Sector study · published 3 November 2026

One year of the CTPP list: where the ICT services banks rely on actually run

Summary

On 18 November 2025 the European Supervisory Authorities designated 19 critical ICT third-party providers (CTPPs) under DORA. We measured where 221 ICT services of the kind found in a financial entity's Register of Information actually run (hosting, CDN, DNS, serving country), between 27 October 2026 and 1 November 2026. Two findings stand out. First, dependence is concentrated one level below the contract partner: 67% of the services depend on AWS or Cloudflare in at least one layer. Second, the oversight perimeter covers hosting but not the edge: 75% of observable hosting is with CTPP hyperscalers, yet 71% of observable CDN use runs on providers outside the list.

Key figures

67%

of the services depend on AWS or Cloudflare in at least one layer (hosting, CDN or DNS).

148 / 221 · 95% CI 61–73%

46%

depend on Amazon Web Services alone in at least one layer.

102 / 221 · 95% CI 40–53%

75%

of observable hosting sits with AWS, Google Cloud or Microsoft Azure, the three hyperscaler groups on the CTPP list.

91 / 122 · 95% CI 66–81%

71%

of observable CDN use runs on providers that are not on the CTPP list (Cloudflare, Akamai, Fastly).

97 / 137 · 95% CI 63–78%

63%

of services with all three layers visible run hosting, CDN and DNS at the same provider group.

24 / 38 · 95% CI 47–77%

80%

of observable endpoints are served from the United States.

97 / 121 · 95% CI 72–86%

Unit: one ICT service. Percentages refer to services where the layer is observable; intervals are 95% Wilson score intervals.

What it means for DORA Art. 28 and 29

Oversight of CTPPs does not move responsibility

Under Art. 28(1)(a) the financial entity remains fully responsible for its obligations when it uses ICT third-party services. The CTPP oversight framework adds supervision of the provider; it does not replace the entity's own concentration assessment.

Concentration sits below the contract

Art. 29 asks whether several arrangements lead to the same or closely connected providers. Contracts are signed with the vendor, but the shared dependency is the cloud, CDN or DNS operator underneath. A register reviewed vendor by vendor will not show it.

The edge layer is outside the list

CDN and DNS operators sit in front of most services. Where they are not CTPPs, the only assessment of that dependency is the entity's own, including the third-country aspect under Art. 29(2).

Method in detail: how to measure ICT concentration risk under DORA →

Measure your own register

Free vendor scan →

Paste up to 300 vendor domains and see concentration per layer and CTPP exposure in minutes.

Sample report →

The full report for a fictitious bank. For your own list: $50.

Institution package →

Prepared from your register export, re-measured after 30 and 90 days, with auditor annex. From 1,500 USD.

Method

Sample: 221 active services in five catalogue categories that make up a typical financial entity's ICT third-party inventory: payments and fintech, identity and security, enterprise SaaS, productivity and collaboration, communication APIs.
Measurement: public DNS records, routing data (ASN) and TLS certificates of each service's public endpoints, 27 October 2026 to 1 November 2026. Providers are grouped by corporate group (e.g. CloudFront and Route 53 count as AWS).
CTPP status: ESAs' list of 18 November 2025, matched at group level.
Independence: no customer data, no contracts, no data from any financial entity. Aggregate figures only; no service or institution is named.

Limits

Hosting is hidden behind a CDN for many services: hosting is observable for 122 of 221, all three layers for 38. The 63% figure has a wide interval for that reason.
The sample is a catalogue of widely used services, not the register of any particular institution. An individual register can be more or less concentrated.
Outside-in measurement shows where a service runs, not what the contract says or which sub-contractors are undisclosed.

Cite this study

ShadowGraph (3 November 2026): One year of the CTPP list: where the ICT services banks rely on actually run. Measurement 27 October 2026 to 1 November 2026, n = 221. https://shadowalpha.online/research/dora-ctpp-concentration-2026

For journalists and analysts

The aggregate table per layer and the method note are available on request at info@shadowalpha.online. We do not publish or hand out figures for named institutions.