Critical Third-Party Oversight Changes Less Than Banks Think

When European regulators began designating certain ICT providers as critical under DORA, some financial institutions read it as good news: a vendor now facing direct supervisory oversight sounded like someone else doing the compliance work. The opposite is true. Designation puts a vendor under a regulator’s microscope. It does not move the institution’s own accountability anywhere.

That distinction matters more than most institutions initially assume. Direct oversight of a critical provider gives regulators visibility into that provider’s risk management. It does nothing to change who is responsible if that provider’s services fail and an institution cannot demonstrate it managed the relationship properly. This article looks at what critical third-party designation actually changes for financial institutions, what it leaves exactly where it was, and what that means for how vendor risk gets managed going forward.

Executive Summary

Direct regulatory oversight of critical ICT third-party providers is one of the more visible developments under DORA, and it is often misread as reducing the compliance burden on the financial entities that use those providers. It does not. The designation mechanism exists to manage systemic concentration risk across the financial sector as a whole, through ongoing engagement between regulators and the largest, most interconnected providers. It says nothing about whether any individual institution has adequately assessed, documented and monitored its own use of that provider, or of the many providers that never reach critical status at all. For risk and compliance leaders, the practical takeaway is that third-party risk management remains, in full, the institution’s own responsibility, regardless of who else is watching the vendor.

Key Takeaways

1. Critical third-party designation puts a vendor under direct regulatory oversight. It does not transfer the institution’s own accountability for managing that vendor relationship.
2. The list of designated critical providers changes over time. Providers are added as their footprint grows and can be removed if it shrinks, so a static assessment of vendor risk goes stale.
3. Concentration risk applies to undesignated vendors just as much as designated ones. A provider not yet on the critical list can still represent a single point of failure for a specific institution’s own operations.
4. Regulators expect evidence of ongoing third-party risk management, not a one-time assessment. A register of contractual arrangements and a record of monitoring activity have to be maintained continuously.
5. Designation changes oversight of the vendor, not the institution’s own obligation to prove control. Financial entities still have to demonstrate, on their own evidence, that they understand and manage the risk a third party introduces.

What Critical Third-Party Designation Actually Does

The designation mechanism exists to give regulators visibility into providers whose failure could have consequences across many financial entities at once, based on factors including systemic impact, concentration of reliance, and how easily services could be substituted.

Designation Is About Systemic Concentration, Not Individual Vendor Risk

A provider gets designated as critical because a large number of financial entities depend on it in ways that could create sector-wide disruption if it failed, not because any single institution’s contract with that provider is particularly risky. An individual institution’s exposure to that same provider, based on how it actually uses the service, is a separate question the designation does not answer.

The List Changes, Which Means Vendor Risk Assessment Cannot Be Static

Designated providers are reassessed and the list republished periodically, with providers added as their footprint grows and removed if circumstances change. An institution that treats “is our vendor on the critical list” as a one-time check will find that answer goes stale, without anyone telling them it changed.

Why Your Own Accountability Does Not Move

Oversight of a critical provider by regulators and an institution’s own duty to manage its relationship with that provider are two entirely separate obligations that happen to involve the same vendor.

Direct Oversight of the Vendor Is Not Oversight of Your Contract

When regulators engage directly with a critical provider, they assess that provider’s own risk management at a general level. They are not reviewing any individual institution’s specific contract, its exit plan, or whether it has mapped what would happen if the provider’s service degraded. That remains work only the institution itself can do.

Undesignated Providers Still Carry Concentration Risk for You

Because designation operates at the level of the financial sector, a provider that falls just short of the systemic thresholds can still represent a severe single point of failure for the specific institution relying on it. The concentration risk that matters for an individual institution is what that institution itself depends on, not what the sector as a whole depends on.

What Regulators Actually Expect an Institution to Demonstrate

Whether or not a specific vendor is designated critical, financial entities are expected to maintain their own continuous, evidenced understanding of the ICT third parties they rely on.

A Register of Information Is a Living Record, Not a Snapshot

Maintaining an accurate register of contractual arrangements with ICT providers, including which functions each provider supports, is an ongoing obligation, not a document produced once for an audit.

Monitoring Has to Be Continuous to Count as Evidence

A due diligence exercise performed once at contract signing does not demonstrate ongoing risk management. Regulators expect to see continuous monitoring, meaning an institution needs a record of what it actually observed about a vendor’s performance over time.

Building Third-Party Risk Management That Holds Up Under Scrutiny

The practical response to critical third-party designation is not to relax vendor oversight for undesignated providers. It is to build an internal capability that continuously tracks which providers support which functions, how concentrated that reliance is, and what evidence exists of ongoing monitoring.

How a Data Control Plane Supports Continuous Third-Party Risk Evidence

Demonstrating control over third-party ICT risk depends on being able to show, continuously, what data moves through which vendors and channels, who accessed it, and under what conditions, rather than relying on a vendor’s own assurances.

The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every send, share and access action across every channel, and captures each one in a tamper-proof, unthrottled audit log that feeds directly into SIEM tooling. For an institution managing ICT third-party risk under DORA, this means a continuous, queryable record of exactly how sensitive data moves through the vendors and channels the institution actually uses, evidence that stands on its own regardless of any single provider’s designation status. Single-tenant architecture and customer-owned encryption keys further mean the institution’s own control over its most sensitive exchanges does not depend on any third party’s oversight status either.

Institutions that want to see how continuous, cross-channel evidence supports their own ICT third-party risk obligations can schedule a custom demo to walk through how it applies to their current vendor landscape.