Critical Entities, Resilience Obligations and the Evolution of Integrity Governance
From conventional compliance and asset protection to integrated governance of continuity, dependency, financial-integrity risk and institutional resilience
Critical entities are part of the societal infrastructure on which people, businesses and public authorities depend every day. Their governance must therefore address service continuity, autonomy, recovery capacity and public reliability as one connected responsibility.
Van Leeuwen Law Firm approaches critical entities on the premise that organisations delivering essential services can no longer credibly be understood merely as businesses or institutions requiring a higher level of physical, digital or operational security. Their significance is more fundamental. Energy supply, financial-market infrastructure, transport, healthcare, drinking water, digital infrastructure, food supply and other essential functions form part of the societal infrastructure on which citizens, businesses and public authorities continuously rely. The consequences of interruption rarely remain within the boundaries of the affected entity: disruption can spread through production, payments, logistics, communications, public services, healthcare, access to information and government decision-making. The standard by which governance is assessed consequently changes. Efficiency, cost discipline and formal compliance remain important, but they do not suffice when investment decisions, supplier selection, outsourcing, ownership structures, digital access and financing relationships may simultaneously affect the continuity, autonomy or recoverability of the essential service. The decisive question shifts from whether separate facilities and assets are adequately protected to whether the critical entity as a whole can prevent, withstand, absorb, contain and recover from disruption without materially undermining the reliability or governability of its public-facing function. Integrity governance therefore moves from the organisational margins to the centre of strategic decision-making. It is no longer simply a collection of controls for fraud, money laundering, sanctions breaches, bribery or conflicts of interest: it directly concerns ownership and control, suppliers and financing, access to data, crisis decisions, continuity planning and the organisation's ability to protect itself institutionally.
Van Leeuwen Law Firm connects this development directly with Integrated Financial Crime Risk Management (IFCRM). Conventional financial-crime controls remain necessary, but for a critical entity their ultimate purpose must be examined more broadly. A supplier with sanctions exposure is not merely a sanctions problem when its withdrawal could suspend an essential service. An opaque investor raises more than a disclosure or governance issue when effective control could restrict the board's freedom to act during a crisis. An IT provider represents more than ordinary third-party risk when its privileged access determines whether operations can continue. An unusual financing structure is not solely a financial concern if it creates strategic dependence. The central insight is that financial and economic relationships may themselves constitute the infrastructure through which operational, digital, governance and security vulnerabilities enter the organisation. IFCRM must make those connections visible and governable. Risk assessments should combine financial integrity with continuity and security; reporting should transform fragmented indicators into decision-useful intelligence; third-party governance should evaluate not only counterparty integrity but also access, substitutability and concentration; digital resilience should take ownership, contracts and external dependencies into account; and oversight and assurance should test whether these elements work together. Integrity governance thus evolves from compliance control into resilience governance: an integrated management architecture in which the board, Business, Operations, Procurement, Security, Technology, Legal, Compliance, Risk and Assurance can collectively identify where financial-integrity exposure may develop into undue influence, disruption or a loss of public reliability.
Critical entities as foundations of societal continuity, public reliability and economic stability
Governance responsibilities deepen when the functioning of an entity becomes a prerequisite for the functioning of society, public authorities and markets
Van Leeuwen Law Firm regards critical entities as organisations whose importance extends beyond their immediate commercial, institutional or sectoral interests. Their services are preconditions for the operation of other organisations and societal processes. Without dependable energy, production and digital infrastructure cannot operate normally; without functioning payment systems, economic activity is disrupted; without telecommunications and data infrastructure, citizens, companies and public authorities lose essential means of communication; without transport and logistics, manufacturing and distribution chains falter; and interruptions to healthcare or drinking-water supplies may have immediate and serious consequences for society. For that reason, the decisive consideration is not whether an entity is publicly, privately or jointly owned, but what the interruption of its functions would mean in practice. A privately owned business can perform a function of profound public importance when its failure rapidly creates disruption elsewhere. Its board must accordingly evaluate investments, outsourcing, supplier choice, ownership, access rights and risk appetite against a broader standard. An arrangement may be commercially efficient yet produce an unacceptable concentration of risk; contractual protections may appear robust while genuine replacement of a provider is impracticable; and a seemingly ordinary dependency can become a loss of decision-making autonomy during a crisis. These consequences need to be assessed before a commercial choice becomes an embedded vulnerability.
Nor does public reliability follow merely from certification or reassuring statements. What matters is demonstrable governance capability: can the entity understand its dependencies, identify anomalies, escalate risks, take decisions under pressure and restore an essential service in a controlled manner? Integrity acquires a deeper institutional significance in this setting. Opaque ownership, a conflict of interest, inadequate third-party screening or uncontrolled external access may create primarily financial, legal or reputational exposure in a non-critical business. In a critical entity, the same shortcomings can directly threaten services on which the public depends. Integrity governance must therefore establish which persons, suppliers, financiers and other external partners can exert effective influence over critical assets, information, maintenance, systems and decisions. The shift is from corporate integrity to institutional reliability. The question is not simply whether individual relationships are lawful, but whether the overall governance and dependency model enables the entity to deliver its societal function predictably, independently and with a credible capacity to recover. This requires boards to connect legal due diligence with operational insight and to treat public-service continuity as a material factor in the decisions they authorise.
- 01Critical Entities & Essential Societal Functions
- 02Public Reliability & Institutional Responsibility
- 03Economic Stability & Critical Service Continuity
- 04Essential Functions & Systemic Dependency
- 05Ownership, Investment & Continuity Governance
- 06Risk Appetite within Critical Service Providers
- 07Institutional Trust & Demonstrable Resilience
- 08Integrity Risk & Public-Service Reliability
- 09Critical Functions beyond Legal Form
- 10Board Accountability for Societal Continuity
European resilience obligations as a new context for integrated integrity governance
Moving from discrete security measures to demonstrable governance of risk analysis, organisational preparedness, incidents and recovery
For Van Leeuwen Law Firm, the European approach to critical-entity resilience marks a fundamental shift in the way essential-service operators must think about protection. The relevant framework reaches beyond securing buildings, installations or individual assets: it is concerned with the entity as an organisational nexus for essential services. Risk must therefore be understood more broadly. Natural hazards, sabotage, insider threats, hybrid interference, terrorism, health emergencies, supply-chain disruption and other events should not only be classified separately, but also assessed for their interaction and potential cumulative effects. The board cannot discharge its responsibilities merely by confirming that each specialist function has its own controls. The real issue is whether those measures, taken together, allow essential services to remain governable under a range of disruptive conditions. Organisational risk analysis, preparedness, incident reporting, recovery, third-party management and the ability to evidence board-level oversight all form part of one resilience architecture. Precisely which legal duties apply depends on the entity's designation, sector and applicable national implementation; the approach must not confuse a general resilience principle with a legal obligation imposed uniformly on every operator.
This shift has direct consequences for Integrated Financial Crime Risk Management. Conventional assessment of AML/CFT, sanctions, bribery, corruption, fraud and third-party integrity remains indispensable, but its systemic significance changes. An opaque counterparty presents more than potential misconduct when it has access to essential processes. A complex investor structure poses more than a corporate-transparency problem when unclear control could limit the entity's autonomy during a crisis. An outsourced technology function is not simply vendor risk when the same provider controls data, identity, remote access and operational functionality. Financial-crime governance must therefore be linked to resilience analysis by tracing how financial, contractual and governance relationships affect continuity, access, control and recovery. Legal, Compliance and Financial Crime functions need closer working relationships with continuity planning, crisis management, critical-function classification and third-party resilience. Equally, Security, Operations and Continuity teams must recognise that economic and integrity signals can reveal the early conditions for later operational disruption. These resilience obligations do not replace integrity governance; they broaden its objectives and deepen the accountability of those responsible for managing it. The result should be a documented, proportionate and entity-specific system rather than a superficial overlay of new terminology on existing policies.
- 01Critical Entities Resilience Framework
- 02Entity-Wide versus Asset-Based Resilience
- 03All-Hazards Risk Assessment
- 04Organisational Resilience Measures
- 05Incident Preparedness & Reporting
- 06Board-Level Resilience Accountability
- 07Integrity Risk within Resilience Governance
- 08Critical Service Continuity & Recovery
- 09Cross-Domain Risk Integration
- 10Demonstrable Resilience & Supervisory Readiness
Connecting financial-integrity risk with continuity, security and disruption risk
Understanding financial and economic relationships as possible pathways through which dependency, influence and operational vulnerability become embedded
Within a critical entity, Van Leeuwen Law Firm treats financial-integrity risk as an early-warning layer for wider institutional vulnerability. Traditional financial-crime categories—money laundering, fraud, corruption, sanctions, bribery, conflicts of interest and third-party integrity—remain relevant, but their implications may be more extensive where an organisation performs an essential societal function. An atypical financing structure may raise questions about the source of funds and, at the same time, strategic leverage. A service provider with unclear ownership may present sanctions or bribery exposure while acquiring privileged access to critical systems. An intermediary with unusual contractual rights may alter the real balance of decision-making authority. Financial and economic relationships can thus create the channels through which operational dependence, influence and the capacity to disrupt are built into an organisation. Assessment cannot stop at whether an investment, transaction or contract is formally lawful. Relationships that are lawful, or difficult to classify as misconduct, may nevertheless impair the autonomy and recoverability of a critical entity. It would be equally mistaken, however, to treat every irregularity as a security threat: credible causal pathways and the actual materiality of the potential impact must be established.
That requires a shared picture of risk in which Legal, Compliance, Security, Procurement, Technology, Operations and senior management can examine the same relationship through different dimensions of impact. A supplier decision should be assessed for price, performance and contractual compliance, but also ownership, sanctions exposure, access privileges, replaceability, concentration and strategic dependence. Investment appraisal should consider actual control rights and potential influence alongside return and legal structure. Outsourcing arrangements should explain not only service levels but who will effectively control the data, systems and means of recovery. This approach prevents financial-crime signals from remaining isolated within Compliance when they have continuity implications, or technical dependencies from remaining within Security without analysis of the economic mechanisms that created them. IFCRM serves as a bridge between financial and economic intelligence and resilience governance. Its purpose is not to turn every integrity concern into a national-security problem, but to recognise when an ownership, contractual or financial anomaly presents a credible route to loss of control or material operational disruption. That distinction permits proportionate intervention supported by evidence rather than speculative escalation.
- 01Financial Integrity as a Resilience Indicator
- 02Ownership, Control & Strategic Autonomy
- 03Financing Structures & Dependency Risk
- 04Third Parties with Critical Operational Access
- 05Procurement Integrity & Continuity Exposure
- 06Sanctions Risk & Essential-Service Dependency
- 07Economic Relationships as Disruption Pathways
- 08Cross-Risk Intelligence & Escalation
- 09Financial Crime Signals within Security Governance
- 10Integrity–Continuity–Security Integration
Critical sectors exposed to financial-criminal, hybrid, physical and digital pressure
Recognising converging pressures that build simultaneously through economic relationships, technology, access and dependence
Critical sectors are particularly vulnerable to compound threats because the consequences of disruption can be substantial while society's tolerance for prolonged interruption is low. Financial-criminal networks, state-linked or other influence strategies, cyber actors, insiders, physical saboteurs and different sources of pressure need not act independently. Economic penetration can establish durable access; outsourcing can create technical reliance; digital intrusion may increase information asymmetry; physical disruption can exhaust recovery capacity; and contracts may prevent a rapid change of supplier or system. A conventional catalogue that assigns fraud to one function, cyber risk to another and physical security to a third cannot adequately explain how the entity might actually be destabilised. Van Leeuwen Law Firm therefore focuses on threat convergence: where could economic, digital, physical and governance vulnerabilities reinforce one another? The relevant assessment must examine combinations of weaknesses and the practical pathways through which they could undermine an essential function, rather than treating each risk rating as an isolated result.
Financial-crime intelligence has a distinctive role because economic relationships can provide access long before a visible security incident occurs. An investment, joint venture, supplier contract or intermediary relationship may be formally legitimate while giving a party a position in maintenance, software, data access, logistics or supply-chain decisions. In capital-intensive and technically specialised sectors, such relationships are often durable and difficult to replace; an early choice can subsequently become a structural dependency. The threat is therefore not limited to criminal proceeds entering a sector. Financial relationships, contracts and third-party structures can also be used to obtain influence, information, access or dependency. IFCRM should accordingly contribute to multidimensional threat assessment. A cyber weakness may be rooted in poor supplier due diligence; a maintenance failure may have been preceded by conflicts of interest; and a physical-access problem may be connected with inadequate contractor governance. The board gains a real advantage when these connections become visible early enough for proportionate intervention, before a succession of individually modest weaknesses forms a material route to disruption. This calls for intelligence sharing between functions, tested escalation triggers and scenario analysis—not an assumption that unrelated events must necessarily reflect one hostile actor.
- 01Compound & Hybrid Threats
- 02Financial-Criminal Pressure on Critical Sectors
- 03Strategic Influence & Economic Penetration
- 04Cyber-Physical Threat Convergence
- 05Insider Risk & Privileged Access
- 06Third-Party Infiltration & Dependency
- 07Critical Supply-Chain Manipulation
- 08Information Asymmetry & Governance Pressure
- 09Multi-Layer Threat Intelligence
- 10Integrated Protection against Cascading Disruption
Risk assessment, reporting and supervision as core requirements for essential-service organisations
Replacing retrospective compliance evidence with a continuous management-information system that detects vulnerability, escalation and structural deterioration
Van Leeuwen Law Firm regards risk assessment for critical entities not as an occasional exercise conducted principally to satisfy formal requirements, but as the analytical foundation for continuity, prioritisation and management intervention. The organisation must be able to understand the internal and external factors that could impair an essential service, the ways in which they interact and the organisational, technical and governance responses available. A static risk register will not do. Threats evolve, suppliers change, outsourcing expands, systems become interconnected, ownership rights shift and concentrations once considered acceptable can turn into material vulnerabilities. Risk assessment must be sufficiently dynamic to reveal these developments. Financial-crime intelligence belongs within this wider risk picture. Unusual ownership changes, atypical supplier behaviour, repeated exceptions, inadequate audit rights and unusual contractual structures may not prove imminent disruption on their own. In combination with other evidence, however, they can acquire far greater relevance for board-level decisions. The entity must therefore distinguish indicators that warrant investigation from established risks and record the basis for proportional action.
Reporting and oversight complete that model. Management information should not simply document what has already happened: it should allow decision-makers to distinguish routine operational noise from signs of structural deterioration. Serious incidents may be preceded by unclear responsibility, recurring exceptions, atypical supplier patterns, deficient access to audit evidence, opaque ownership, outsourcing concentration or slow escalation of integrity concerns. If the indicators remain dispersed across different dashboards, the board may never see their combined significance. Effective reporting brings dependencies, recurring exceptions, control degradation and material integrity signals together in a form that supports timely intervention. Supervisory and assurance functions must then look beyond the existence of discrete controls. They should assess the quality of governance, risk classification, third-party due diligence, escalation, incident management and the extent to which financial-crime intelligence actually informs continuity decisions. Van Leeuwen Law Firm approaches risk analysis, reporting and assurance as one evidential governance chain. A critical entity should be able to explain why its resilience assessment is justified by its risk picture, decision record, control performance, incident response and lessons learned. Documentary evidence is essential, but it has to demonstrate operating effectiveness rather than only the existence of procedures.
- 01Integrated Critical-Entity Risk Assessment
- 02Dynamic Threat & Dependency Analysis
- 03Financial Integrity within the Enterprise Risk Picture
- 04Resilience-Oriented Management Information
- 05Early Warning & Structural Weakness Indicators
- 06Incident Reporting & Escalation Quality
- 07Third-Party & Concentration Risk Reporting
- 08Supervisory Readiness & Governance Evidence
- 09Board Oversight & Demonstrable Intervention
- 10Risk Analysis, Reporting & Assurance as One Governance Chain
Integrated Financial Crime Risk Management beyond conventional compliance in critical entities
Moving from discrete financial-crime controls to a board-level capability linking economic signals with continuity, influence and operational resilience
Van Leeuwen Law Firm regards Integrated Financial Crime Risk Management within critical entities as a fundamental extension of conventional compliance. Traditional programmes properly address money laundering, terrorist financing, sanctions, fraud, bribery and corruption, conflicts of interest, unusual transactions, and customer and third-party risks. But that approach is no longer sufficient when the very same economic relationships determine access to systems, ownership and control, the availability of technology, maintenance, financing, data processing or operating continuity. The unit of analysis must move beyond the individual transaction or counterparty to the structural significance of the relationship for the operation of the critical entity. A supplier may pass conventional due diligence and still pose material resilience risk because it possesses exclusive technical know-how, exercises uncontrolled privileged access or cannot realistically be replaced. An investor may meet disclosure requirements yet undermine governance where contractual rights, financing leverage or indirect influence constrain the board's practical independence in a crisis. A legally sound financing arrangement can leave an entity economically dependent on a party whose future geopolitical, sanctions or integrity exposure severely limits freedom of action. IFCRM must therefore ask not only 'Is this relationship permitted?' but also *'What access, dependence, influence, information advantage and capacity for disruption does it create, and what are the consequences for the essential service?'* Third-party selection, investment approvals, governance arrangements, escalation and continuity planning must all take that wider question seriously. This does not displace ordinary compliance obligations; it extends their relevance to the entity's actual public-facing function.
The change also affects the place of Legal, Compliance and Financial Crime functions within the operating model. Van Leeuwen Law Firm does not advocate erasing accountability between the Three Lines. Instead, it advocates an integrated Target Operating Model in which risk ownership, independent oversight and assurance can examine the same material set of facts without losing their distinctive responsibilities. Business and Operations understand how essential processes work; Procurement knows suppliers, contractual dependencies and substitutability; Technology and Security understand access, infrastructure and systemic concentration; Finance knows financial flows and funding structures; Legal analyses enforceable rights and decision-making powers; Compliance and Financial Crime contribute ownership, sanctions, fraud, corruption and integrity intelligence; Investigations reconstruct anomalies and causation; and Assurance tests the architecture under both ordinary and stressed conditions. The central question becomes not *'Which department owns this risk?'* but 'How is relevant information joined up so that an economic warning can be recognised before it becomes a continuity problem, security weakness or strategic dependency?' That requires common risk taxonomies, coherent escalation standards, intelligence at the relationship level, dependency mapping, integrated management reporting and clear decision rights when integrity and continuity concerns intersect. IFCRM thus evolves from a set of controls into an institutional sensing and steering capability. It identifies not only misconduct, but also how apparently legitimate economic choices can gradually erode governance capacity, substitutability and resilience. The test of the model is whether decision-makers can act on that insight in time, with evidence and proportionate authority.
- 01IFCRM beyond Traditional Compliance
- 02Financial Integrity & Essential-Service Continuity
- 03Ownership, Control & Strategic Influence
- 04Financial Relationships as Resilience Dependencies
- 05Third-Party Integrity & Disruption Potential
- 06Integrated Risk Intelligence across the Three Lines
- 07Financial Crime Signals as Early-Warning Indicators
- 08Board-Level Financial Crime & Resilience Governance
- 09Cross-Domain Escalation & Decision Rights
- 10From Compliance Control to Institutional Resilience Capability
Supply-chain dependencies, third parties and digital reliance as defining vulnerabilities
From supplier administration to end-to-end dependency governance across access, concentration, substitution, subcontracting and recovery
Supply-chain dependence is one of the defining vulnerabilities of critical entities because essential services are increasingly produced outside any single organisation's own perimeter. Modern infrastructure depends on layered ecosystems of suppliers, cloud providers, software developers, maintenance partners, data processors, logistics operators, specialist contractors, financial service providers and subcontractors. That architecture brings efficiency, scale and specialised expertise, but also generates dependencies that may only become fully apparent during a disruption. Contractual reliability is therefore only the starting point. Van Leeuwen Law Firm also examines what function a provider actually performs, what access it holds, how difficult it would be to replace, which subcontractors sit behind it, where data and infrastructure are located, how quickly an alternative could be activated and what follows if the relationship ends unexpectedly. An apparently peripheral provider may prove to be a single point of failure because it controls unique credentials, maintains proprietary software, supplies exclusive replacement parts or is indispensable to incident recovery. Third-party management consequently cannot be limited to standard screening and contractual clauses. It must evaluate access, replaceability, ownership, sanctions sensitivity, subcontracting and operational concentration together—and test whether the organisation's assumptions about those factors are accurate.
Van Leeuwen Law Firm connects traditional third-party integrity with the entire dependency lifecycle: selection → due diligence → contracting → access → monitoring → change → incident → substitution → exit. Onboarding should identify not just red flags but the structural reliance being created. Contracts should address information and audit rights, notification of ownership changes, subcontracting controls, security standards, incident reporting, business continuity, data portability and exit assistance, so governance does not disappear when execution is outsourced. Monitoring must go beyond periodic recertification to track changes in ownership, deteriorating service quality, sanctions exposure, cyber incidents, pricing anomalies, unexpected subcontracting and increasing reliance on exceptional arrangements. Concentration deserves special scrutiny. Suppliers that appear commercially independent may ultimately rely on the same cloud infrastructure, parent company, software component or logistical route: apparent diversification can conceal a common point of failure. Extended enterprise governance therefore looks beyond first-tier suppliers to the relationships that determine the critical entity's real ability to continue, recover and exercise control. An organisation should be able to distinguish manageable inconvenience from genuine dependency that could threaten an essential function, and should know who may decide on substitution and how those decisions will be implemented. For critical entities, third-party governance is not merely a supporting procurement activity. It is a central element of institutional resilience and defensible board-level stewardship.
- 01Critical Third-Party Dependency
- 02Supply-Chain & Sub-Outsourcing Visibility
- 03Vendor Ownership & Integrity Risk
- 04Access, Privilege & External Control
- 05Concentration & Single-Point-of-Failure Risk
- 06Substitutability & Exit Readiness
- 07Contractual Resilience & Audit Rights
- 08Continuous Third-Party Risk Intelligence
- 09Dependency Mapping across the Extended Enterprise
- 10End-to-End Critical Supply-Chain Governance
Digital resilience as a prerequisite for operational continuity and systems trust
Treating digital infrastructure as part of the essential service itself, with cyber resilience linked to governance, third parties, data integrity and recoverability
Van Leeuwen Law Firm approaches digital resilience in critical entities not as a specialist IT issue but as a constitutive requirement of operational continuity. Digital systems no longer serve administrative functions alone. They manage production, identity and access, payments, logistics, communication, customer interaction, monitoring, maintenance and crisis response. A disturbance to software, data, identity or connectivity can therefore directly impair physical or societal services. Ransomware may make operational assets unavailable; compromised credentials may grant unauthorised access to critical environments; manipulated data may cause operators to make incorrect decisions; a defective software update may interrupt an essential function; and a cloud outage may simultaneously disable several services. The crucial dividing line is not between 'cyber' and 'operations', but between systems that remain governable under stress and systems whose digital dependencies are poorly understood. Systems trust rests on demonstrable control over access, logs, backups, recoverability, changes and the privileges of external service providers. It also requires understanding how failures in one digital component could cascade into other critical processes.
Digital resilience must consequently be linked with IFCRM and integrity governance. Cyber exposure does not arise only from malicious code or technical defects. Its origins may lie in procurement, outsourcing, ownership, weak access governance, inadequate segregation of duties, deficient screening, conflicts of interest or contracts that confer much greater practical power on outside parties than originally intended. A critical entity needs to know not only whether a supplier meets technical security standards, but also who controls it, which subcontractors are engaged, who has remote access, how permissions are granted, what must be reported after an incident and how quickly privileges can be withdrawn. It also needs an explicit recovery architecture: which systems will be restored first, which information is authoritative, what manual alternatives exist, which dependencies determine recovery time, and who is empowered to depart from normal procedures under emergency conditions? Rapid incident response must not become unregulated improvisation. Even under severe time pressure, legal authority, documentation, preservation of evidence and accountability must remain sufficiently clear. In Van Leeuwen Law Firm's approach, digital resilience combines cybersecurity, data integrity, continuity, third-party governance and executive crisis decision-making. Confidence in the system is earned only when stakeholders can see that the entity is capable not merely of detecting incidents but of maintaining and restoring its essential function in a lawful, controlled and explainable manner.
- 01Digital Resilience & Essential-Service Continuity
- 02Cyber-Physical Dependency
- 03Identity, Access & Privileged Control
- 04Cloud & Critical Technology Concentration
- 05Data Integrity & Decision Reliability
- 06Third-Party Digital Access
- 07Backup, Recovery & Restoration Governance
- 08Cyber Incident Escalation & Crisis Decision-Making
- 09Digital Dependency Mapping & Scenario Testing
- 10System Trust through Demonstrable Digital Resilience
Public–private cooperation as a condition for protecting vital functions
Organising shared societal responsibility without obscuring public direction, private ownership or institutional roles
Van Leeuwen Law Firm treats the protection of vital functions as a shared responsibility with clearly differentiated roles. Critical infrastructure and essential services are operated to a significant extent by private and semi-public organisations, even though serious interruptions directly affect wider societal interests. A model in which public authorities simply set standards and each company implements them in isolation does not sufficiently reflect those interdependencies. Public actors may possess intelligence, cross-sector threat assessments, national-security context and system-wide coordinating responsibilities that individual operators cannot reproduce. Critical entities, in turn, possess detailed operational knowledge of their assets, suppliers, dependencies, customer impacts and the constraints of practical recovery. Effective public–private cooperation must connect these distinct perspectives through ongoing interaction among national strategy, sector expertise, supervision, information exchange, preparedness and collective learning. The governance challenge is to make shared information usable in real decisions without dissolving private responsibility or obscuring the limits of public authority. Coordination must have a sound legal basis and must not assume that the public interest overrides every requirement of confidentiality, due process or organisational accountability.
That collaboration needs to extend beyond meetings convened after an incident. Van Leeuwen Law Firm advocates continuous public–private resilience governance, including recurring threat dialogue, sectoral exercises, joint scenario analysis, clear escalation routes, incident-information protocols, lessons learned and mechanisms for turning public threat assessments into operational priorities. Confidentiality, personal data, commercially sensitive information, legal professional privilege and the legal limits of information sharing require careful attention. Not every private vulnerability should be circulated widely, and not every intelligence signal may lawfully or safely be transmitted for operational use. Governance should therefore determine in advance which information matters, with whom it may be shared, under what legal conditions, for which purpose and who is responsible for responding. IFCRM can supply a common analytical language: financial flows, ownership, supplier relationships, sanctions exposure and unusual commercial behaviour may be private integrity concerns as well as indicators of wider strategic risk. The aim is shared situational awareness without diffuse accountability. The public sector retains its roles in policy, applicable standards and systemic coordination; the critical entity remains responsible for its concrete risk management and service continuity; and competent supervisors examine the effectiveness and coherence of the measures taken. Properly designed cooperation is not a substitute for governance. It enables separate sources of knowledge to be brought together before fragmented warning signs develop into a systemic incident, while preserving each participant's legal mandate and responsibilities.
- 01Public–Private Resilience Governance
- 02Shared Situational Awareness
- 03Public Threat Intelligence & Private Operational Insight
- 04Sectoral Cooperation & Collective Preparedness
- 05Information Sharing with Legal Safeguards
- 06Joint Scenario Planning & Exercises
- 07Incident Escalation & Coordinated Response
- 08Clear Public and Private Decision Rights
- 09Cross-Sector Learning & Threat Adaptation
- 10Shared Protection with Distinct Accountability
Resilience of critical entities as the next stage in Integrated Financial Crime Risk Management
Developing IFCRM into an intelligence-led governance model for continuity, autonomy, recovery and the protection of essential services
Van Leeuwen Law Firm regards the resilience of critical entities as a principled next stage in Integrated Financial Crime Risk Management. Established subjects do not disappear: AML/CFT, sanctions, fraud, bribery and corruption, conflicts of interest, third-party integrity, unusual transactions and investigations remain essential capabilities. What changes is the measure of effectiveness. A sanctions alert may be handled correctly yet fail to reveal that the affected provider is operationally irreplaceable. Understanding a beneficial-ownership structure is insufficient if effective control rights undermine the board's autonomy in a crisis. An outsourcing arrangement can comply formally with policy while leaving the provider indispensable to recovery of the essential service. The shift is to situate traditional integrity controls within the wider architecture of resilience. Financial-crime management must help identify pathways to influence, dependence, disruption and deterioration of essential services, not merely document that the relevant compliance processes have operated. IFCRM thus moves from measuring compliance effectiveness towards testing institutional resilience effectiveness. This is a substantive change in purpose rather than a renaming of existing checks.
Van Leeuwen Law Firm sees that development as an integrated management cycle in which governance, risk intelligence, data, technology, operations, third parties, investigations, escalation, continuity, remediation and assurance continually inform one another. The Three Lines Model remains valuable for clarity of roles, but it should not produce institutional separation in which each line maintains incompatible taxonomies, isolated data and competing management accounts of the same risk. First Line operational intelligence should improve Second Line risk assessment; financial-crime findings must feed back into supplier selection, investment, access design and continuity planning; investigations should uncover structural dependencies; and Third Line assurance should examine not only whether controls existed on paper, but also where governance weaknesses and cross-domain reliance generate material exposure. Ultimately, the board must ask something more demanding than 'Do we have enough financial-crime controls?': *'Do we have an integrated system that recognises in time how financial and economic signals may affect our essential functions, enables consistent decisions under stress, and can demonstrably recover and learn?'* The desired model is adaptive, intelligence-led and evidence-based, enabling relevant information to reach decision-makers before manageable risk becomes uncontrollable. The objective is not absolute immunity. It is the more demanding condition of a critical entity able to maintain its essential function lawfully, governably, transparently and sustainably despite abuse, undue influence, digital disruption, supply-chain failure or geopolitical pressure. Financial integrity, continuity and resilience must reinforce one another in practice, and that claim must be capable of independent scrutiny.
- 01Critical-Entity Resilience as the Next IFCRM Frontier
- 02From Financial Crime Control to Continuity Protection
- 03Integrity Intelligence & Essential-Service Governance
- 04Financial, Digital & Operational Dependency Integration
- 05Three Lines within One Resilience Architecture
- 06Board-Level Resilience & Executive Accountability
- 07Continuous Risk Intelligence & Early Warning
- 08Assurance of Cross-Domain Control Effectiveness
- 09Adaptive Remediation, Recovery & Organisational Learning
- 10Intelligence-Driven, Evidence-Based & Resilient IFCRM
Explore related perspectives
Critical entities are part of the societal infrastructure on which people, businesses and public authorities depend every day. Their governance must therefore address service continuity, autonomy, recovery capacity and public reliability as one connected responsibility.
Strategic questions for critical entities and resilience
Questions to assess essential functions, financial-crime indicators, ownership, third parties, digital dependencies, recovery capacity and public reliability as one integrated governance responsibility.
- Which functions of your organisation are so essential that their failure would immediately affect societal continuity, public reliability or economic stability?
- Have applicable European resilience obligations been translated into a demonstrable system of risk assessment, incident preparedness, recovery and board accountability?
- Are financial-integrity risks systematically linked to continuity, security, dependence and disruption risks?
- Can your organisation identify compound threats in which financial, digital, physical, hybrid and governance weaknesses reinforce one another?
- Does management information reveal structural weakening, concentration risks, recurring exceptions and relevant financial-crime indicators in time?
- Does IFCRM function as an institutional capability for sensing and steering, rather than solely as a compliance control framework?
- Can you trace and govern critical suppliers, subcontracting, privileged access, ownership, substitutability and exit preparedness end to end?
- Is digital resilience linked to data integrity, access governance, third-party risk, recovery and executive crisis decisions?
- Is there a continuing public–private governance model for threat intelligence, scenario exercises, escalation and shared lessons learned?
- Can the board demonstrate that IFCRM, continuity, resilience, remediation and assurance work together to protect and strengthen the essential service?
Connect integrity, dependencies and continuity before an apparently ordinary commercial relationship becomes a critical vulnerability.
Van Leeuwen Law Firm connects financial-crime intelligence, ownership, third-party governance, digital resilience, continuity, crisis decisions and assurance in a legally and organisationally defensible resilience architecture.