What is concentration risk?
Concentration risk exists when a single provider, technology, site or person carries so many processes that one failure hits them all at once. Article 3(29) of Regulation (EU) 2022/2554 (DORA) defines ICT concentration risk as "an exposure to individual or multiple related critical ICT third-party service providers creating a degree of dependency on such providers so that the unavailability, failure or other type of shortfall of such provider may potentially endanger the ability of a financial entity to deliver critical or important functions …".
Concentration risk is therefore part of ICT third-party risk. It reaches beyond providers, though: a site or a single specialist can also become a shared point of failure. How such points of failure are covered in continuity planning is set out in the business continuity guide.
DORA and MaRisk address concentration under two terms
In the financial sector two terms sit side by side, and they trigger different duties:
| Term | Reference | Subject | Management |
|---|---|---|---|
| ICT concentration risk | Art. 3(29), Art. 29 DORA | dependency on critical ICT third-party service providers | preliminary assessment before contracting, weighing alternatives |
| Risk concentration | MaRisk (Circular 06/2026 (BA)), AT 2.2 no. 1 and AT 4.3.2 no. 1 | exposures to single counterparties and correlated exposures within one risk type or across risk types | identify, assess, limit and monitor effectively, for example through limit or traffic-light systems |
MaRisk is BaFin's set of minimum requirements for risk management in German institutions. It distinguishes intra- and inter-risk concentrations and requires risk concentrations to be considered for all material risks. That includes operational risk, of which ICT risk is a part.
Where does concentration risk come from?
Concentration risk arises in five dimensions; it only becomes visible once the dependencies are brought together in one place:
| Dimension | Example |
|---|---|
| Provider | one provider carries several critical functions |
| Technology | one platform or product sits underneath many processes |
| Site | a data centre or region is a shared point of failure |
| Person | knowledge of a critical system sits with a single specialist |
| Chain | different providers rely on the same upstream supplier |
Hidden concentration sits with the upstream supplier
Hidden concentration sits one level down: three formally independent providers can run on the same infrastructure, the same data centre or the same network operator. A two-provider strategy resting on a shared upstream supplier produces cost but not independence.
Subcontractors and their locations therefore belong in the inventory. How redundant zones at a single cloud provider give technical redundancy but not independence is explored in concentration risk in the cloud.
What does Article 29 DORA require?
Article 29 DORA requires financial entities to assess ICT concentration risk before they contract. The preliminary assessment applies to contracts for ICT services supporting critical or important functions. The assessment is anchored in the pre-contract risk assessment under Article 28(4)(c). The entity has to assess:
- whether the contract would lead to an ICT third-party service provider that is not easily substitutable (Article 29(1)(a));
- whether there would be multiple such contracts with the same or closely connected providers (point (b));
- the benefits and risks of subcontracting, particularly with subcontractors in a third country, and whether long or complex chains impair monitoring (paragraph 2);
- the limits set by the provider's insolvency law and by the urgent recovery of its own data (paragraph 2).
The benefits and costs of alternative solutions, such as using different providers, have to be weighed. DORA deliberately sets no caps: recital 67 considers rigid caps or strict limitations inappropriate, because they might hinder the conduct of business and restrain contractual freedom.
At sector level, Chapter V, Section II (Articles 31 to 44) sets up an oversight framework for critical ICT third-party service providers. The European Supervisory Authorities published a first list of such providers in November 2025. How Article 29 fits into third-party management as a whole is set out in the DORA guide.
Replacement time and substitutability make concentration measurable
Concentration risk can be ranked with five indicators per provider:
| Indicator | Question behind it |
|---|---|
| critical or important functions per provider | How many functions fail together? |
| substitutability in the market | Is there another provider at all? |
| replacement time | How long would a switch actually take? |
| share of data holdings | What part of the data sits with this provider? |
| tested alternative | Is there a tested exit strategy? |
Replacement time says more than the provider's market share once you compare it with the tolerable downtime from the business impact analysis. For financial entities, the register of information under Article 28(3) DORA supplies the contract base, because it records arrangements for critical or important functions separately.
Which measures reduce a concentration risk?
Five measures reduce a concentration risk:
- several providers where the service is interchangeable and independence reaches down to the upstream suppliers;
- portability as a requirement in selection and in the contract: open formats, documented interfaces, data return;
- prepared exit strategies for the providers that carry the most weight;
- separate sites and transmission paths for infrastructure;
- deputising arrangements and documentation against concentration in people.
Several providers bring risks of their own: more interfaces, more access paths, uneven security levels. A single provider can therefore be the better choice when a named risk owner knows the concentration, assesses it and accepts it deliberately.
How Rizzqo models concentrations in the asset register
Rizzqo models concentration risk through the asset register: every provider is a supporting asset, linked to the processes, information and services that depend on it. Dependency relationships connect it to its upstream suppliers. How many primary assets hang on one provider is therefore recorded in the register. The supporting asset takes the confidentiality rating and the personal-data flag of the primary assets it carries.
The risk owner rates the concentration risk itself with a likelihood in per cent and an impact in euros through a configurable matrix. Measures such as an exit strategy run as tasks; their planned risk reduction is reserved and applied on completion.