TPRM maturity check: Take the check
Trestec
Book a demo

Guides

Practical guidance for teams that oversee suppliers: materiality, registers, due diligence, exit and supply chain risk.

All guides

How to assess materiality under PRA SS2/21

A practical method for deciding which outsourcing and third party arrangements are material, recording why, and keeping that view current.

Why materiality matters

PRA Supervisory Statement SS2/21 sets out the PRA's expectations for how banks, building societies, PRA-designated investment firms and insurers manage outsourcing and third party risk. Materiality drives almost everything else: material outsourcing attracts the most demanding expectations, including prior notification to the PRA, stronger contractual terms, and documented business continuity and exit plans.

SS2/21 also asks firms to assess non-outsourcing third party arrangements in a proportionate way, so the assessment should cover your whole supplier population, not only arrangements labelled as outsourcing.

A step-by-step method

  1. 1

    Build a complete inventory

    List every third party arrangement, including intragroup arrangements, with a named business owner for each. Incomplete inventories are the most common reason materiality views are wrong.

  2. 2

    Classify each arrangement

    Decide whether it is outsourcing (a third party performing something the firm would otherwise do itself) or another type of third party arrangement, and record the reasoning.

  3. 3

    Apply consistent criteria

    Assess each arrangement against the factors SS2/21 describes, such as its link to regulated activities, the impact of disruption on your important business services and regulatory obligations, the data involved, and how easily the service could be substituted or brought in-house.

  4. 4

    Link to important business services

    Connect each arrangement to the important business services it supports under your operational resilience framework (SS1/21). An arrangement behind an important business service usually deserves close scrutiny.

  5. 5

    Record the decision and the decision maker

    Keep the answers, the rationale and who approved the outcome. A materiality view that cannot be explained to a supervisor is a weak one.

  6. 6

    Reassess on change

    Review materiality periodically and whenever the service, the supplier or your reliance on it changes significantly. Pre-notify the PRA where an arrangement becomes material outsourcing.

Common pitfalls

  • Assessing the supplier rather than the specific service it provides
  • Scoring by contract value alone, which misses low-cost but critical services
  • Leaving out intragroup and non-outsourcing arrangements
  • Recording a rating without the evidence or the person who approved it

General information, not legal advice. Check the current text of the rules that apply to your firm.

Building a DORA Register of Information

What the register must contain, how the templates link together, and how to build a register that survives submission checks.

What the register is

Article 28(3) of the Digital Operational Resilience Act (DORA) requires EU financial entities to maintain and update a register of information on all contractual arrangements for ICT services provided by ICT third party service providers, at entity level and, where relevant, at sub-consolidated and consolidated level. DORA has applied since 17 January 2025.

The format is set by implementing technical standards adopted as Commission Implementing Regulation (EU) 2024/2956. Competent authorities collect the register and pass it to the European Supervisory Authorities, which use it, among other things, to identify critical ICT third party providers. Submission dates are set by each competent authority, so check yours.

How the templates fit together

The register is a set of linked tables rather than a single list. Each table refers to the others through identifiers, so a missing or inconsistent identifier breaks the chain.

  • The entity maintaining the register and the entities in its scope
  • Contractual arrangements, and the links between them where one arrangement depends on another
  • Which entities use each ICT service
  • ICT third party service providers, and their own ICT supply chain for services supporting critical or important functions
  • Functions, with whether each is critical or important
  • Assessments of each ICT service, including substitutability and exit

Template numbering and field lists are defined in the implementing regulation and accompanying ESA reporting guidance. Check the version in force when you submit.

A practical build order

  1. 1

    Fix identifiers first

    Collect a Legal Entity Identifier (LEI) for your entities and for each provider where one exists. Many submission errors trace back to wrong or missing identifiers.

  2. 2

    Define your functions

    Agree the list of functions and which are critical or important before mapping contracts to them.

  3. 3

    Map arrangements to functions and entities

    Record which entities rely on each ICT service and which functions it supports.

  4. 4

    Extend to the supply chain

    For services supporting critical or important functions, capture the subcontractors that effectively underpin the service.

  5. 5

    Validate before submission

    Check every reference resolves, every mandatory field is filled and each value can be traced to a source document.

General information, not legal advice. Check the current text of the rules that apply to your firm.

Running supplier due diligence that scales

How to keep due diligence proportionate across hundreds of suppliers: tiering, reusable evidence, clear review and a sensible refresh cycle.

Proportionate by design

Sending every supplier the same long questionnaire wastes their time and yours, and buries the answers that matter. Regulators expect depth to match risk: the most important arrangements get the deepest review, and low-risk suppliers a light, quick check.

Five practices that scale

  1. 1

    Tier before you ask

    Use materiality and inherent risk to place each supplier in a tier, and attach a question set and evidence list to each tier.

  2. 2

    Reuse existing evidence

    Accept independent assurance where it exists, such as ISO/IEC 27001 certificates or SOC 2 reports, and check their scope and dates rather than re-asking what they already cover.

  3. 3

    Use one supplier portal

    Give suppliers one place to answer questions and upload documents, with clear due dates and reminders.

  4. 4

    Review gaps, not just answers

    Record each finding, its severity and the follow-up action, and keep the decision with a named reviewer.

  5. 5

    Refresh on a cycle and on events

    Repeat due diligence on a tier-based cycle, and sooner when something changes, such as an incident, a change of ownership or a new service.

What to keep on record

  • The questionnaire version each supplier answered
  • Documents received, with their dates and scope
  • Findings, actions and who approved the outcome
  • Subcontractors the supplier named, for your Nth party view

General information, not legal advice. Check the current text of the rules that apply to your firm.

Writing and testing exit plans

What a credible exit plan covers, the difference between stressed and planned exit, and how to test a plan without leaving the supplier.

What regulators expect

SS2/21 expects documented exit plans for material outsourcing arrangements, covering both stressed exit (for example, the supplier fails or stops providing the service) and non-stressed, planned exit. DORA requires exit strategies for ICT services supporting critical or important functions, and expects exit plans to be documented, sufficiently tested and reviewed periodically. The EBA outsourcing guidelines set similar expectations for critical or important outsourcing.

What a credible plan covers

  • The trigger events that would start an exit, and who decides
  • Realistic alternatives: another provider, bringing the service in-house, or a different way of working
  • How data is returned or migrated, in what format, and how deletion is confirmed
  • Timelines, costs and the resources needed
  • How the important business service keeps running during the transition
  • Contract terms that support exit, such as transition assistance and notice periods

Testing without leaving

  1. 1

    Tabletop the stressed scenario

    Walk through a sudden supplier failure with the people who would act, and record what was missing.

  2. 2

    Trial a data return

    Ask for an export of a representative data set and check you could actually use it.

  3. 3

    Check the alternatives are still real

    Confirm that the alternative provider or in-house option still exists and could absorb the work in the time assumed.

  4. 4

    Record and act on the results

    Keep the test date, findings and actions with the plan, and review the plan when the service changes.

General information, not legal advice. Check the current text of the rules that apply to your firm.

Mapping Nth parties and concentration risk

How to see the subcontractors behind your suppliers, find where several services rely on the same provider, and decide what to do about it.

Why look beyond tier one

Your suppliers depend on their own suppliers: cloud platforms, data centres, payment networks and software providers. When several of your important services rely on the same provider several layers down, one failure can stop them all at once. That is concentration risk, and it rarely shows up in a list of direct suppliers.

SS2/21 sets expectations on sub-outsourcing and asks firms to consider concentration risk. Under DORA, the register captures the ICT supply chain behind services supporting critical or important functions, and firms must assess ICT concentration risk before contracting for such services.

Building the map

  1. 1

    Start with what matters

    Begin with the suppliers behind your important business services or critical or important functions, not the whole supplier base.

  2. 2

    Ask suppliers to name their subcontractors

    Collect material subcontractors through due diligence and contract terms, with what each provides and where.

  3. 3

    Normalise names

    Record providers consistently, ideally with an identifier such as an LEI, so the same company is recognised across chains.

  4. 4

    Look for shared nodes

    Find providers that appear behind several suppliers or services, and shared locations or infrastructure.

  5. 5

    Decide and record

    For each concentration, accept it with a reason, reduce it, or strengthen continuity and exit plans, and record who decided.

General information, not legal advice. Check the current text of the rules that apply to your firm.

Modern slavery statements: what to collect from suppliers

The evidence that supports a credible modern slavery statement, and how to collect it from suppliers in proportion to risk.

The legal starting point

Section 54 of the UK Modern Slavery Act 2015 requires commercial organisations that carry on business in the UK and have a total annual turnover of £36 million or more to publish a slavery and human trafficking statement each financial year. The statement must be approved by the board (or equivalent) and signed by a director, and published with a prominent link on the organisation's website homepage.

The Act suggests what a statement may cover: the organisation's structure, business and supply chains; its policies; its due diligence processes; where the risk lies and the steps taken to manage it; how effectiveness is measured; and training. Much of that evidence sits with suppliers.

What to ask suppliers for

  • Their own modern slavery statement, if they are in scope, and the year it covers
  • Relevant policies, such as a supplier code of conduct and recruitment and whistleblowing policies
  • Where they operate and source from, with sectors and countries of higher risk identified
  • Audit or assessment results, and remediation taken where issues were found
  • How workers can raise concerns, and how concerns are handled
  • Training given to staff and how requirements are passed down to their own suppliers

Keep it proportionate

Focus the deepest questions on suppliers in higher-risk sectors and locations, such as labour-intensive manufacturing, logistics, cleaning and facilities services. Record what you asked, what you received and what you did about gaps, so next year's statement can show progress rather than intent.

General information, not legal advice. Check the current text of the rules that apply to your firm.

More reading

Notes on regulation, resilience and supply chains, and answers to common questions.

Read the blog Read the FAQ

See Trestec on your own supplier list.

Book a demoTalk to us