Operational resilience across every regime you operate in

A firm may delegate an activity but not the accountability for it. Regulators expect dependencies to be understood several layers deep, including sub-outsourcing and the providers behind your providers. Many firms map only their direct suppliers, so a failure further down the chain arrives as a surprise. DORA's subcontracting standard (Delegated Regulation (EU) 2025/532) and the UK's multi-layered dependency mapping both point this way, and Brazil expects live third-party risk monitoring. Contract clauses alone do not give that visibility.

Applies to: EU (DORA), UK (critical third parties regime), Australia (APRA CPS 230), Brazil (Central Bank Rules 519, 520, 521)

Supervisors are moving from point-in-time assessments to continuous, data-driven assurance, and a written plan alone no longer counts as proof. The FCA's 2026 operational resilience reviews have shifted towards auditing explicit evidence of live scenario testing, and they challenge boards that claim they can recover from severe cyber disruption without documented technical evidence. Firms often hold playbooks that were never run against plausible stress scenarios. Exit plans must be operationally feasible and executable, and impact tolerances should be tested against providers' actual SLAs. In the US, stablecoin issuers face pre-operational resilience examinations before authorisation.

Applies to: UK (FCA PS21/3), EU (DORA), US (GENIUS Act, federal interagency guidance), Brazil (Normative Instruction 701)

A register of third-party arrangements is a report to the supervisor, not an internal spreadsheet. DORA's register of information is submitted in a prescribed format, and the Dutch DNB required it as xBRL-CSV by 23 April 2025. Firms often build the list once, tidy it before submission and never reconcile it with anything else. It should reconcile with the EBA outsourcing register and with the designated critical third-party lists in the UK and EU. A provider missing from your inventory is a gap a supervisor can find.

Applies to: EU (DORA, EBA Third-Party Guidelines), UK (critical third parties regime)

Regimes define reportable incidents differently, and firms working across jurisdictions often apply a single internal classification to all of them. The MFSA's September 2025 Dear CEO letter flagged recurring weaknesses in ICT risk frameworks, incident classification and third-party risk management among payment institutions. Regulators treat systemic IT failure with the gravity of a capital or liquidity crisis, so accountability sits with the board and not only with IT. Vixio's Outlook expects US and Brazilian virtual asset firms to move towards immediate notification of significant cyber events.

Applies to: EU (DORA, MFSA Malta), UK, US (GENIUS Act), Brazil (Central Bank Rules 519, 520, 521)

AI creates two exposures: new ways to attack a firm, and new things to depend on. CySEC's June 2026 Circular C786 added AI-driven cyber threats as an explicit DORA concern. Vixio's Outlook names provider concentration and AI-driven dependencies as the emerging themes regulators will prioritise. Firms often treat an AI tool as a software purchase, so it never enters the third-party register, the scenario library or the exit plan. Threat-led penetration testing under Delegated Regulation (EU) 2025/1190 is one place to test them.

Applies to: EU (DORA, CySEC Circular C786); emerging supervisory theme in Vixio's Outlook