Third-Party Risk Governance: From Vendor Register to Steering

Third-party risk management today requires more than a well-maintained vendor list. Supervisory authorities in the EU and Switzerland demand structured registers, a continuously updated risk assessment and regular reporting to the governing body. The first-ever designation of critical ICT third-party providers in November 2025 shows that systemic risks are now being derived from this register data. For GRC functions, this marks the shift from recording to steering, supported by metrics, defined responsibilities and escalation paths.

What do supervisory authorities require beyond register maintenance?

Under Article 28(3) of the DORA Regulation, financial entities must maintain a register of all contractual arrangements with ICT third-party providers and report it to the competent authority. Beyond the register, DORA requires a strategy for ICT third-party risk, due diligence assessments before the use of ICT services, and clear requirements on contract content and exit strategies. The European Banking Authority (EBA) additionally obliges institutions, in its guidelines on outsourcing published in 2019, to inform the governing body regularly about identified risks and to keep the risk assessment continuously updated. These requirements presuppose a structure that goes beyond a plain list of names: data fields on criticality, contract duration, substitutability and concentration must be maintained and evaluated.

What does the designation of critical ICT third-party providers in November 2025 show?

On 18 November 2025, the European Supervisory Authorities EBA, EIOPA and ESMA designated 19 critical ICT third-party providers under DORA for the first time, deriving systemic concentration risks from reported register data. According to the European Insurance and Occupational Pensions Authority (EIOPA), the designation followed a multi-stage process: collection of data from the registers of financial entities, a criticality assessment based on systemic importance, the role played in critical functions and substitutability, and a right of the affected providers to be heard. For financial entities, this means that their own register data no longer serves internal oversight alone, but feeds directly into a supervisory risk analysis. The regulatory overlaps between EBA guidelines, DORA and MaRisk sharpen this requirement further.

What deficiencies does FINMA identify in service provider management?

In Supervisory Communication 03/2024, FINMA identified significant deficiencies in service provider management, including missing inventories, incomplete controls and insufficient integration into the internal control system. The communication is based on Article 29 paragraph 2 of the Financial Market Supervision Act, which governs the reporting obligation for cyberattacks and is in principle also relevant for small and medium-sized asset managers. FINMA also found that cyberattacks on service providers of supervised institutions were successful more often than average; the share of such successful attacks rose in subsequent years from around 25 to over 50 percent. Circular 2018/3 on outsourcing at banks and insurers had already aligned supervisory practice with a principles-based approach and left the materiality assessment of outsourcing arrangements more to the institutions’ own responsibility. A loss of EUR 89 million at an ICT service provider illustrates how quickly gaps in controls can become financially material.

What structure does effective governance of third-party risk require?

Effective governance combines a structured register with a continuously updated risk assessment and regular reporting to the governing body. According to the FINMA Risk Monitor 2024, one third of the cyberattacks on financial institutions reported to FINMA occur indirectly via third parties, which underlines the importance of continuous rather than point-in-time observation. A governance structure must define who assesses criticality, concentration and contractual risk, at what interval this assessment is updated, and which thresholds trigger escalation to executive management. The principle that risk management serves the achievement of objectives, not itself, applies directly to the governance of third-party risk.

What first step leads from list to steering?

The first step is to extend the existing vendor register with fields on criticality and concentration, enabling a recurring assessment rather than a one-off recording exercise. Those responsible for third-party risk management should determine, before the next review of the register, which metrics are reported regularly to executive management, for example the share of critical providers, open audit findings, or contracts without a documented exit strategy. Equally important is clarifying who within the organization is responsible for updating the risk assessment and at what interval this happens. Governance that answers these questions does not automatically satisfy every supervisory requirement, but it creates the basis on which such compliance becomes possible in the first place.

FAQ

Frequently asked questions

What distinguishes a vendor register from effective third-party risk governance?

A vendor register only records names and contracts. Effective governance extends this register with data fields on criticality, substitutability and concentration, links these to a continuously updated risk assessment, and ensures regular reporting to the governing body, as required by DORA and the EBA guidelines.

What does Article 28(3) DORA require for the ICT third-party provider register?

Article 28(3) DORA obliges financial entities to maintain a register of all contractual arrangements with ICT third-party providers and to report it to the competent supervisory authority. Beyond this, DORA requires a strategy for ICT third-party risk, due diligence assessments before contract conclusion, and clear requirements on contract content and exit strategies.

How many critical ICT third-party providers were designated under DORA in November 2025?

On 18 November 2025, the European Supervisory Authorities EBA, EIOPA and ESMA designated 19 critical ICT third-party providers under DORA for the first time. The designation was based on register data from financial entities, from which a criticality assessment was derived using systemic importance, role in critical functions, and substitutability.

What deficiencies did FINMA identify in service provider management?

In Supervisory Communication 03/2024, FINMA identified missing inventories, incomplete controls and insufficient integration of service provider management into the internal control system. It also found that the share of successful cyberattacks on service providers of supervised institutions rose from around 25 to over 50 percent.

What share of reported cyberattacks on financial institutions occurs via third parties?

According to the FINMA Risk Monitor 2024, one third of the cyberattacks on financial institutions reported to FINMA occur indirectly via third parties. This figure underlines why continuous rather than point-in-time monitoring of third-party risk is necessary.

Sources

1. DORA – Managing of ICT third-party riskAustrian Financial Market Authority (FMA)
2. Designation of critical ICT third-party providersEuropean Banking Authority
3. Designation of critical ICT third-party providersEuropean Insurance and Occupational Pensions Authority (EIOPA)
4. FINMA publishes outsourcing circularFINMA
5. Guidelines on outsourcing arrangements EBA/GL/2019/02European Banking Authority
6. Article on the FINMA Risk Monitor 2024Handelszeitung Insurance