Category-specific effects of digital trust on third-party risks in the banking industry

Purpose This paper aims to investigate the relationship between digital trust and various categories of third-party risk within the Baltic banking industry, where the Digital Operational Resilience Act mandates comprehensive oversight of information and communication technology (ICT) third parties. Design/methodology/approach The study employs a mixed-methods approach. Quantitative data were collected through a survey of 138 employees involved in ICT third-party cooperation, and partial least squares structural equation modelling was used to estimate the effects of digital trust on 12 third-party risk categories. Findings were then discussed with 13 industry experts. Findings The quantitative analysis reveals that higher digital trust is associated with lower assessed risk in 10 of the 12 categories, with the strongest effects observed for concentration, contingency planning and financial and strategic risks. No statistically significant effect was found for vendor and supply-chain cybersecurity or partner-specific factor risks. Expert interviews suggest that this is because cybersecurity risk is primarily driven by external attack activity. Trust assessments often occur prior to contract and are governance-focused. Additionally, self-reported assessments may lead to higher ratings. Furthermore, contractual coverage does not eliminate cybersecurity exposure. Practical implications The findings confirm that digital trust assessment is a valuable complementary tool in third-party risk management. It provides practical value for governance, operational continuity, financial stability and strategic fit. However, it is not a reliable indicator of lower cybersecurity risk and should not replace policy-based screening. Originality/value This research presents a novel perspective on the trust–risk management relationship by empirically demonstrating the differential impact of digital trust across various categories of third-party risk.