European financial supervisors have put reliance on non-EU payment solutions and technology providers on their operational-resilience agenda, warning that concentration outside the bloc can magnify geopolitical, cyber and service-disruption risks.
The European Banking Authority, European Insurance and Occupational Pensions Authority and European Securities and Markets Authority—the three European Supervisory Authorities, or ESAs—published the warning on September 23 in their Autumn 2026 update on risks and vulnerabilities. The findings had been presented to the EU Economic and Financial Committee’s Financial Stability Table on September 10.
The update does not report a payment outage, name a deficient supplier or order firms to abandon non-EU providers. Its significance is narrower and more practical: supervisors are treating payment-provider dependence as a concentration and continuity risk that financial institutions should be able to map, test and manage.
Banks rank payment dependencies near the top
The underlying report says high reliance on third-party ICT providers and payment service providers amplifies operational risk, and notes that many of those providers are domiciled outside the EU. In an EBA risk-assessment questionnaire, about 80% of responding banks regarded ICT service-provider dependencies as their biggest non-EU or non-EEA dependency challenge. Payment-solution dependencies were the second-highest material risk, cited by about 60%.
Those percentages describe banks’ assessments in the EBA questionnaire; they are not measures of the share of European payments processed by foreign companies. The report does not disclose a transaction-volume concentration figure, identify the providers behind the responses or say that 60% of payment traffic is externally dependent.
The ESAs place payment reliance within a broader pattern. They say non-EU dependencies also appear in clearing, repurchase-agreement and credit-rating infrastructure, while banks face funding gaps in some foreign currencies. Reliance on providers governed by other regulatory regimes can make the EU financial sector more exposed to geopolitical events, cross-border legal constraints and correlated operational disruption.
The control question is substitutability
For banks and payment firms, the accountability question is not simply where a supplier is headquartered. It is whether an institution knows which critical services depend on that supplier, how concentrated those dependencies are, and whether an alternative can take over within the recovery time the institution has promised.
The ESAs recommend continued monitoring of non-EU and non-EEA technology-service dependencies through oversight under the Digital Operational Resilience Act. Their report specifically says that services concentrated among a small number of providers should be included in that work, including payment services.
That direction turns vendor inventories into a resilience test. Institutions need to connect a provider to the payment products, customer journeys, data flows and settlement processes it supports; identify subcontractors and shared points of failure; and test whether contractual exit rights can work under stressed conditions. A paper migration plan is of limited value if credentials, token vaults, routing logic, fraud models or reconciliation data cannot be moved in time.
The report does not prescribe those implementation steps individually or impose a new deadline. They are the operational implications of its call for monitoring, crisis preparedness, resilience testing and contingency planning. Existing DORA obligations remain the legal framework; the Autumn update is a supervisory risk assessment, not a new binding rule.
Cyber risk raises the stakes
The ESAs also link concentrated external dependencies to cyber risk. They warn that increasingly capable AI systems could help attackers find and exploit vulnerabilities faster, while future quantum-computing capability could undermine cryptographic systems used to protect communications, transactions, databases and blockchains.
The report says firms should maintain operational resilience, cybersecurity controls and contingency planning, strengthen software quality and security practices, and prepare for AI and quantum-related threats. These concerns matter to payments because a concentrated service can transmit a technical or security failure across multiple institutions even when each institution’s own systems remain available.
No current consumer loss or merchant harm is quantified in the update. The risk is the scale of disruption that could follow if a widely shared payment or technology dependency fails and institutions cannot switch, isolate or recover it quickly. That makes evidence of tested recovery and substitutability more important than assurances that a provider is contractually replaceable.
What payment firms should expect
The immediate supervisory signal is to expect closer questions about concentration, cross-border dependencies and credible alternatives. Banks should be able to show which non-EU providers support critical payment functions and how disruption scenarios are reflected in governance, due diligence and recovery exercises. Payment service providers serving multiple regulated institutions should expect customers to seek clearer evidence on subcontracting, incident response, portability and exit support.
The ESAs’ assessment stops short of arguing for blanket localisation or strategic autonomy at any cost. It acknowledges that the EU financial system remains resilient. The warning is that resilience cannot be inferred from normal service availability: firms and supervisors need evidence that critical payment functions can continue when geopolitical, cyber or supplier failures occur together.