Cloud renewal for critical portfolio management at an asset manager
Meridian Asset Management is an EU AIFM with €18bn assets under management. It uses a non-EU SaaS provider for portfolio management, order routing and regulatory reporting. The service supports a critical or important function. The contract auto-renews in 60 days. It is governed by the provider's home law, includes only a SOC 2 report instead of audit rights, lets the provider terminate for convenience on 30 days' notice, has no exit assistance, and permits subcontracting without notice. Client data is stored in three regions. The register of information lists the provider but not its subcontractors. Meridian has no documented exit plan and no alternative provider assessment. The provider refuses to accept audit rights or a data-location commitment, citing its global standard terms. The board asks whether it can renew and what to do about concentration risk.
1. Identify the contractual gaps against DORA's ICT third-party requirements and rank them. What must be negotiated before renewal?
Read the worked answer
Gaps and ranking. First, audit and access rights: a SOC 2 report is evidence but not a contractual right to access, inspect and audit the provider and relevant subcontractors. This is critical because Meridian and its supervisor need assurance over a critical function. Second, termination and exit: a 30-day provider termination right with no exit assistance is a continuity risk. Third, subcontracting without notice prevents Meridian from assessing concentration and downstream risk. Fourth, the data-location position is unclear and may affect legal and operational risk. Service levels, cooperation with authorities, business continuity, data return and deletion, and testing cooperation also need to be addressed.
Before renewal. Meridian should classify the service as critical or important and require the full contractual set. It should negotiate audit rights covering subcontractors, a data-location schedule, longer termination notice, exit assistance and a subcontracting notification and approval clause. If the provider refuses, Meridian should not renew as-is without a board-approved risk assessment and an alternative plan. The decision should be documented, time-bound and linked to the exit strategy.
2. Assess Meridian's exit plan and concentration risk. What should the board decide if the provider refuses the key clauses?
Read the worked answer
Exit plan. There is no documented exit plan. That is a serious gap for a critical function. Meridian needs a data export format, transition assistance, escrow or source-code arrangements if relevant, a parallel-run plan, cost and time estimates, and a tested alternative. A 30-day provider termination right makes the absence of an exit plan more severe because Meridian may have little time to move.
Concentration. Meridian depends on one non-EU provider for portfolio management, order routing and regulatory reporting, with no alternative assessment. That is concentration risk at both entity and function level. The board should consider whether the services can be separated, whether a second provider is feasible, and whether the data and process portability are adequate.
Board decision. If the provider refuses audit rights, data-location commitments, exit assistance and subcontracting transparency, the board should not treat renewal as routine. It should either require a short extension with remediation milestones and a signed exit plan, or approve a time-bound risk acceptance with supervisory engagement and a credible migration option. It should not accept indefinite contractual opacity.
3. What register of information and subcontracting issues must be fixed?
Read the worked answer
The register must identify the provider, the services, the critical or important function supported, the data locations, contract expiry and the subcontractors. Listing only the provider is incomplete. Meridian should obtain the subcontractor chain, the services each subcontractor performs, their locations and their materiality. It should assess whether any subcontractor creates a single point of failure or a supervisory access problem.
The contract should require notification before subcontracting changes, the right to object or terminate on material changes, and audit rights over subcontractors. The register should be updated when the contract is renewed or the service changes. Meridian should also reconcile the register with the exit plan and concentration assessment so that the board and supervisor see the same dependencies. Missing subcontractors is not a clerical error; it undermines the entire third-party risk picture.