Compliance articles and resources

DORA requires covered financial entities to manage risk from ICT third-party service providers and maintain information about their ICT contractual arrangements, with enhanced requirements where providers support critical or important functions. NIS2 requires essential and important entities to address supply-chain security, particularly risks involving direct suppliers and service providers. The two regimes overlap, but DORA is more prescriptive about ICT third-party risk management.

DORA third-party risk management is shared between financial entities and their ICT providers. Since 17 January 2025, Article 13(6) requires banks, insurers and investment firms to run ICT security awareness and resilience training and, where appropriate, include their ICT providers in it, and Article 30(2)(i) requires every ICT contract to set out how the provider takes part. Providers that can evidence this keep the contract.

PEP screening identifies whether a customer, supplier or business partner is a politically exposed person: someone who holds or has held a prominent public position, or a family member or close associate of one. A name match is only the start. Effective screening checks the role, level of influence, country and whether the person is still in office, then documents the risk decision and repeats the check as circumstances change.

Third party screening for growing companies answers one question before a contract is signed: who are we really doing business with? In practice it checks three signals, whether the counterparty appears on a sanctions list, whether an individual is a politically exposed person, and whether adverse media points to fraud, corruption or other misconduct. Done consistently, proportionately and with a record, it is a basic part of managing business risk, not a bank-only exercise.

Sanctions compliance for SMEs is no longer optional in 2026. Directive 2024/1226 makes serious sanctions violations criminal offences across the EU, sets minimum penalties and extends liability to companies, so enforcement now reaches small firms that trade, export or source internationally. What SMEs need is a clear, repeatable process: screen every counterparty against sanctions lists, record the result and monitor for changes over time.

Supply chain compliance for growing companies changes in 2026 because EU rules now reach past the regulated company into its suppliers: the requests for information on sourcing, ownership and risk come from clients and partners, not regulators, and they arrive more often and more structured. SMEs do not need a large team, but they need one clear process to know who they work with, collect the information once and answer every request from it.

SMEs can meet NIS2 requirements for vulnerability handling with a simple, structured reporting process: one channel where employees, suppliers and researchers can report a security weakness, confidential handling, a defined owner who assesses and fixes it, and a record of what was done. A whistleblowing system already provides that workflow, so the same channel can serve both regimes.

The ECCTA Failure to Prevent Fraud offence applies to large organisations, but it reaches SMEs through their contracts. Because the only statutory defence is evidencing reasonable procedures, UK enterprises now ask suppliers to prove anti-fraud training, whistleblowing arrangements, audit rights and termination clauses. Smaller suppliers are bound in practice, not by the statute.

In supply chain management, proportionality means focusing due diligence on the largest, most strategic suppliers, but it should not mean ignoring the smaller ones. Small suppliers carry hidden compliance, continuity and reputational risk, and they also bring flexibility, specialisation and innovation. A balanced strategy screens every supplier at a baseline level and scales scrutiny with risk, not with company size.

Supply chain ethics now comes with legal requirements. The Corporate Sustainability Due Diligence Directive, approved by the European Parliament on 24 April 2024, makes large companies responsible for identifying, preventing and remedying human rights and environmental harm across their value chains, and that duty flows down to their suppliers through contracts and questionnaires. Companies that map their chain and document supplier checks meet the demand and gain a commercial edge.