The Concentration Problem: DORA, Market Data Dependency, and the Case for Independence

April 2026

Executive Summary

The EU's Digital Operational Resilience Act (DORA) came into full effect on 17 January 2025. It is the most significant regulatory intervention in financial services technology governance in a generation. Its implications extend well beyond cybersecurity. For banks and investment firms operating on legacy market data infrastructure, DORA has converted what was once a commercial inconvenience into a compliance obligation with board-level accountability and material financial penalties.

This paper examines three interconnected questions. First, what does DORA require of financial entities in relation to their market data infrastructure? Second, why does the dominant real-time data distribution platform in capital markets present a specific and acute concentration risk challenge under that framework? And third, what has changed in the technology landscape that makes the long-held assumption that these platforms are simply too difficult to replace no longer accurate?

DORA is forcing the market to re-examine a long-held assumption: that incumbent data platform infrastructure is too difficult to replace.

1. What DORA Actually Requires

The five pillars

DORA organizes its requirements across five areas: ICT risk management, incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing. For firms with material market data infrastructure dependencies, the fourth pillar, ICT third-party risk management, is where the most significant obligations arise.

Exit planning and concentration risk

DORA requires firms to maintain an ICT third-party risk strategy and policy for ICT services supporting critical or important functions, to assess ICT concentration risk at entity level, and to maintain dedicated exit strategies for relevant contractual arrangements. These obligations sit across Articles 28 and 29 of the regulation.

Article 28(8) is the most direct requirement: for ICT services supporting critical or important functions, financial entities must put in place exit strategies. Those exit plans must be comprehensive, documented, and sufficiently tested and reviewed periodically. Firms must identify alternative solutions and develop transition plans enabling them to remove contracted ICT services and transfer them to alternative providers or reincorporate them in-house.

Article 28(2) requires financial entities to adopt and regularly review an ICT third-party risk strategy, including a policy on ICT services supporting critical or important functions. Article 29 is the natural home for the preliminary assessment of ICT concentration risk at entity level: the requirement that firms assess and document over-reliance on a single provider or a small group of providers for functions that are critical to operations.

Together, these provisions establish two distinct but related obligations. First, a firm must be able to exit a critical provider relationship without operational disruption. Second, it must actively assess and manage the risk that it is too concentrated in any single provider to do so credibly.

The exit plan obligation applies to all ICT services supporting critical or important functions, not only those provided by CTPP-designated vendors. CTPP designation adds direct ESA oversight on top of existing obligations; it does not create them.

The CTPP designation: what it means in practice

In November 2025, the ESAs published the first list of Critical Third-Party Providers: nineteen providers designated for direct EU-level oversight. The list includes hyperscale cloud providers, data center operators, and providers of financial services-specific technology. The designation criteria assessed four factors: systemic impact of large-scale operational failure; systemic importance of dependent financial entities; concentration of reliance across the EU financial sector; and the substitutability of the provider's services.

CTPP designation brings significant consequences for financial entities that use those providers. The ESA Lead Overseer will assess the CTPP's risk management frameworks, data portability mechanisms, and ability to support client exit plans. Recommendations issued to a CTPP are shared with the competent national authorities supervising those firms' clients. In extreme cases, regulators can require financial entities to suspend or terminate use of a non-compliant CTPP's services.

For firms, this means that a CTPP relationship is no longer purely a bilateral commercial matter. It is a regulatory relationship with three parties: the firm, the provider, and the ESA.

Enforcement: supervisory scrutiny has intensified

Regulators treated 2025 largely as a transition year. That posture has changed materially. In Germany, BaFin initiated DORA-related on-site visits as early as May 2025. The first Register of Information submission was due to national competent authorities in April 2025. From 2026, competent authorities transmit updated registers to the ESAs by 31 March, and BaFin has asked firms to submit updated registers between 9 and 30 March 2026. Supervisory scrutiny of register completeness, ICT third-party governance, and exit plan quality is expected to intensify significantly through the year.

Deloitte's 2025 European DORA survey found that 50% of surveyed institutions expect to reach full compliance only by 2026 or 2027, well beyond the regulatory deadline. Critically, only 8% of respondents considered themselves fully compliant with the ICT Third-Party Risk Management pillar specifically, the pillar most directly relevant to market data infrastructure.

2. Why Market Data Infrastructure Is a Concentration Risk Problem

Thirty years of embedded infrastructure

The dominant real-time market data distribution platform in capital markets has been in continuous deployment at major financial institutions for approximately three decades. It evolved from its origins in the early 1990s through successive iterations, accumulating integrations, dependencies, and operational knowledge at every major bank and investment firm along the way.

The result is an infrastructure layer that has become, in the most literal sense, load bearing. At a typical tier-one institution, the platform sits at the center of a web of dozens to hundreds of downstream application connections: trading systems, risk engines, pricing libraries, compliance platforms, reference data stores, and desktop terminals, all consuming data through the platform's proprietary APIs and entitlement architecture.

The anatomy of lock-in

The lock-in created by this infrastructure operates at multiple levels simultaneously, each reinforcing the others.

– Distribution APIs: The platform's distribution APIs are deeply embedded in application codebases across trading, risk, and compliance systems. Historically, re-coding downstream applications to use alternative APIs has been the single largest cost driver in migration planning. It is worth noting that the leading incumbent's Real-Time SDK stack has been published as open source on its developer portal and GitHub, which has reduced, though not eliminated, this barrier.

– Entitlement architecture: The platform's access control system enforces data licensing compliance at the user and service level. It is applied to every application that accesses controlled data. Migrating entitlement logic while maintaining compliance with exchange data licensing obligations is a significant operational undertaking.

– Institutional knowledge: Operations and engineering teams have built careers around managing this infrastructure. The institutional knowledge required to run it is specialized, and the community of practitioners is finite.

These factors combine to create a platform that is commercially sticky not because of the value of its current functionality, but because of the cost and risk of change. That stickiness has historically served the incumbent vendor’s commercial interests. Under DORA, it now works against the regulatory interests of the financial entities that depend on it.

Why DORA’s substitutability criterion is specifically relevant

The ESA’s CTPP designation methodology explicitly evaluated the substitutability of each designated provider’s services. The inclusion of major data vendors in the first CTPP cohort confirmed what supervisors already suspected: that financial entities have concentrated critical infrastructure dependency in a small number of providers whose services are genuinely difficult to replace quickly.

Under DORA, firms are required to demonstrate control and exit readiness for ICT services supporting critical or important functions, and to assess concentration risk where critical infrastructure is deeply embedded.

A bank whose exit plan exists only on paper, with no tested alternative and no demonstrated transition capability, is unlikely to satisfy regulators that its Article 28 obligations have been met in substance. In practice, that means firms need more than documentation alone. They need a credible, operationally defensible view of control, concentration, and exit feasibility where critical infrastructure is deeply embedded.

Platform Development and Roadmap: An Underweighted Input to ICT Risk Assessment

DORA’s third-party risk framework requires firms to assess and monitor the ongoing appropriateness of their critical ICT provider relationships, not merely at onboarding, but continuously. One dimension of that assessment that is frequently underweighted in conventional vendor reviews is the active development trajectory of the platform itself.

Firms should, as part of their DORA ICT risk management obligations, validate the roadmap and ongoing development status of any data distribution platform on which critical or important functions depend. A platform in active development, receiving new capability, architectural improvement, and adaptation to evolving regulatory and operational requirements, presents a materially different risk profile from one that has entered a period of maintenance-only operation.

Asking a vendor directly about its platform roadmap, development investment, and engineering capacity is a straightforward due diligence step. The answers inform not just the firm’s current risk assessment but its forward-looking view of whether the provider relationship remains appropriate as DORA’s standards continue to evolve.

3. What Has Changed: The Technology Landscape in 2026

The historical argument against migration

For most of the past decade, the argument against migrating away from incumbent market data platforms was structurally sound. There was no credible, fully featured alternative that could replicate the scope of the incumbent's capabilities. Even if one existed, the combination of proprietary APIs, entitlement complexity, and dozens to hundreds of downstream application dependencies made migration a multi-year, high-risk, expensive program, disproportionate to any commercial benefit.

That argument rested on two assumptions: that no viable alternative existed, and that the migration complexity was inherent to the problem. Both assumptions have become materially less defensible.

Backward compatibility: The migration barrier removed

The primary source of migration complexity in legacy market data distribution environments has always been the downstream application estate. The prospect of re-coding tens to hundreds of application integrations across trading, risk, compliance, and reference data systems, while maintaining operational continuity, was the factor that made migration programs appear indefinitely deferrable.

EventStream, MarketsIO's real-time data distribution platform, addresses this directly. Built by the same engineering team that designed and authored the legacy infrastructure it replaces, EventStream is fully backward compatible. Existing feeds work. Existing applications work. No re-coding is required for downstream application connectivity.

Clients can trial the platform and see their existing data feeds, applications, and desktops work out of the box. This shifts the risk equation. The migration risk that previously made exit planning impractical is structurally removed.

The practical consequence is that what was previously a multi-year re-coding program, touching every application in the estate, becomes a platform substitution. The existing application estate continues to run unchanged.

MarketsIO also provides the source code of its Fusion API suite to data consumers, meaning firms are not locked into MarketsIO either. The Fusion API suite is multi-platform and multi-language, enabling firms to migrate legacy API integrations efficiently where required. Applications can typically be migrated in days rather than months, where firms want to write directly to the Fusion API, which materially changes the timeline and risk profile of any transition program and/or ongoing operations.

A purpose-built modern architecture

EventStream is not a fork or a wrapper around legacy code. It was built from the ground up with modern architectural principles. Its codebase is approximately one tenth the size of the legacy platform it replaces, delivering up to 40% greater scalability and materially higher reliability. The reduction in codebase complexity has direct implications for auditability, testability, and the ability to evidence operational resilience under DORA's testing requirements.

The platform introduces Adaptive Fault Tolerance, an instrument-level resiliency model that isolates failures at the individual instrument rather than the feed level. This is both more resilient in practice and more demonstrable to regulators than feed-level failover models employed by legacy infrastructure.

4. The Strategic Implications

For compliance officers and CROs

The immediate practical question is whether the firm's current DORA exit plan for its market data distribution infrastructure is credible. A credible plan under Article 28 is not a document that describes how migration would be approached. It is a documented and sufficiently tested plan that demonstrates the firm can actually execute the transition without operational disruption.

For firms running legacy market data distribution infrastructure, the availability of a backward-compatible alternative means that credible exit planning is now a realistic program rather than a theoretical exercise. The question shifts from whether it can be done to whether the firm has done the work to be able to demonstrate it.

For CTOs and infrastructure teams

The architecture of EventStream, approximately one tenth of the legacy codebase, instrument-level fault tolerance, cloud-native deployment options, and open API sourcing, represents a meaningful platform modernization independent of any regulatory driver. The DORA obligation provides the regulatory urgency; the technology case for migration stands on its own merits.

The backward compatibility architecture also changes the program structure materially. Rather than a single high-risk cutover, firms can run EventStream in parallel, validate operational equivalence, and transition progressively. The legacy platform can remain in place during validation, removing the binary risk that has historically made migration programs difficult to approve.

For the management body

DORA places direct responsibility for the ICT risk management framework on the management body. The regulatory technical standards require reporting to it on ICT projects affecting critical or important functions, and on the firm's internal governance of critical ICT third-party arrangements. Boards and senior management must therefore understand not just that concentration risk exists in their market data estate, but what the firm is actively doing to manage it and what a credible exit path looks like.

That question now has a different answer than it did even two years ago. A management body that is told in 2026 that migration from legacy market data infrastructure is a multi-year program with no credible near-term alternative is not receiving an accurate picture of the current technology landscape.

Conclusion

DORA does not mandate that financial entities replace their incumbent market data platforms. What it does mandate is that firms can demonstrate control, exit readiness, and assessed concentration risk for ICT services supporting critical or important functions. For firms where legacy data distribution infrastructure is deeply embedded, demonstrating those things credibly has historically been very difficult.

The combination of DORA's enforcement posture, now under materially closer supervisory scrutiny as of 2026, and the availability of genuinely backward-compatible, architecturally modern alternatives means the strategic calculus has shifted. The argument that incumbent platforms are too difficult to replace no longer reflects the capabilities of available technology.

Firms that treat their DORA exit plan obligations as a documentation exercise rather than an operational readiness requirement are accumulating regulatory risk. Firms that engage with the technology landscape as it exists in 2026, rather than as it existed five years ago, will find that the path to compliance is materially more achievable than it has ever been.

DORA may not reduce market data concentration on its own. But it does force the market to confront it, and the technology now exists to respond.

Author

Terry Roche – MarketsIO Co-Founder & CEO

About MarketsIO

MarketsIO is a pioneering technology company delivering innovative, scalable, and low-risk solutions to the financial services industry. We specialize in removing the cost and complexity of legacy data sourcing and distribution, empowering firms with genuine choice and control through modern architecture, transparent design, and deep domain expertise. Our focus is on the most demanding performance domain, real-time streaming market data.

Our mission is to modernize financial data infrastructure by embracing the principles of openness and freedom, enabling organizations to make informed technology decisions without the constraints of outdated systems or reliance on legacy data aggregators. Through close partnerships, MarketsIO drives transformation, performance, and long-term operational flexibility for its clients.