relationship and service management, and on the underlying provider for the actual delivery. Understanding single-provider concentration therefore requires looking through the contracting structure to the organisation and platform that actually deliver the service.

An outage is the most visible form of provider failure, but it is not the only one. A provider might degrade in quality, lose key staff, change its service in a way that no longer fits the firm's needs, or decide to exit a market. It might face financial difficulty, regulatory action, or a security incident that limits its ability to support customers. Each of those paths can affect a concentrated firm differently, and each needs different contingency thinking.

A firm that only plans for a short outage may be unprepared for a prolonged deterioration or an exit. Exit planning in particular raises questions that an outage plan does not: whether an alternative provider exists, whether data can be moved, whether the service can be brought in-house, and how long a transition would realistically take. Those questions are easier to ask while the provider relationship is healthy than during a crisis, which is why concentration assessment is linked to exit and substitutability thinking in DORA's third-party framework.

Consider an illustrative firm that relies on one provider group for market data, order routing support, and post-trade record keeping. Each function might have its own agreement and its own support contact, and day to day the arrangement may work well. If the group suffers a platform incident that affects its shared infrastructure, the firm could lose market data, routing support, and record keeping together, at the moment when accurate information and reliable records matter most.

The illustration shows why testing matters. Testing each function separately would not reveal the shared infrastructure risk. Testing a scenario in which the provider group as a whole is unavailable would. It would also reveal practical details, such as whether staff know which alternative sources exist, whether records can be reconstructed, and whether customers and counterparties can be kept informed. Those details are the substance of concentration risk, beyond the label.

Concentration can also change bargaining and oversight in practice. A firm that depends heavily on one provider may find it harder to obtain information, to negotiate protections, or to enforce service expectations, because replacing the provider is difficult. That difficulty does not imply any wrongdoing by the provider. It is a structural feature of dependence, and it can affect how quickly problems are disclosed and resolved.

Recognising that dynamic helps a firm set realistic expectations. It may need to invest more in monitoring, in contractual information rights, and in its own understanding of the service, precisely because switching is hard. It may also need to be candid internally about where its leverage is limited, so that risk decisions are not based on an assumed ability to move quickly that does not exist in practice.