Fourth-party risk
Also called nth-party risk, subcontractor risk
Fourth-party risk is the risk a firm faces from the suppliers of its suppliers. A bank may contract with a software provider that hosts data with a cloud company. The bank has no contract with that cloud company, yet an outage or breach there can still disrupt the bank's services and customers.
How it works
Firms map the subcontracting chain behind each important supplier. Contracts require the direct supplier to disclose material subcontractors, give notice of changes and pass down security, audit and data obligations. Due diligence questionnaires ask which parties support critical services. Monitoring teams track incidents at those subcontractors as well as at the direct supplier.
The risk matters because a failure several links down the chain hits the firm in the same way as a failure at its own supplier. Regulators hold the firm responsible for the whole chain. Under DORA, financial entities must assess subcontracting of ICT services that support critical or important functions, and record those subcontractors in their register of information.
The rules
Sets what financial entities must assess before and during subcontracting of ICT services that support critical or important functions, including due diligence and monitoring.
EU financial entities within the scope of DORAExpects firms to assess material sub-outsourcing, require notification of changes and keep the right to object or terminate where subcontracting raises risk.
Banks, building societies, PRA-designated investment firms and insurersAsks banks to consider a third party's reliance on subcontractors during due diligence, contracting and ongoing monitoring across the relationship life cycle.
US banking organisations supervised by the three agenciesCommon questions
What is the difference between third-party and fourth-party risk?
Third-party risk comes from suppliers a firm contracts with directly. Fourth-party risk comes from the subcontractors those suppliers use. The firm usually has no contract with a fourth party, so it relies on the direct supplier for information, notice of changes and audit access.
Does DORA cover fourth parties?
Yes. DORA treats subcontracting of ICT services that support critical or important functions as part of the financial entity's own risk. Delegated Regulation (EU) 2025/532 sets the assessment and monitoring the entity must apply to those subcontracting chains.
How do firms find their fourth parties?
Most firms ask suppliers to list material subcontractors in questionnaires and contracts. Some also use external data on supplier technology and hosting. Concentration often appears at this level, when many suppliers rely on the same cloud or data centre provider.
