Third-party / ICT third-party risk and governance
Domain 4 - Third-party / ICT third-party risk and governance. This domain tests Chapter V: how financial entities select, contract with, monitor and exit ICT providers, and how the EU oversees providers designated as critical.
Entity-level duties
The entity remains responsible for compliance. It must maintain a register of information on all contractual arrangements with ICT third-party providers, report it at least annually and on request, and assess concentration risk at entity and sector level. Due diligence precedes contracting; monitoring continues through the lifecycle. Contracts must include clear service descriptions, data location, security and availability commitments, access and audit rights, subcontracting conditions, termination rights, exit strategies and cooperation with authorities. The management body approves the third-party strategy.
Critical providers and oversight
ESAs may designate an ICT third-party provider as critical where its failure could affect financial stability, citing systemic impact, criticality, dependence and substitutability. A lead overseer coordinates oversight, can issue recommendations and request information, and may impose periodic penalties for non-compliance.
Worked example
A bank outsources core banking to a cloud provider. The contract gives the provider unilateral subcontracting rights and no audit rights. The bank's register lists the contract but not the subcontractor. The failures are contractual (Article 30), register-related (Article 28) and concentration-related (Article 29). The bank cannot argue that the provider is responsible: DORA places the obligation on the bank.
Traps
Treating the register as a one-off; omitting exit plans because the service is not critical; assuming a provider's own regulatory status satisfies DORA; and confusing designation as a critical ICT third-party provider with the entity's own critical-function classification.