Payments and Market Infrastructure
The Global Risks Alliance (GRA)
Payment and market infrastructures and their participants depend on a few technology providers: cloud platforms, messaging networks, software vendors and data centres. A failure at one can disrupt many institutions at once. This page sets out how third-party concentration risk develops, how it is measured, and the authorities and boards who decide.
GRA · In development · service level R0
Third-party concentration risk is the risk that many financial institutions and infrastructures depend on the same technology providers, so one failure disrupts many. It is hard to see because of subcontracting. Financial authorities, boards, providers and procurement functions hold the decisions.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Third party concentration · RTGS system · Business day 156
Cloud, identity and outsourced systems. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Cloud, messaging and core software markets are concentrated. Institutions that diversify individually may still share the same underlying provider.
Institutions often do not know their providers' subcontractors. Authorities lack a sector-wide map of dependencies.
Migrating away from a core provider takes years. Exit plans exist on paper but may not be executable in a crisis.
Regimes such as DORA designate critical ICT providers for direct oversight. Their effect on resilience is still emerging.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Concentration risk | The risk from dependence on a single provider or a small number of providers. |
| Critical third party | A provider designated by authorities for oversight because of its importance to the financial sector. |
| Exit plan | A documented plan to move a service away from a provider without unacceptable disruption. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Critical ICT third-party providers designated | count | annual | European Supervisory Authorities records | OFFICIAL |
| Share of critical services on top cloud providers | percent | periodic | Supervisory surveys | REPORTED |
| Registers of information on ICT arrangements submitted | count | annual | DORA reporting | OFFICIAL |
| Incidents caused by third parties | count and share of incidents | annual | Incident reports | OFFICIAL |
| Tested exit plans | share of critical arrangements | periodic | Supervisory reviews | DECLARED |
| Fourth-party dependencies identified | count per critical provider | periodic | Institution mapping | REPORTED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| FSB toolkit for third-party risk management and oversight | Terminology and tools | Free, FSB terms |
| European Supervisory Authorities DORA oversight records | Designated critical ICT providers | Free, EU reuse terms |
| Bank of England, PRA and FCA critical third parties regime documents | UK regime for critical third parties | Free, Bank of England terms |
| IMF and BIS reports on cloud concentration in finance | Analysis of concentration risk | Free, IMF and BIS terms |
| Public incident reports by providers | Root causes of major outages | Free to read, terms per provider |
Payments and Market Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Financial authorities | Which providers to designate and oversee | Dependency mapping and incident evidence |
| FMI and institution boards | How much concentration to accept and how to plan exit | Provider dependence and test results |
| Technology providers | How to meet oversight and resilience expectations | Regulatory requirements |
| Procurement functions | Which contract terms protect resilience | Comparable contract practice |
Outsourcing can improve resilience by giving infrastructures access to providers with strong security and redundancy. But concentration creates a common point of failure that individual firms cannot see or manage alone. Authorities in several jurisdictions have introduced oversight of critical third parties to the financial sector, reflecting the shared nature of the risk.
Concentration arises from shared providers, hidden dependencies and limited substitutability.
A small number of cloud providers host a growing share of financial services, including some critical functions.
Identity providers, financial messaging networks and certificate authorities are used across the sector.
Core banking, payment processing and security software from few vendors creates shared vulnerabilities.
Individual institutions can manage their own provider risk through due diligence, contracts and exit plans, but they cannot see how many others depend on the same provider, or what would happen if it failed for everyone at once. That systemic view requires aggregated information across the sector. Building it in a way that respects confidentiality and competition law is one of the clearest cases for shared industry understanding.
Aggregated mapping of provider dependencies across institutions, applying network science and contagion. Requires careful aggregation to protect confidential information.
Analysis of published provider outages and their effects on financial services.
Analysis of how quickly and at what cost functions could move between providers.
Exercises simulating the failure of a major provider across several institutions.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.