Build, Buy or Partner in Q4 2026: When the Buy Column Grew Teeth
On 18 November 2025, the European Supervisory Authorities named the first nineteen critical ICT third-party providers under the Digital Operational Resilience Act. The list reads like the default architecture diagram of any European bank: Amazon Web Services, Microsoft, Google Cloud, Oracle, SAP, IBM, Accenture, Capgemini, Kyndryl, Bloomberg, LSEG, Equinix, Deutsche Telekom, Orange, Colt, NTT DATA, Tata Consultancy Services, Fidelity National Information Services and InterXion. Ten months later, in June 2026, the European Commission tabled its Tech Sovereignty Package: Chips Act 2.0, a Cloud and AI Development Act, an open-source strategy and an energy-sector roadmap, all pointed at reducing the continent's reliance on a small number of foreign suppliers.
If you run innovation, strategy or transformation inside a European financial institution, those two events did not just add compliance work. They quietly rewrote the middle column of every build, buy or partner decision on your desk. And most Q4 planning documents still treat 'buy' the way they did in the first half of 2025.
The problem: the buy column grew teeth
For twenty years, the 'buy' option in build, buy or partner was the easy one. Established vendor, reference customers, enterprise agreement, done. The debate was mostly between 'buy' and 'build', with 'partner' reserved for fintech pilots that either faded or graduated into another category.
That framing no longer survives contact with 2026. Three things changed at once.
The first is direct oversight. Under DORA, the ESAs now supervise designated critical providers directly, not through the banks that use them. Your provider is not only your counterparty. It is also a supervised entity in its own right, with obligations, inspections and, if the ECB or a national competent authority insists, exit-plan tests. The relationship carries visibility it did not carry before.
The second is concentration. The nineteen designated CTPPs sit under many of the workloads that regulated firms most want to modernise: core banking on hyperscalers, agentic AI on a small handful of foundation-model hosts, data and reference services on a shrinking cluster of index and data providers. Buying more of any one of them is now a concentration decision that the ECB's 2026-28 supervisory priorities will read as risk, not efficiency.
The third is sovereignty. The Tech Sovereignty Package is not, yet, a binding rulebook for banks. It is a signal. Boards are already asking whether the AI platform under the customer-service pilot runs entirely on European infrastructure, whether the identity stack can be re-hosted on a European alternative in a reasonable timeframe, and whether the answer to those questions will change again before 2028. Innovation offices are being asked to answer sovereignty questions that were, twelve months ago, someone else's problem.
Add the ordinary delivery pressure of a European bank in Q4 (a stack of migration programmes running late, a regulatory reporting cycle that will not slip, a cost programme with next year's ratios attached) and the build, buy or partner question stops being a spreadsheet exercise. It becomes a portfolio decision with regulatory, geopolitical and delivery weight on every row.
Common approaches and their trade-offs
Most institutions are defaulting to one of three postures. Each has honest defenders. Each also has a cost this year that was smaller last year.
The first is default to buy from the biggest name available. This has kept a lot of transformation programmes moving. It compresses vendor management, uses existing enterprise agreements and leans on the fact that any auditor recognises the brand. The cost, in 2026, is that many of those names are now the CTPPs the ESAs will focus on, that the sovereignty conversation lands squarely on your relationship, and that concentration figures get harder to defend in front of a joint supervisory team. The buy is not wrong, but the negotiating position and the disclosure burden have both shifted.
The second is default to build. Some CIOs, watching vendor scrutiny rise, are quietly recategorising work as internal capability. Payments orchestration, customer identity, model-serving platforms are being pulled back inside. This gives control, and it makes the sovereignty conversation easier to close. It also puts hiring, retention and platform maintenance costs on the balance sheet permanently, in a labour market that has not eased, at the same time as EU AI Act obligations demand documented governance for anything the bank builds itself. Build is not free. It has moved from optional to explicit.
The third is default to partner with a fintech. This was the fashionable answer four years ago, and it still has real merit for specific workloads. But post-DORA, the partner has to be either non-critical enough that its failure is absorbable, or robust enough that it can meet ICT third-party obligations under Article 28. Many mid-stage European fintechs sit in between: too important to be casual about, too small to carry the full DORA operational burden on their own. Partnership is not dead. It is just no longer a shortcut around the buy question.
The pattern is the same across all three. Each posture is defensible. Each is quietly more expensive than it was a year ago. And the innovation office is expected to hold the room together while heads of transformation, procurement and second-line risk each pull the decision toward their own posture.
A smarter route: buy the peer view before the vendor pitch
The recurring failure mode is not that banks pick the wrong option. It is that they pick without having seen the option chart clearly. Vendor pitches show one column at a time. Analyst reports smooth the differences. Internal governance forums, understandably, focus on the deal in front of them.
What is missing is a peer view of how comparable institutions have actually resolved the same decision this year: what they built, what they bought, what they partnered on, and what they wish they had chosen differently. That view rarely comes from vendors, rarely comes from analysts, and never comes from public disclosures.
This is where formats like a Discovery Innovation Meeting, a Peer Forum, or the analytical work in Finance X Magazine show their utility. Not as a pitch, and not as a substitute for internal governance. As a way to test a specific build, buy or partner call against how ten peers have already resolved it, before the vendor slides start. A Roundtable format with two or three peer banks in the room does more to sharpen a build, buy or partner decision than a fortnight of desk research. A carefully framed peer forum gives an innovation lead permission to say 'we looked at this together and moved' when the second-line challenge arrives.
The point is not the format. The point is that in Q4 2026, an evidence-based peer view is a cheap and disproportionately useful input into a decision that regulators, boards and delivery teams will all inspect.
Why this matters right now
Three timing pressures converge in the next hundred days.
Q4 is when 2027 investment cases are written. A build, buy or partner call made in October will bind procurement, hiring and vendor management through most of next year. A call written for the 2025 environment will be re-litigated the moment DORA supervisory activity picks up in the first quarter.
The ECB supervisory cycle for 2026-28 treats digital operational resilience and ICT third-party risk as one of its three named priorities. That will not be reversed by Q1. Innovation portfolios that quietly deepen dependence on one or two CTPPs without a documented exit posture will be flagged, not because the individual providers are unsafe, but because the concentration is now a supervised metric.
And the EU AI Act obligations that landed on 2 August 2026 have shifted the internal governance cost of anything the bank builds itself. Build is no longer the low-friction option for AI-adjacent capability. Neither is buy. The right answer in 2026 is often a hybrid: partner where the workload is non-critical, buy where the workload is critical and the provider can carry the DORA weight, and build only where the strategic case is strong enough to fund permanent internal capability.
That hybrid decision is exactly the kind of choice that benefits from peer input.
Closing thought
Build, buy or partner has never been a purely technical question, and it has never been more political than it is in Q4 2026. Between the CTPP list, the Tech Sovereignty Package and a supervisory cycle that has moved third-party risk to the front of its agenda, the buy column now carries weight it did not carry a year ago. The build column carries a governance bill it did not carry a year ago. And partner is not the escape valve it used to be.
The teams that will move well in the next hundred days are the ones that stop treating build, buy or partner as three separate spreadsheets and start treating it as one decision with regulatory, sovereignty and delivery constraints attached. The teams that will move fastest are the ones that see how their peers have already resolved the same question, before they meet the next vendor.
If Q4 planning is on your desk this week, the useful question is not 'what will we buy'. It is 'which two peers have solved this build, buy or partner call this year, and what did they learn'. Then work backwards to the decision that fits your own bank.
