Concentration risk
Also called third-party concentration risk, ICT concentration risk
Concentration risk, in third-party management, is the danger of relying heavily on one supplier or a small group of suppliers. If that provider fails, many services stop at once. At market level, regulators worry when many banks and insurers depend on the same cloud or technology firms, so one outage could spread across the sector.
How it works
Firms measure concentration by counting how many important business services rely on each supplier and how easily that supplier could be replaced. They look at location, shared subcontractors and data centres as well as the contract itself. High concentration leads to multi-provider set-ups, tested exit plans or limits on further dependence.
Regulators treat concentration as a systemic issue. DORA requires EU financial entities to assess ICT concentration risk before contracting, and its oversight regime lets the European supervisory authorities supervise designated critical ICT providers directly. The UK has built a separate regime that lets HM Treasury designate critical third parties for oversight by the Bank of England, PRA and FCA.
The rules
Article 29 requires a preliminary assessment of ICT concentration risk before contracting, and Articles 31 to 44 create EU oversight of critical ICT third-party providers.
EU banks, insurers, investment firms, payment firms and other financial entitiesSets resilience, incident reporting and testing duties for third parties whose failure could threaten UK financial stability or confidence.
Third parties designated as critical by HM TreasuryRequire firms to consider concentration risk when outsourcing critical or important functions. EBA/GL/2026/09, published 18 September 2026, will repeal them once it applies.
Credit institutions, investment firms, payment and e-money institutionsCommon questions
Does concentration risk have other meanings?
Yes. In prudential regulation it also means credit concentration, such as large exposures to one borrower, sector or country. Capital rules and large exposure limits cover that meaning. In third-party management the term refers to dependence on a small number of suppliers.
Which providers have been designated under DORA?
The European supervisory authorities published the first list of critical ICT third-party providers on 18 November 2025. It named 19 providers, including cloud, data centre, network and financial technology firms, which are now subject to direct EU oversight.
How is firm-level concentration different from systemic concentration?
Firm-level concentration is one firm's reliance on a single supplier. Systemic concentration is many firms relying on the same supplier. Firms manage the first through their own controls. Regulators address the second through critical third-party oversight.
