Article 29Preliminary assessment of ICT concentration risk at entity level
1. When performing the identification and assessment of risks referred to in Article 28(4), point (c), financial entities shall also take into account whether the envisaged conclusion of a contractual arrangement in relation to ICT services supporting critical or important functions would lead to any of the following:
(a) contracting an ICT third-party service provider that is not easily substitutable; or
(b) having in place multiple contractual arrangements in relation to the provision of ICT services supporting critical or important functions with the same ICT third-party service provider or with closely connected ICT third-party service providers.
Financial entities shall weigh the benefits and costs of alternative solutions, such as the use of different ICT third-party service providers, taking into account if and how envisaged solutions match the business needs and objectives set out in their digital resilience strategy.
2. Where the contractual arrangements on the use of ICT services supporting critical or important functions include the possibility that an ICT third-party service provider further subcontracts ICT services supporting a critical or important function to other ICT third-party service providers, financial entities shall weigh benefits and risks that may arise in connection with such subcontracting, in particular in the case of an ICT subcontractor established in a third-country.
Where contractual arrangements concern ICT services supporting critical or important functions, financial entities shall duly consider the insolvency law provisions that would apply in the event of the ICT third-party service provider’s bankruptcy as well as any constraint that may arise in respect to the urgent recovery of the financial entity’s data.
Where contractual arrangements on the use of ICT services supporting critical or important functions are concluded with an ICT third-party service provider established in a third country, financial entities shall, in addition to the considerations referred to in the second subparagraph, also consider the compliance with Union data protection rules and the effective enforcement of the law in that third country.
Where the contractual arrangements on the use of ICT services supporting critical or important functions provide for subcontracting, financial entities shall assess whether and how potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions and the ability of the competent authority to effectively supervise the financial entity in that respect.
DORA, the European Union regulation on digital operational resilience, Article 29
Concentration risk, assessed before signing rather than discovered afterwards. When identifying and assessing risks under Article 28(4)(c), for arrangements covering ICT services that support critical or important functions, entities must consider whether the arrangement would mean contracting a provider that is not easily substitutable, or holding multiple such arrangements with the same provider or closely connected providers. They must weigh the benefits and costs of alternatives, such as different providers, against their business needs and digital resilience strategy.
Where the contract allows the provider to subcontract a service supporting a critical or important function, the entity must weigh the benefits and risks, particularly where a subcontractor is established in a third country. For any arrangement supporting a critical or important function it must also consider the insolvency law that would apply if the provider failed, and any constraint on urgent recovery of its data. Where the provider itself is in a third country, it must also consider compliance with Union data protection rules and the effective enforcement of law there.
The entity must also assess whether long or complex subcontracting chains could limit its ability to monitor the contracted functions, or the authority’s ability to supervise it.
Article 28(4)(c) names concentration risk as a risk to assess; this article says what to look at. It asks the entity to weigh these matters and sets no limit on acceptable concentration. The subcontracting detail is in Commission Delegated Regulation (EU) 2025/532, made under Article 30(5); check the current text for amendments.
What is in the packs for this
Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
in DORA ICT Risk & Resilience Readiness
Requirement Library rows RQ-46, RQ-50: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
in DORA ICT Risk & Resilience Readiness
Readiness items TP-03, TP-05 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
ICT Third-Party Arrangements Register — Working CopyExcel
in DORA ICT Risk & Resilience Readiness
The Arrangements sheet shows substitutability and several arrangements with one provider; the Supply chain and Providers sheets show subcontractors and their rank.
DORA Documentation & Evidence ChecklistExcel
in DORA ICT Risk & Resilience Readiness
Evidence records EV-28, EV-32: the records a supervisor can ask for under the provision, with who keeps them and for how long.
Supplier Criticality & Tiering ModelWord
in Third-Party Security Risk Management
Concentration looks across suppliers for providers that several critical services depend on, using the substitutability criterion TC-4.
Supplier Security Risk RegisterExcel
in Third-Party Security Risk Management
Counts critical services per provider (TPM-04) with substitutability (TC-4) and exit plan, to show concentration.
Third-Party Risk DashboardExcel
in Third-Party Security Risk Management
The Concentration view lists providers that several critical services depend on, with their exit plans.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.