From ‘Too Big to Fail’ Banks to ‘Too Critical to Fail’ Technology Providers?

On 18 November 2025, the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority published the first list of critical information and communication technology third-party providers designated under the Digital Operational Resilience Act (DORA). The authorities assessed providers by reference to their systemic importance, their role in supporting critical or important functions and the substitutability of their services.

Most immediate commentary has understandably focused on compliance: which providers were designated, what oversight will involve and how financial entities should adapt their governance. Those questions matter. But the designations also raise a more fundamental issue: what happens when financial regulators begin directly overseeing businesses that are not financial institutions?

DORA changes the perimeter of financial regulation. For decades, regulators concentrated principally on banks, insurers, investment firms and financial market infrastructures. Under the new framework, European authorities can oversee technology providers whose services underpin the sector. The regulatory spotlight now reaches beyond financial entities to the digital foundations on which they operate.

From the perspective of a practitioner working in third-party risk management, this development confirms a reality that operational-resilience professionals have recognized for years. Financial institutions have not merely outsourced technology services. In some cases, they have outsourced elements of their operational survival.

Payments, lending, securities processing, customer authentication, data storage, fraud monitoring and business continuity all depend on complex digital ecosystems. A relatively small group of providers may support hundreds or thousands of financial entities at once. DORA’s designation process is significant because it formally recognizes that shared dependence.

The comparison with the post-financial-crisis debate is revealing. Regulators developed frameworks for identifying systemically important financial institutions by examining interconnectedness, substitutability, concentration and systemic impact. DORA asks strikingly similar questions of technology providers. That invites a provocative conclusion: certain providers may now be ‘too critical to fail’ for the financial system.

Analogy has limits. Technology providers do not take deposits, extend credit or perform maturity transformation. A DORA designation is not a finding that a provider will receive public support in a crisis. Nor does the framework transfer responsibility for resilience away from financial entities. The authorities describe oversight as complementing, rather than replacing, firms’ own risk-management duties.

Yet the underlying concern is comparable. A severe outage, cyber incident or service failure at a widely used provider could affect many firms simultaneously and transmit disruption across markets. The oversight framework responds by allowing a Lead Overseer to assess whether a designated provider has appropriate governance and risk-management arrangements and to conduct examinations and issue recommendations.

This direct oversight is an important step, but it also exposes the limits of traditional outsourcing governance. Over the past decade, regulation has emphasized due diligence, contractual safeguards, monitoring, concentration-risk analysis and exit planning. These disciplines remain necessary. They are not, however, a complete answer to structural dependency.

A financial institution may maintain an exit plan that is credible on paper while still facing formidable technical, operational and financial barriers to replacing a deeply embedded provider. Migration can require redesigning systems, transferring data, retesting controls and coordinating numerous internal and external parties. In a concentrated market, suitable alternatives may be scarce. During a sector-wide disruption, they may also be under the same pressure.

Substitutability is therefore more than one criterion in a designation exercise. It reveals a tension at the heart of outsourcing regulations. Supervisors expect firms to retain control over outsourced risks, but market structure may leave them with limited practical control over the availability of genuinely interchangeable suppliers.

This is why DORA should be understood not only as a cyber-security or operational-resilience regime, but also as an early form of infrastructure regulation for the digital financial system. By designating and overseeing providers at Union level, the authorities acknowledge that resilience cannot be secured solely by supervising each customer firm in isolation. Some risks arise from common dependencies across the market.

The next policy question is whether oversight of individual critical providers will be enough. Regulators may ultimately need to examine the conditions that make those providers critical: market concentration, barriers to switching, limited interoperability, complex subcontracting chains and the economics of duplicating infrastructure. If resilience policy focuses only on the conduct of designated providers, it may manage the symptoms of dependency without addressing its sources.

That does not mean regulators should attempt to eliminate concentration altogether. Scale can improve security investment, service quality and recovery capability. Fragmentation can create its own vulnerabilities. The better objective is to distinguish efficient concentration from dangerous dependency and to test whether the financial sector can continue delivering essential services when a major provider is unavailable.

DORA does not resolve that debate. It does, however, make it unavoidable. The first critical-provider designations are more than a technical milestone: they reflect a new understanding of financial stability in a digital economy. The institutions capable of creating systemic disruption may no longer sit within the traditional regulatory perimeter.

After the financial crisis, the central concern was which institutions were too big to fail. The next chapter may be about which technology providers are too critical to ignore.

Magda Ositashvili holds a Joint European Master's Degree in Law and Economics from the University of Hamburg and Pompeu Fabra University (Barcelona). She is a young professional in the German banking sector, specializing in financial regulation.