Research Note

DORA's ICT third-party risk requirements and the cloud concentration problem

ITFG 4 min read

Abstract

The Digital Operational Resilience Act requires financial entities to manage the risks arising from their reliance on ICT third-party providers, and establishes an oversight framework for those providers designated as critical. This note asks a narrower question: whether DORA's instruments are capable of addressing concentration risk, where a small number of cloud providers underpin the operations of a large share of the European financial sector. We examine the register of information, the contractual requirements of Article 30, the exit-strategy obligations, and the critical ICT third-party provider oversight regime, and assess each against the specific mechanics of concentration. We find that DORA improves the visibility and contractual hygiene of individual outsourcing arrangements but does not, on its own, give supervisors an instrument calibrated to a systemic concentration that is already present. The note identifies where the framework's reach ends and what supervisory and structural questions remain open.

The question

The Digital Operational Resilience Act (DORA) entered application across the European Union with a substantial set of obligations governing how financial entities manage their dependence on information and communications technology (ICT) third-party providers. Much of the early compliance attention has concentrated on the entity-level mechanics: maintaining the register of information, renegotiating contracts to meet the Article 30 requirements, and documenting exit strategies. This note sets those mechanics aside in order to ask a narrower and more structural question. The European financial sector’s reliance on cloud infrastructure is concentrated in a small number of hyperscale providers. Does DORA furnish supervisors with an instrument capable of addressing that concentration, as distinct from managing the resilience of any single outsourcing relationship?

Regulatory context

DORA approaches ICT third-party risk through two distinct layers. The first is microprudential and entity-facing: financial entities must classify their ICT services, maintain a register of contractual arrangements, ensure that contracts supporting critical or important functions contain prescribed provisions, and document the means by which they could exit an arrangement without unacceptable disruption. The second layer is the Union Oversight Framework, under which the European Supervisory Authorities may designate certain providers as critical ICT third-party providers (CTPPs) and subject them to direct oversight, including the power to make recommendations and to address findings to the provider itself rather than only to its financial-sector clients. The CTPP regime is the first mechanism in EU financial law to reach a technology provider directly, and it is the natural place to look for an answer to the concentration question.

Analysis

The entity-level layer is essentially additive: it improves the quality and visibility of each outsourcing arrangement but operates on relationships one at a time. The register of information aggregates these relationships and, in principle, allows supervisors to observe sector-wide patterns of dependence. Observation, however, is not the same as a calibrated instrument. Knowing that a large share of regulated entities depend on the same provider does not, by itself, supply a supervisory lever proportioned to that fact.

The CTPP oversight framework comes closer, because it acts on the provider directly. Yet its instruments are oversight recommendations and the escalation mechanisms attached to them, not structural remedies. The framework can require a designated provider to address identified weaknesses in its own resilience; it does not give any authority the power to limit the sector’s aggregate dependence on that provider, to require diversification across providers, or to compel a reduction in concentration that is already established. The exit-strategy obligation, similarly, is calibrated to the failure or exit of a provider relative to a single entity. Where the same provider supports a large fraction of the market simultaneously, the assumption that an entity can transition to an alternative, itself likely one of the same small set of providers, is weaker precisely when concentration is highest.

Open questions

DORA materially strengthens the resilience of individual ICT third-party arrangements and, through the CTPP regime, establishes direct oversight of the providers that matter most. What it does not yet resolve is whether oversight of a critical provider’s own operational resilience is an adequate response to the systemic risk arising from the sector’s collective dependence on a small number of such providers.

Three questions remain open for supervisors and legislators. First, whether the register of information can be developed into a genuine concentration-monitoring instrument rather than a static inventory. Second, whether the oversight framework’s recommendation-based design is sufficient where the relevant risk is structural rather than firm-specific. Third, whether resilience to the failure of a single provider can be assured at all in a market where the realistic alternatives are members of the same concentrated set. This note does not propose a remedy; it identifies the point at which DORA’s instruments, as drafted, reach the limit of their calibration to the concentration problem.