Digital finance: four suppliers account for half of critical external ICT spending
The number of contracts alone does not establish how diversified a digital infrastructure is. In its Financial Stability Report published on 13 November, the Bank of Italy describes more than 3,600 ICT suppliers and subcontractors and around 9,600 contracts for directly supervised intermediaries, referring to the end of 2025.[4][5]
This is a newly published analysis of an earlier snapshot, not a count of contracts signed yesterday.
## Concentration behind the supplier catalogue
Around 95% of contracts involve suppliers outside the intermediary's group, and roughly half support critical or important functions.[4]
For those functions, the top four direct external suppliers account for approximately 50% of total spending on supplies outside the group.[4]
That percentage applies to this specific scope, not half of all IT spending across Italy's economy.
Il Sole 24 Ore Radiocor covers supplier concentration in its 18:00 dispatch on 13 November; the official report clarifies the connection with critical functions.[5][4]
## Switching is more than signing another contract
The Bank of Italy identifies multi-layered subcontracting chains and limited supplier substitutability, highlighting the exit and business-continuity strategies required under DORA.[4]
The practical question is what remains usable during migration or disruption, rather than merely how many names appear in the purchasing directory.
The survey scope includes less significant banks, payment and electronic-money institutions and other categories in the footnote, including asset managers, Cassa depositi e prestiti and BancoPosta; it is not a survey of every European bank.[4]
## The next step is organisational
The report refers to the Bank of Italy's 17 July communication on digital resilience and AI and its invitation to prepare a report and risk-appropriate strengthening plan by 31 December 2026.[4]
Listed safeguards include governance, cyber hygiene, vulnerability management, monitoring, testing and third-party risk controls.[4]
This is neither an announcement of an ongoing attack nor a security certification for suppliers. The issue is demonstrable service continuity when a technological dependency becomes a problem.
## Sources
[4] https://www.bancaditalia.it/pubblicazioni/rapporto-stabilita/2026-2/RSF_2_2026.pdf — bankitalia
[5] https://www.ilsole24ore.com/radiocor/nRC_13.11.2026_18.00_59610596 — sole-ict