DORA, OCC, FCA, and EBA all require financial institutions to formally manage vendor risk — with documented registers, assessed vendors, and evidence available on demand. VendorAuditly generates regulator-ready evidence packs at $49/month, without the enterprise GRC price tag.
Whether you are a UK-licensed payment institution, an EU fintech under DORA, a US bank overseen by the OCC, or an APAC firm with EBA-aligned requirements, the core obligation is the same: document your vendors, assess their risk, and prove it.
Effective January 2025. Applies to credit institutions, payment institutions, e-money institutions, investment firms, and crypto asset service providers. Requires an ICT third-party register, pre-contract due diligence, mandatory contractual provisions, and risk-proportionate ongoing assessments.
Art. 28: full third-party risk framework requiredOCC-supervised banks must maintain a risk management framework for all third-party relationships, with heightened oversight for critical activities. The framework must cover planning, due diligence, contract negotiation, ongoing monitoring, and termination.
Updated 2021 with interagency guidanceFCA-regulated firms must maintain appropriate oversight of outsourced activities. Material outsourcing requires enhanced due diligence, contracts with specific provisions, and documented ongoing monitoring. FCA expects a risk register for material third parties.
Applies to EU credit institutions and investment firms. Requires a register of all outsourcing arrangements, risk assessments before entry, contractual safeguards, and periodic review. The EBA guidelines substantially overlap with DORA for ICT outsourcing.
DORA Article 28 sets out the most prescriptive third-party risk requirements any financial services regulator has published to date. Here is what it actually demands — and what evidence you need to show.
Maintain a complete, up-to-date register of all ICT third-party service providers, including contractual arrangements. The register must distinguish between providers supporting critical or important functions and those that do not.
VendorAuditly: live vendor register with risk classification, exportable on demandBefore entering a contract with an ICT provider, conduct and document due diligence proportionate to the risk. For critical/important functions, this includes a formal assessment of the provider’s ICT security, business continuity, and resilience capabilities.
VendorAuditly: DORA-specific questionnaire template, response tracking, dated evidenceContracts with ICT providers must include: full service descriptions, data location provisions, audit rights, sub-outsourcing conditions, exit rights, and incident notification requirements. Document which contracts include each provision.
Periodically re-assess the risk of ICT providers, with frequency proportionate to criticality. Critical/important function providers require annual assessment. Assessments must be documented with dated evidence of completion.
VendorAuditly: assessment scheduling by risk tier, dated completion recordsFor critical ICT providers, document how you would exit the relationship if required — including data migration, alternative providers, and transition timelines. This is particularly relevant for cloud and core banking providers.
Most fintech startups and challenger banks know they need vendor risk management. Few have the evidence organised and ready to produce. That gap is exactly what DORA enforcement targets.
No GRC consultant. No six-figure platform. No six-month implementation. VendorAuditly gets a regulated financial institution from spreadsheet to DORA-ready in a single week.
Import your vendor list and classify each vendor by function type (critical/important or non-critical), data access, and operational dependency. This forms the foundation of your DORA Article 28.2 register.
Use VendorAuditly’s DORA-aligned questionnaire template to assess ICT security, resilience, data location, and sub-outsourcing arrangements. Responses are dated and stored as evidence of pre-contract or periodic due diligence.
Store SOC2, ISO 27001, and cyber liability certificates for each vendor. VendorAuditly tracks expiry dates and alerts you 90, 60, 30, and 7 days before each certificate lapses — so your evidence file is always current.
Set reassessment schedules by risk tier. Critical ICT providers get annual assessment prompts. VendorAuditly tracks completion dates and surfaces overdue assessments — demonstrating to regulators that your programme is systematic, not ad hoc.
When an inspection arrives, click export. VendorAuditly generates a complete evidence pack: ICT register, risk classifications, assessment records with dates, certificates on file, and audit trail. Everything DORA Article 28 requires, in a single export.
ICT third-party register, risk assessments, certificate tracking, and one-click evidence export. Built for the financial services firm that cannot afford a $100k GRC platform.
No credit card required. Set up in under an hour.