Since January 2025, Digital Operational Resilience Act (DORA) Article 29 has required financial institutions to assess vendor concentration risk, and in November 2025 the European Supervisory Authorities (ESA) designated the first 19 Critical Information and Communication Technology Third-Party Providers, putting concentration in front of sector regulators as a named, tracked category for the first time.
Accountability sits with the CIO and CRO, not the vendor or the regulator. Individual due diligence, however rigorous, cannot answer the question that matters: whether a provider, combined with others already in place, concentrates multiple critical functions on the same or a closely connected vendor. A department can clear every review it owes and still have no answer, because that answer only exists at the institutional level.
Not all concentration carries equal risk. Substitutability decides whether a dependency is manageable or a strategic resilience risk, some factors, such as contractual rights, data portability, market alternatives, and skills availability, sit outside the institution's control. Others, such as technical feasibility, migration, time, and cost, are the institution's to fix. A termination clause proves neither. Only a tested exit plan does.
Prioritize concentration by how hard it would be to unwind, not by vendor size. Assign one owner accountable for the factors within reach. Test exit capability before the next renewal locks the exposure in again, not after a failure or an examiner forces the question.
