ISS-004Risk mitigationCriticalIn progress

Critical third-party concentration exceeds risk appetite

1 of 1 action plans are still open. An issue can only be closed once all its action plans close.

Description

Risk R-001 sits outside appetite: over-reliance on a small number of critical ICT providers creates concentration and substitutability risk. This issue tracks the structural mitigation programme raised in response to the risk review.

Action-plan SLA

Plans required by

13 Apr 2026

Met

Action plans

AP-004Onboard a secondary KYC provider to reduce concentration

Open

10%

TB Tom BrennanTarget 30 Sep 2026

What this issue addresses

Audit findings

Concentration analysis lacks substitutability scoring

F-004 · KPMG — Concentration follow-up

Open

Control gaps

Critical third-party register review

C-022

Needs work

Risks mitigated

Critical ICT third-party concentration

R-001 · residual

High

Requirements

DORA Art. 28(1)FCA SYSC 15A.2.5