Your Vendor’s Problem Is Now Yours: What Critical Third-Party Designation Actually Changes

Introduction

When European regulators started designating certain ICT providers as critical under DORA, some organisations read it as good news: a vendor now facing direct supervisory oversight sounded like someone else doing the compliance work. The opposite is true. Designation puts a vendor under a regulator’s microscope. It does not move the financial entity’s own accountability anywhere.

That distinction matters more than most organisations initially assume. Direct oversight of a critical provider gives regulators visibility into that provider’s risk management. It does nothing to change who is responsible if that provider’s services fail and a financial entity cannot demonstrate it managed the relationship properly. This article looks at what critical third-party designation actually changes, what it leaves exactly where it was, and what that means for how organisations manage vendor risk going forward.

• Takeaway 1: Critical third-party designation puts a vendor under direct regulatory oversight. It does not transfer the financial entity’s own accountability for managing that vendor relationship.
• Takeaway 2: The list of designated critical providers changes over time. Providers are added as their footprint grows and can be removed if it shrinks, so a static assessment of vendor risk goes stale.
• Takeaway 3: Concentration risk applies to undesignated vendors just as much as designated ones. A provider not yet on the critical list can still represent a single point of failure for an organisation’s own operations.
• Takeaway 4: Regulators expect evidence of ongoing third-party risk management, not a one-time assessment. A register of contractual arrangements and a record of monitoring activity have to be maintained continuously, not produced once.
• Takeaway 5: Designation changes oversight of the vendor, not the organisation’s own obligation to prove control. Financial entities still have to demonstrate, on their own evidence, that they understand and manage the risk a third party introduces.

Executive Summary

Direct regulatory oversight of critical ICT third-party providers is one of the more visible developments under DORA, and it is often misread as reducing the compliance burden on the financial entities that use those providers. It does not. The designation mechanism exists to manage systemic concentration risk across the financial sector as a whole, through ongoing engagement between regulators and the largest, most interconnected providers. It says nothing about whether any individual financial entity has adequately assessed, documented and monitored its own use of that provider, or of the many providers that never reach critical status at all. For risk and compliance leaders, the practical takeaway is that third-party risk management remains, in full, the organisation’s own responsibility, regardless of who else is watching the vendor.

What Critical Third-Party Designation Actually Does

The designation mechanism exists to give regulators visibility into providers whose failure could have consequences across many financial entities at once, based on factors including systemic impact, the concentration of reliance on that provider, and how easily its services could be substituted.

Designation Is About Systemic Concentration, Not Individual Vendor Risk

A provider gets designated as critical because a large number of financial entities depend on it in ways that could create sector-wide disruption if it failed, not because any single organisation’s contract with that provider is particularly risky. The assessment operates at the level of the financial system as a whole. An individual organisation’s exposure to that same provider, based on how it actually uses the service and what alternatives it has, is a separate question the designation does not answer.

The List Changes, Which Means Vendor Risk Assessment Cannot Be Static

Designated providers are reassessed and the list republished periodically, with providers added as their footprint grows and removed if circumstances change. Providers can also apply to opt in voluntarily. An organisation that treats “is our vendor on the critical list” as a one-time check will find that answer goes stale, sometimes in either direction, without anyone telling them it changed.

Why Your Own Accountability Does Not Move

Oversight of a critical provider by regulators and an organisation’s own duty to manage its relationship with that provider are two entirely separate obligations that happen to involve the same vendor.

Direct Oversight of the Vendor Is Not Oversight of Your Contract

When regulators engage directly with a critical provider, they are assessing that provider’s own risk management, governance and resilience practices at a general level. They are not reviewing any individual financial entity’s specific contract, its exit plan for that provider, or whether that organisation has adequately mapped what would happen if the provider’s service degraded. That remains work only the financial entity itself can do, and remains work regulators expect to see evidence of when they examine the financial entity directly.

Undesignated Providers Still Carry Concentration Risk for You

Because designation operates at the level of the financial sector, a provider that falls just short of the systemic thresholds that trigger designation can still represent a severe single point of failure for the specific organisation relying on it. Treating “not on the critical list” as equivalent to “low risk” confuses a sector-wide assessment with an organisation-specific one. The concentration risk that matters for an individual financial entity is what that entity itself depends on, not what the sector as a whole depends on.

What Regulators Actually Expect an Organisation to Demonstrate

Whether or not a specific vendor is designated critical, financial entities are expected to maintain their own continuous, evidenced understanding of the ICT third parties they rely on.

A Register of Information Is a Living Record, Not a Snapshot

Maintaining an accurate register of contractual arrangements with ICT providers, including which functions each provider supports and how critical those functions are, is an ongoing obligation, not a document produced once for an audit. As vendor relationships change, add subcontractors, or expand into new services, the register has to be kept current, because it is the primary evidence regulators expect an organisation to produce about its own third-party landscape.

Monitoring Has to Be Continuous to Count as Evidence

A due diligence exercise performed once at contract signing does not demonstrate ongoing risk management. Regulators expect to see continuous monitoring of third-party relationships, meaning an organisation needs a record of what it actually observed about a vendor’s performance and security posture over time, not just a point-in-time assessment filed away and never revisited.

Building Third-Party Risk Management That Holds Up Under Scrutiny

The practical response to critical third-party designation is not to relax vendor oversight for undesignated providers or assume designated ones are now someone else’s problem. It is to build an internal capability that continuously tracks which providers support which functions, how concentrated that reliance is, and what evidence exists of ongoing monitoring, so that when a regulator asks about any specific vendor relationship, designated or not, the answer already exists rather than needing to be assembled under pressure.

How a Data Control Plane Supports Continuous Third-Party Risk Evidence

Demonstrating control over third-party ICT risk depends on being able to show, continuously, what data moves through which vendors and channels, who accessed it, and under what conditions, rather than relying on a vendor’s own assurances or a periodic manual review. A governance layer spanning every channel sensitive data moves through, including email, file sharing, APIs and AI agents, becomes the evidence base for an organisation’s own third-party oversight, independent of whichever providers happen to be designated critical in any given year.

The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every send, share and access action across every channel, and captures each one in a tamper-proof, unthrottled audit log that feeds directly into SIEM tooling. For an organisation managing ICT third-party risk under DORA, this means a continuous, queryable record of exactly how sensitive data moves through the vendors and channels the organisation actually uses, evidence that stands on its own regardless of any single provider’s designation status. Single-tenant architecture and customer-owned encryption keys further mean the organisation’s own control over its most sensitive exchanges does not depend on any third party’s oversight status either.

Organisations that want to see how continuous, cross-channel evidence supports their own ICT third-party risk obligations can schedule a custom demo to walk through how it applies to their current vendor landscape.