.png)
.png)
.png)
Want to learn how to optimize your processes?
Discover our solutions for companies in finance and banking
In short: The EU's Digital Operational Resilience Act (DORA) has applied since 17 January 2025, and it makes a bank's management body ultimately responsible for ICT risk, including risk that comes from suppliers. A vendor outage or breach is treated as the institution's own failure, and national penalty regimes can reach individual managers. Yet many banks still lack a single, reliable view of their suppliers: in the regulators' 2024 dry run, only 6.5% of submitted supplier registers passed every data quality check. This article explains why supplier contracts are now compliance evidence, how fragmented procurement drains value and creates risk, and how a unified procurement approach turns that liability into an advantage.
Strong quarterly results can sit alongside a question no board wants left unanswered: if your main cloud provider failed tomorrow, what would your regulatory exposure and recovery time be? For many banks the honest answer is not immediate, and that gap is the point.
Good profitability can hide structural weaknesses. For banking leaders, some of the most serious threats today come not from traditional competitors but from fragmented procurement processes that few people at board level actively watch.
DORA changed the rules for financial institutions. It puts the management body in charge of, and ultimately responsible for, the institution's ICT risk management, and that explicitly includes risk from ICT third-party providers. When a core system is breached or a payment processor goes down, supervisors do not treat it as a "vendor problem". They treat it as the institution's failure. Penalties are set in national law, and under Article 50 member states can apply them to members of the management body as well, not only to the institution.
The scale of the dependency is easy to underestimate. A large bank can rely on hundreds or thousands of suppliers, often without a consolidated view of the risk this creates. The CrowdStrike outage of July 2024, when a faulty update from a single security vendor took down Windows systems worldwide, caused serious outages at a number of banks, insurers and payment services at the same time. In November 2025 the European Supervisory Authorities designated 19 critical ICT third-party providers for direct EU oversight, including AWS, Google Cloud, Microsoft, Oracle, SAP and Deutsche Telekom. Concentration on a handful of providers is now an explicit supervisory concern.
Every supplier contract has turned from a purely commercial agreement into potential evidence of DORA compliance, or non-compliance. Article 30 lists the provisions ICT contracts must contain, including access, inspection and audit rights, service levels, termination rights and exit strategies. A contract that lacks them is not just a weak negotiation; it can be a regulatory gap in its own right.
DORA also requires every institution to keep a register of information on all its ICT third-party arrangements. That register is where fragmented procurement data shows up first: in the supervisors' 2024 dry run with around 1,000 financial entities, only 6.5% of registers passed all 116 data quality checks. Without systematic vendor management, an institution can carry many individual compliance gaps that look like ordinary commercial relationships.
Much of the record profit European banks reported in 2023 and 2024 came from higher interest rates rather than from operational excellence. That can create a misleading picture: an institution may look efficient while it is losing value through uncontrolled third-party spending and risk.
As rates have come down since the European Central Bank began cutting in 2024, procurement inefficiencies that strong margins used to hide are becoming more visible to shareholders, supervisors and boards alike.
The loss rarely shows up as a single line item. Research by World Commerce & Contracting puts the average value lost after signature at close to a tenth of annual contract value, through missed obligations, off-contract buying and poorly managed renewals. Every off-contract purchase can mean several things at once: negotiated prices bypassed, compliance checks skipped, and unvetted supplier risk entering the organization.
The cumulative effect is what makes this expensive: missed volume discounts, unclaimed rebates and unfavorable terms that renew automatically create a steady drain that is hard to see, measure or control.
Critical supplier information often sits in disconnected ERP systems, departmental spreadsheets and legacy tools. When board members ask for basic procurement facts, such as total supplier spend, third-party risk exposure or contract obligations, teams often have to start an organization-wide data hunt instead of giving an immediate answer.
This is not only inefficient; it limits strategic decisions. Choices about partnerships, risk mitigation and competitive position depend on reliable supplier information. If you cannot quickly assess your supplier relationships, you cannot make well-informed decisions about them.
Manual vendor checks struggle against increasingly sophisticated, often AI-assisted fraud aimed at the supply chain and payment processes. Business email compromise, where attackers impersonate suppliers or executives to redirect payments, caused close to USD 2.8 billion in reported losses in 2024 alone, according to the FBI's Internet Crime Complaint Center. These schemes exploit weak supplier onboarding and payment validation.
In other words, a procurement weakness can become a cybersecurity weakness. Every unverified supplier relationship is a potential entry point for attacks that target operational gaps rather than technical systems.
A growing number of banking leaders treat procurement transformation as a source of competitive differentiation rather than a back-office necessity. The business case rests on three things: lower leakage, faster and better-evidenced compliance, and fewer surprises from suppliers.
A unified, intelligent procurement platform typically provides:
Done well, procurement transformation lets a leader close one of the institution's least-watched risk areas before competitors do, gain confidence that third-party risk management offers real protection under DORA, and show profitability that does not depend only on the interest-rate cycle. Done poorly, or not at all, the same risks keep building up quietly.
Discover our solutions for companies in finance and banking
Procurement transformation works best when it is treated as a strategic architecture decision rather than a departmental tweak. Fragmentation, data silos and uncontrolled supply chain risk are systemic problems, and tactical fixes tend to leave the underlying issue in place.
DORA and ongoing market consolidation have narrowed the room for slow, gradual improvement. The institutions that come out stronger will not simply be those with the largest balance sheets, but those with the most resilient and best-informed procurement foundations.
A bank's procurement function is either building competitive advantage or quietly accumulating executive accountability. DORA, competitive pressure and operational reality have made this a board-level priority rather than a back-office concern.
The question for every banking leader is whether to lead this change and capture its benefits, or to wait until supervisory pressure forces a reactive response, when the strategic advantage is already gone.
Procurement software evaluation checklist: a detailed checklist for assessing your software options. It covers:
Download the procurement software evaluation checklist here.
What is DORA, and why does it matter for procurement?
DORA (the Digital Operational Resilience Act) is an EU regulation on the digital operational resilience of financial entities, applicable since 17 January 2025. It matters for procurement because it makes the institution and its management body responsible for risks from ICT third-party providers, sets mandatory contract provisions, and requires a register of all ICT third-party arrangements.
Are executives personally liable for vendor failures?
DORA makes the management body ultimately responsible for ICT risk management, including third-party risk. Penalties are set in national law, and DORA allows member states to apply them to members of the management body as well as to the institution. The exact conditions therefore depend on the country.
What must an ICT supplier contract contain under DORA?
Article 30 lists the key provisions, including a clear description of services, service levels, data location and protection, access, inspection and audit rights, termination rights and exit strategies. Contracts supporting critical or important functions have additional requirements.
Why is fragmented procurement a compliance and security risk, not just a cost issue?
When supplier data is spread across disconnected systems, no one has a reliable view of exposure. That makes it hard to evidence control during an audit or to build an accurate DORA register, easy to miss unfavorable contract terms, and easier for fraudsters to exploit weak onboarding and payment checks.
What should a bank prioritize first?
Start by consolidating supplier and contract data into a single source, then check that contracts include the provisions DORA requires. From there, automated risk scoring and renewal tracking address the highest-exposure gaps first.
