# Third-Party Risk Governance: From Vendor Register to Steering > Swiss GRC explains how financial institutions move from a vendor register to steering third-party risk under DORA, the EBA outsourcing guidelines and FINMA supervision. It covers register data, continuous risk assessment and reporting to the governing body. - URL: https://swissgrc.com/en/third-party-risk-governance-from-vendor-register-to-steering/ - Publisher: SwissGRC® - Published: 2026-08-29 - Last updated: 2026-09-17 ## Key facts - On 18 November 2025, EBA, EIOPA and ESMA designated 19 critical ICT third-party providers under DORA for the first time, deriving systemic concentration risks from reported register data. - Article 28(3) DORA requires financial entities to maintain a register of all contractual arrangements with ICT third-party providers and to report it to the competent authority. - In Supervisory Communication 03/2024, FINMA identified missing inventories, incomplete controls and insufficient integration of service provider management into the internal control system. - According to FINMA, the share of successful cyberattacks on service providers of financial institutions rose from around 25 percent to 50 percent. - The FINMA Risk Monitor 2024 states that one third of the cyberattacks reported to FINMA occur indirectly via third parties. - The article names as first step the extension of the existing vendor register with fields on criticality and concentration, so that assessment becomes recurring instead of a one-off exercise. Third-party risk management today requires more than a well-maintained vendor list. Supervisory authorities in the EU and Switzerland demand structured registers, a continuously updated risk assessment and regular reporting to the governing body. The first-ever designation of critical ICT third-party providers in November 2025 shows that systemic risks are now being derived from this register data. For GRC functions, this marks the shift from recording to steering, supported by metrics, defined responsibilities and escalation paths. In short Effective governance of third-party risk needs more than a vendor register: it combines structured register data on criticality and substitutability with a continuously updated risk assessment and regular reporting to the governing body. DORA, the EBA guidelines on outsourcing and FINMA supervision require this structure, because a register alone does not remedy the deficiencies in service provider management that supervisory authorities have identified. 19providers Critical ICT third-party providers designated for the first time by EBA, EIOPA and ESMA under DORA European Banking Authority, press release, 18 November 2025 50% Share of successful cyberattacks on service providers of financial institutions, up from around 25 percent FINMA, Supervisory Communication 03/2024, 7 June 2024 1/3 Share of cyberattacks reported to FINMA that occur indirectly via third parties FINMA Risk Monitor 2024, cited in Handelszeitung Insurance, 19 February 2025 ## What do supervisory authorities require beyond register maintenance? Under Article 28(3) of the [DORA Regulation](https://www.fma.gv.at/en/cross-sectoral-topics/dora/dora-managing-of-ict-third-party-risk/), financial entities must maintain a register of all contractual arrangements with ICT third-party providers and report it to the competent authority. Beyond the register, DORA requires a strategy for ICT third-party risk, due diligence assessments before the use of ICT services, and clear requirements on contract content and exit strategies. The European Banking Authority (EBA) additionally obliges institutions, in its guidelines on outsourcing published in 2019, to inform the governing body regularly about identified risks and to keep the risk assessment continuously updated. These requirements presuppose a structure that goes beyond a plain list of names: data fields on criticality, contract duration, substitutability and concentration must be maintained and evaluated. ## What does the designation of critical ICT third-party providers in November 2025 show? On 18 November 2025, the European Supervisory Authorities EBA, EIOPA and ESMA designated 19 [critical ICT third-party providers](https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital) under DORA for the first time, deriving systemic concentration risks from reported register data. According to the European Insurance and Occupational Pensions Authority (EIOPA), the designation followed a multi-stage process: collection of data from the registers of financial entities, a criticality assessment based on systemic importance, the role played in critical functions and substitutability, and a right of the affected providers to be heard. For financial entities, this means that their own register data no longer serves internal oversight alone, but feeds directly into a supervisory risk analysis. The regulatory overlaps between EBA guidelines, DORA and MaRisk sharpen this requirement further. ## What deficiencies does FINMA identify in service provider management? In Supervisory Communication 03/2024, FINMA identified significant deficiencies in service provider management, including missing inventories, incomplete controls and insufficient integration into the internal control system. The communication is based on Article 29 paragraph 2 of the Financial Market Supervision Act, which governs the reporting obligation for cyberattacks and is in principle also relevant for small and medium-sized asset managers. FINMA also found that cyberattacks on service providers of supervised institutions were successful more often than average; the share of such successful attacks rose in subsequent years from around 25 to over 50 percent. Circular 2018/3 on outsourcing at banks and insurers had already aligned supervisory practice with a principles-based approach and left the materiality assessment of outsourcing arrangements more to the institutions’ own responsibility. A loss of EUR 89 million at an ICT service provider illustrates how quickly gaps in controls can become financially material. ## What structure does effective governance of third-party risk require? Effective governance combines a structured register with a continuously updated risk assessment and regular reporting to the governing body. According to the FINMA Risk Monitor 2024, one third of the cyberattacks on financial institutions reported to FINMA occur indirectly via third parties, which underlines the importance of continuous rather than point-in-time observation. A governance structure must define who assesses criticality, concentration and contractual risk, at what interval this assessment is updated, and which thresholds trigger escalation to executive management. The principle that risk management serves the achievement of objectives, not itself, applies directly to the governance of third-party risk. ## What first step leads from list to steering? The first step is to extend the existing vendor register with fields on criticality and concentration, enabling a recurring assessment rather than a one-off recording exercise. Those responsible for third-party risk management should determine, before the next review of the register, which metrics are reported regularly to executive management, for example the share of critical providers, open audit findings, or contracts without a documented exit strategy. Equally important is clarifying who within the organization is responsible for updating the risk assessment and at what interval this happens. Governance that answers these questions does not automatically satisfy every supervisory requirement, but it creates the basis on which such compliance becomes possible in the first place. Related ### From list to resilient steering The Third-Party Risk Management solution maps register, risk assessment and escalation paths within a single structure, and supports reporting to executive management with traceable data. [Third-Party Risk Management](https://swissgrc.com/en/tprm-software/) For practice ## Key points - Extend the ICT third-party provider register with fields on criticality, substitutability and contract duration, as required by Art. 28(3) DORA. - Establish a recurring risk assessment that is reported regularly to the governing body, as required by the EBA guidelines on outsourcing. - Review internal service provider management against the gaps identified by FINMA: missing inventories, incomplete controls, insufficient integration into the internal control system. - Define thresholds above which a third-party provider triggers escalation to executive management. - Document exit strategies for critical contracts before a supervisory authority asks for them. FAQ ## Frequently asked questions What distinguishes a vendor register from effective third-party risk governance? A vendor register only records names and contracts. Effective governance extends this register with data fields on criticality, substitutability and concentration, links these to a continuously updated risk assessment, and ensures regular reporting to the governing body, as required by DORA and the EBA guidelines. What does Article 28(3) DORA require for the ICT third-party provider register? Article 28(3) DORA obliges financial entities to maintain a register of all contractual arrangements with ICT third-party providers and to report it to the competent supervisory authority. Beyond this, DORA requires a strategy for ICT third-party risk, due diligence assessments before contract conclusion, and clear requirements on contract content and exit strategies. How many critical ICT third-party providers were designated under DORA in November 2025? On 18 November 2025, the European Supervisory Authorities EBA, EIOPA and ESMA designated 19 critical ICT third-party providers under DORA for the first time. The designation was based on register data from financial entities, from which a criticality assessment was derived using systemic importance, role in critical functions, and substitutability. What deficiencies did FINMA identify in service provider management? In Supervisory Communication 03/2024, FINMA identified missing inventories, incomplete controls and insufficient integration of service provider management into the internal control system. It also found that the share of successful cyberattacks on service providers of supervised institutions rose from around 25 to over 50 percent. What share of reported cyberattacks on financial institutions occurs via third parties? According to the FINMA Risk Monitor 2024, one third of the cyberattacks on financial institutions reported to FINMA occur indirectly via third parties. This figure underlines why continuous rather than point-in-time monitoring of third-party risk is necessary. Sources 1. [DORA – Managing of ICT third-party risk](https://www.fma.gv.at/en/cross-sectoral-topics/dora/dora-managing-of-ict-third-party-risk/)Austrian Financial Market Authority (FMA) 2. [Designation of critical ICT third-party providers](https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital)European Banking Authority 3. [Designation of critical ICT third-party providers](https://www.eiopa.europa.eu/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital-2025-11-18_en)European Insurance and Occupational Pensions Authority (EIOPA) 4. [FINMA publishes outsourcing circular](https://www.finma.ch/de/news/2017/12/20171205-mm-rs-outsourcing/)FINMA 5. [Guidelines on outsourcing arrangements EBA/GL/2019/02](https://www.eba.europa.eu/documents/10180/2761380/EBA+revised+Guidelines+on+outsourcing_DE.pdf/5546a705-bff2-43eb-b382-e5c7bed3a2bc)European Banking Authority 6. [Article on the FINMA Risk Monitor 2024](https://www.handelszeitung.ch/insurance/it-auslagerungen-erhohen-cyberrisiken-drastisch-792082)Handelszeitung Insurance ## Frequently asked questions ### What is the difference between a vendor register and third-party risk governance? A vendor register records providers and contracts. Governance adds data on criticality, substitutability and concentration, a continuously updated risk assessment and regular reporting to the governing body. ### What does Article 28(3) DORA require? Financial entities must maintain a register of all contractual arrangements with ICT third-party providers and report it to the competent authority. DORA also requires a strategy for ICT third-party risk, due diligence before using ICT services, and clear requirements on contract content and exit strategies. ### Which deficiencies in service provider management did FINMA identify? In Supervisory Communication 03/2024, FINMA named missing inventories, incomplete controls and insufficient integration into the internal control system. ### Which metrics should be reported to executive management for third-party risk? The article gives as examples the share of critical providers, open audit findings and contracts without a documented exit strategy. It also says the organization must define who updates the risk assessment and at what interval.