Third-party inventory
Also called vendor inventory, third-party register, supplier register
A third-party inventory is a firm's complete record of the outside providers it uses, the services each supplies, the business functions they support and the risk tier assigned. It is the starting point for third-party risk management. Regulators in the EU and UK now require structured versions of it for oversight.
How it works
The inventory pulls data from procurement, contract and finance systems so every supplier with a live contract appears once. Each record links the provider to the services it supports, the data it handles, its subcontractors and its criticality tier. Owners update records at onboarding, renewal and exit. Gaps usually appear where business units buy services directly or where intragroup providers are left out.
Supervisors use the inventory to see concentration and systemic exposure. Under DORA, EU firms keep a register of information on all ICT contracts in set templates and report it to their authority. UK firms will keep a register of material third-party arrangements from March 2027. An incomplete inventory means risk assessments, exit plans and incident reporting rest on missing data.
The rules
Article 28(3) requires financial entities to maintain a register of information on all contractual arrangements for ICT services from third-party providers.
EU financial entities and their ICT third-party service providersSets the standard templates financial entities use to record and report their ICT third-party contracts at entity and group level.
EU financial entities in scope of DORARequires UK firms to notify and keep a register of material third-party arrangements, applying from 18 March 2027.
PRA-regulated and FCA-regulated firmsExpects banking organisations to maintain a complete inventory of third-party relationships and identify those supporting critical activities.
Banking organisations supervised by the Federal Reserve, FDIC and OCCCommon questions
What is the difference between a third-party inventory and a register of information?
A third-party inventory is the firm's own list of all suppliers. The register of information is the DORA version for ICT contracts, kept in prescribed templates and reported to EU supervisors. Most firms build the register from their wider inventory.
Should intragroup providers be included?
Yes. DORA covers ICT services provided by group companies and the PRA does not treat intragroup arrangements as inherently lower risk. Leaving them out hides concentration and dependencies inside the group.
Does the inventory need to show subcontractors?
For critical services, yes. The DORA templates record the ICT supply chain for services supporting critical or important functions. Tracking key subcontractors lets firms see fourth-party concentration that a direct supplier list misses.
Our coverage
News and analysis on third-party risk from RegTech Post.
Read the coverage →RegTech PostDORA: A Complete Overview of Europe’s Digital Operational Resilience ActRead the article →RegTech PostManaging Third-Party Risk: What Legal Teams Must Focus on in 2026Read the article →
