Third-Party Risk

Third-party risk is the risk that a firm suffers loss, disruption, regulatory breach or harm to customers because of a supplier, partner or other outside organisation it relies on. In financial services those third parties include technology vendors, cloud providers, card processors, partner banks, fintech partners, outsourced call centres, agents and payout partners.

The discipline of controlling it is called third-party risk management, and is also known as vendor risk management. Regulators are clear that a bank or payment firm can hand over a task but not its responsibility: if a supplier mishandles customer data, fails to screen for sanctions or goes offline, the regulated firm answers for it. Third-party risk overlaps with operational risk, cybersecurity risk and concentration risk.

Suppose you run a restaurant and hire a cleaning company, a delivery app and a payroll service. Each makes life easier. But if the cleaners skip the kitchen, the health inspector fines you, not them. If the payroll service collapses, your staff still expect to be paid. Your business now depends on how well other people do their jobs.

Banks and payment firms depend on outsiders far more than a restaurant does. A single app might rely on a cloud host, a card processor, an identity-check service and a partner bank. Third-party risk management is the habit of choosing those partners carefully, writing clear contracts, keeping an eye on them and having a plan for when one of them lets you down.

• Technology and cloud. Core systems, middleware and data often run on outside platforms. On 19 July 2024 a faulty software update from the security vendor CrowdStrike crashed Windows computers worldwide, disrupting banks, airlines and payment services that had never been attacked.
• Bank–fintech partnerships. In banking-as-a-service, a sponsor bank relies on fintechs and middleware firms to onboard customers and keep records. The April 2024 bankruptcy of the middleware company Synapse left many end users unable to reach funds held in pooled for-benefit-of accounts while the records were reconciled.
• Compliance outsourcing. Firms that rely on vendors for know your customer checks, sanctions screening or transaction monitoring remain liable for any failures.
• Agents and partners. Money transmitters depend on agents and payout partners in other countries, and banks on correspondents, whose own controls they cannot see directly.
• Fourth parties. Suppliers have suppliers; a vendor's subcontractor can be the weak link.

In June 2023 the US Federal Reserve, FDIC and OCC replaced their separate rules with one Interagency Guidance on Third-Party Relationships: Risk Management. It describes a life cycle that most firms worldwide follow in some form:

1. Planning. Decide whether to use an outside party at all, and what risks the activity carries.
2. Due diligence and selection. Check the candidate's finances, controls, security, licences and ownership; this due diligence is sometimes called know your vendor.
3. Contract negotiation. Set service levels, audit and data-access rights, security duties, incident notification, subcontracting rules and exit terms.
4. Ongoing monitoring. Review performance, incidents, audit reports and financial health, more closely for critical suppliers.
5. Termination. Exit in an orderly way, moving the activity to another provider or back in-house and recovering data.

The guidance stresses proportionality: a firm should spend most effort on suppliers that support critical activities, and less on, say, an office stationery vendor. Many firms therefore tier suppliers as critical, high, medium or low and match the depth of review to the tier, as part of wider risk management.

• European Union. The European Banking Authority's 2019 guidelines on outsourcing set rules for banks, payment institutions and e-money institutions. The Digital Operational Resilience Act (DORA), applied since 17 January 2025, adds a register of all ICT third-party arrangements, mandatory contract clauses and exit strategies. In November 2025 the European Supervisory Authorities published the first list of designated critical ICT third-party providers, including large cloud companies, which they now oversee directly.
• United Kingdom. A critical third parties regime, in force since 1 January 2025, lets HM Treasury designate suppliers whose failure could threaten financial stability, after which the Bank of England, PRA and FCA can supervise them.
• Payments and AML. Rules on agents and distributors of payment and e-money firms, and expectations from the Financial Crimes Enforcement Network and state regulators on money transmitter agents, make the principal firm responsible for agent compliance.

Third-party risk cannot be designed away. Small firms have little power to negotiate audit rights with global cloud providers, and questionnaires and certifications such as SOC 2 reports give only a partial view. Heavy reliance on a few large suppliers across the whole financial sector creates shared exposure that individual firms cannot diversify, which is why supervisors now oversee some providers directly. Strong programmes therefore combine paperwork with practical resilience: tested backup providers, data that can be moved, and plans for running critical services if a supplier disappears. Supplier failures also feed reputational risk, because customers blame the brand they deal with, not the vendor behind it.

• Federal Reserve SR 23-4: Interagency Guidance on Third-Party Relationships: Risk Management
• European Supervisory Authorities designate critical ICT third-party providers under DORA