Continuity for Supplier Failure

Continuity for supplier failure asks what a service does when a supplier it depends on stops working, provides a degraded service, or becomes unavailable for a prolonged period. The firm that owns the service remains accountable to its customers, even though it does not control the supplier. Its plan therefore needs to describe the supplier dependency in service terms, the degraded service customers will receive, the alternative or stand-in arrangement if one exists, and how data and records will be protected. Under DORA in the EU, which applies from 17 January 2025, third-party risk is a distinct theme, while the UK regime in FCA PS21/3 and PRA PS6/21 frames supplier dependencies within wider operational resilience. The regime should be labelled where duties are cited.

Supplier failure is often discovered late, because the firm learns about it through customer complaints rather than through a clear signal from the supplier. Continuity planning should therefore include early warning routes: supplier status communication, monitoring of service health where available, and internal escalation when a supplier-dependent step begins to fail. It should also define what the firm will do while it waits for supplier recovery, rather than assuming that waiting is a plan. Waiting may be appropriate for a short, well-understood problem with clear communication, but it is not appropriate where customers are harmed, where the supplier cannot give a credible recovery picture, or where the firm's own tolerance is approaching its limit.

Consider an illustrative foreign exchange payments service that depends on a correspondent provider and a sanctions screening supplier. If screening fails, payments cannot safely proceed in the normal way, and if the correspondent route fails, payments cannot settle. The service plan should distinguish those two failures, because they call for different responses. Screening failure may lead to a paused or limited service with clear customer communication, while settlement failure may lead to alternative routing, delayed settlement with customer agreement, or a managed pause. A plan that treats all supplier failures as a single event, with a single generic response, will mislead responders when the specific failure matters most.

Concentration is a further risk. A firm may depend on one supplier for several services, or on several suppliers that themselves depend on a common platform, network or data provider. Impact analysis should therefore look beyond direct contracts to shared dependencies, because a single underlying failure can affect multiple services at once. Where concentration is found, planners should consider whether a degraded service, a second supplier, an in-house fallback, or a change to service scope reduces the risk to an acceptable level. That consideration involves cost, complexity and customer impact, and it should be owned by the service owner, not left as an abstract procurement question.

Data and exit arrangements deserve attention before failure, not during it. The firm should know what data the supplier holds, how that data can be obtained if the supplier is unavailable, in what form, and how its integrity will be checked. It should also know what happens to customer records and in-flight transactions if the relationship ends abruptly or if the supplier cannot recover. Those arrangements should be tested in a proportionate way, for example by checking that a data extract can actually be read and used, rather than by assuming that a contractual right to data is the same as a usable recovery route. A right that cannot be exercised quickly, under pressure, is of limited help to customers.

Testing supplier continuity should involve the supplier where possible. A joint tabletop exercise can reveal differences in assumptions about recovery order, communication, escalation and data handling, before those differences matter. It can also reveal where the supplier's recovery plan protects the supplier's own systems rather than the firm's service, a distinction that matters when priorities conflict. Findings should change the service plan, the supplier arrangement or the degraded service description, and should be tracked to closure. A supplier plan that has never been discussed with the supplier, or that has never been tested against a realistic failure story, should be treated as an assumption, not as evidence of continuity.