Third-Party Risk Management: TPRM under DORA, EBA and MaRisk

DORA broadens the scope significantly. While the EBA Outsourcing Guidelines and MaRisk AT

9 focus on outsourcing arrangements, DORA Chapter V covers all contractual arrangements on the use of ICT services — regardless of whether they legally qualify as outsourcing. Financial entities must maintain a register of information on all ICT third-party arrangements, embed the mandatory contractual provisions of Art.

30 DORA, assess ICT concentration risk and define documented exit strategies for services supporting critical or important functions. The EBA Guidelines and MaRisk continue to apply to non-ICT outsourcing, so most institutions need an integrated framework that satisfies both regimes without duplicating work. We design this integration so that one classification logic, one contract standard and one monitoring process serve all applicable requirements.

The register of information under Art. 28(3) DORA is a structured inventory of all contractual arrangements on the use of ICT services provided by third-party providers. It must be maintained at entity, sub-consolidated and consolidated level and be made available to the competent authority, which collects it regularly.

🔍 Key content per the ESA templates:

Effective third-party management is risk-based: not every vendor warrants the same scrutiny. We establish a tiering model that classifies each third party by the criticality of the function it supports, its access to data and systems, its substitutability and the potential concentration risk it creates. This classification then drives the depth of due diligence, the contractual clauses applied, the frequency of reassessments and the intensity of ongoing monitoring. Critical ICT providers under DORA receive full assessments including exit strategy and testing of contractual audit rights, while low-risk suppliers pass through a streamlined process. The result is a defensible allocation of effort: supervisors see a consistent methodology, and your teams spend their time where the risk actually sits.

Subcontracting chains are among the most common findings in supervisory reviews, and DORA explicitly addresses them: financial entities must know which material subcontractors underpin the ICT services supporting critical or important functions and reflect them in the register of information. We help you establish chain transparency in three steps: contractual flow-down clauses that oblige providers to disclose and seek approval for material subcontracting, a structured intake of subcontractor data during due diligence and contract renewal, and ongoing monitoring of changes in the chain. For critical services, we also assess whether subcontracting concentrations — for example on a single cloud provider — create risks that require mitigation or contractual safeguards.

The effort depends primarily on three factors: the size and heterogeneity of your third-party portfolio, the maturity of existing processes and data, and the tooling landscape. A typical implementation follows a clear sequence: first, a complete inventory and gap analysis against DORA, EBA and MaRisk requirements; second, design of the governance framework, classification methodology and contract standards; third, remediation of priority gaps such as the register of information and contracts for critical providers; and finally, rollout of onboarding, monitoring and offboarding processes with supporting workflows. We deliberately prioritize the elements with supervisory deadlines or the highest risk exposure, so your institution reaches a defensible state early while the full framework is completed in manageable stages.

TPRM should not become another silo. We integrate third-party management into your existing GRC architecture so that vendor risks feed the same risk taxonomy, control framework and reporting lines as your other operational risks.

🔍 Typical integration points: