Third-party risk management (TPRM)
When a financial market participant uses an ICT service provided by a third party, it must ensure compliance with the requirements set out in Regulation (EU) 2022/2554 (DORA) throughout the entire life cycle of the service – from pre-contract assessment to ongoing monitoring and termination.
1. Before concluding the contract
Prior to entering into a contract, the institution must:
- Identify whether the ICT service supports a critical or important function, or a function whose disruption would significantly impair the financial entity’s financial performance, service continuity, or ability to meet obligations. Examples include payment processing, settlements, cloud infrastructure supporting core services, or the processing and storage of customer data. Additional requirements apply when contracting for such services.
- Assess the service provider’s reputation, experience, service quality, and compliance with regulatory requirements, including cybersecurity and business continuity capabilities (Article 28(4) of DORA).
- Identify and evaluate operational and reputational risks, including cyber, technological, geopolitical, and compliance risks, arising from the use of the third-party service.
2. Contracting and commencement of service
When concluding the contract and initiating service use, the institution must:
- Include all mandatory contractual requirements as set out in Article 30 of DORA. For services supporting critical or important functions, the contractual requirements of RTS 2024/1773 must also be incorporated. A standardised contract annex may be used, provided it reflects the applicable regulatory requirements. These obligations also extend to ICT services used within a financial group.
- The contract must clearly define, depending on the service type:
- description of the service and allocation of responsibilities;
- service quality, security, and continuity requirements (SLA);
- data processing and protection obligations;
- incident management and notification procedures;
- audit and monitoring rights;
- contract termination and data return/destruction procedures;
- options for selecting alternative service providers and replacing the existing service provider if the contract with the current third-party service provider is terminated or it is no longer possible to receive the relevant service; and
- options for insourcing or re-integrating a function previously outsourced to a third-party service provider, where this is necessary or appropriate.
- Register the respective provider in the Register of Information (RoI). The institution must establish and maintain an up-to-date RoI of third-party ICT service providers in accordance with Article 28(3) of DORA, including data on all third-party contracts. The structure of the register shall be developed in line with ITS 2024/2956, and the Excel template provided by the Latvijas Banka may also be used. The data contained in the register maintained by the institution must be submitted to the supervisory authority upon request.
- Inform Latvijas Banka at least 30 days in advance if the institution intends to use an ICT service supporting a critical or important function. The notification must include a service description and a risk assessment.
- Develop and maintain an exit strategy for ICT services supporting critical or important functions, outlining how the institution could either perform the function internally or transition to another service provider if the existing arrangement is terminated or becomes unavailable.
3. Use and monitoring of the ICT service
During the use of the ICT service, the institution must ensure continuous oversight of the service provider. The institution must have the necessary competences, resources, and processes in place to:
- receive timely information about ICT incidents;
- regularly monitor service quality, performance, and security; and
- periodically review and update the risk assessment to identify new or emerging risks related to the ongoing use of the service.