7. Management of ICT Third Party Risk Under the Digital Operational Resilience Act

Almost a decade ago, the Great Recession revealed that financial institutions behaved in matters that the public authorities were not able to regulate or supervise. Nowadays, the unprecedented technological advancement, the impact of SARS-COV II that forced a lot of activities to be delivered digitally, the social movement of platform economy and other reasons lead financial institutions to swift their modus operandi and turn to third parties, mostly those third parties being tech companies. Outsourcing and strategic alliances between FI and companies are not something new for regulators and supervisors. Even in terms of financial technology outsourcing, there are examples of ad hoc regulatory frameworks, e.g., European Supervisory Agencies outsourcing guidelines of 2019, the Directive on Security of Network and Information Systems, the General Data Protection Regulation, etc. Yet the objects of these new alliances, e.g., blockchain-based services, AI etc., are new entries for regulators and supervisors. With new opportunities come new risks. In the EU and under the agenda of the Digital Finance Package, for the first time, the legislator is trying to create a path to regulating and supervising information and communications technology risks (ICT risks) created by third parties. The present article provides a first take of the under-construction framework Digital Operational Resilience Act (DORA) for the management of ICT third-party risk and provides possible recommendations according to EU law key principles, e.g., proportionality and to the Scopes of DORA.