Subcontracting
Also called sub-outsourcing, chain outsourcing
Subcontracting happens when a firm's service provider hands part of the service to another company. In financial regulation it is also called sub-outsourcing. Regulators expect firms to know which subcontractors support critical services, to set conditions on their use and to keep oversight of the whole chain.
How it works
The main contract sets whether the provider may subcontract, which parts of the service can be passed on and the conditions that apply. Providers notify the firm before adding or changing a material subcontractor, and the firm can object or exit. Due diligence, audit rights and data location terms flow down the chain. Firms record material subcontractors in their third-party inventory and, in the EU, in the DORA register of information.
Subcontracting matters because risk sits where the work is done. A failure at a data centre or software supplier two steps removed can stop a bank's payment service. Long chains also hide concentration, as many providers depend on the same few cloud platforms. Supervisors use subcontracting data to map these dependencies across the sector.
The rules
Sets what firms assess before allowing subcontracting of ICT services for critical or important functions, including due diligence, contract terms and monitoring of the chain.
EU financial entities subject to DORARequires ICT contracts to state whether subcontracting of critical or important functions is permitted and under which conditions.
EU financial entities using ICT third-party servicesSection 13.1 sets conditions for sub-outsourcing critical or important functions, including notification of changes and the firm's right to object or terminate.
Credit institutions, investment firms, payment and e-money institutions in the EUChapter 9 expects firms to assess and control material sub-outsourcing, with flow-down of key contract terms and visibility of the supply chain.
Banks, building societies, PRA-designated investment firms and insurersCommon questions
What is the difference between subcontracting and fourth-party risk?
Subcontracting is the act of a provider passing work to another company. Fourth-party risk is the exposure that results. The subcontractor becomes the firm's fourth party, with no direct contract but a real effect on service delivery.
Do firms need to approve every subcontractor?
No. Rules focus on subcontractors that support critical or important functions. For these, contracts require notice of changes and give the firm a right to object or terminate. Lower-risk subcontracting is managed through general contract terms.
How does DORA treat subcontracting?
DORA requires contracts to state whether subcontracting of critical or important functions is allowed. Delegated Regulation (EU) 2025/532 adds detail on risk assessment, contract terms and monitoring. Firms also record relevant subcontractors in the register of information.
