What is TPRM? Third-Party Risk Management, Explained
Key takeaways
- TPRM covers every external relationship — vendors, contractors, advisors and technology providers — not just suppliers.
- 61% of data breaches now involve a third party, according to IBM’s 2024 Cost of a Data Breach Report.
- US programmes are shaped primarily by OCC Bulletin 2023-17 and NIST SP 800-161, with GLBA and NYDFS adding sector-specific obligations.
- Questionnaire-only programmes miss what vendors will not or cannot disclose — independent screening closes that gap.
- Most regulated firms sit at maturity Level 2 or 3 out of 5; regulators effectively expect Level 4.
A complete TPRM programme runs across the full vendor relationship lifecycle: from pre-onboarding due diligence through continuous in-life monitoring to formal offboarding. It covers cybersecurity risk, financial stability, regulatory compliance, reputational exposure, ESG obligations and fourth-party (sub-vendor) risk at the same time.
Third-party risk management is most commonly run as a formal function in regulated industries — financial services, insurance, healthcare and critical infrastructure — where regulators including the OCC, the Federal Reserve, the FCA and the EBA impose explicit, binding obligations to manage third-party risk. TPRM is also known as “vendor risk management,” “supply chain risk management” or “supplier risk management,” and sits as a defined subset within the broader discipline of enterprise risk management.
TPRM (Third-Party Risk Management) is the process an organisation uses to identify, assess and control the risks arising from external vendors, suppliers, contractors and service providers across the full relationship lifecycle, from due diligence through continuous monitoring to offboarding.
Related: What is supply chain risk management? | Enhanced due diligence explained | Third-party risk management framework
What does TPRM stand for?
TPRM stands for Third-Party Risk Management. “Third-party” means any external organisation or individual providing goods, services, data access or operational capability to your organisation. “Risk management” is the structured discipline of identifying, evaluating, treating and monitoring risk before, during and after the relationship.
| Term | Meaning |
|---|---|
| TPRM | Third-Party Risk Management |
| VRM | Vendor Risk Management (narrower scope) |
| TPVRM | Third-Party Vendor Risk Management |
| 3rd party risk management | Informal variant of TPRM |
| Supplier risk management | Procurement-led variant, typically supply chain focused |
| Third-party due diligence | The assessment component of TPRM |
Related: TPRM vs vendor risk management: full comparison | What is a vendor risk assessment? | TPRM questionnaire guide
Why TPRM matters in 2026
Third parties are the primary attack surface for US organisations today.
61% of data breaches now involve a third party. (IBM Cost of a Data Breach Report 2024) The share has risen consistently since 2020 as US firms outsource more critical operational and technology functions.
US regulatory scrutiny tightened through 2023–2025. The OCC’s Third-Party Relationships Interagency Guidance (OCC Bulletin 2023-17) set the lifecycle-based standard national banks must now follow. NIST SP 800-161 Rev.1 (NIST) governs cyber supply chain risk management across federal agencies and their contractors. At state level, NYDFS 23 NYCRR 500 requires regulated New York financial entities to run a documented third-party service provider security policy with annual certification.
UK and EU firms with US operations carry a second layer of obligation. DORA (EU) came into full force across EU financial services in January 2025, and the FCA’s operational resilience rules (PS21/3) embed parallel requirements in the UK. A US firm with EU or UK regulated entities needs to satisfy both sets of rules on the same vendor population — see the full regulatory table below.
Programme gaps carry direct financial consequences. In 2024, the FCA issued fines totalling £57.4m related to inadequate third-party and outsourcing controls. (FCA Annual Report 2023/24) In the US, OCC and Federal Reserve examiners now treat third-party risk as a standing supervisory priority rather than a periodic review item.
Is your TPRM programme built for 2026 scrutiny?
Neotas runs third-party risk programme reviews against OCC, NIST and FCA requirements for US and UK financial services and healthcare organisations.
See the Neotas TPRM platform →TPRM vs. vendor risk management vs. vendor management: what is the difference?
These three terms are used interchangeably in practice. They are not the same thing.
| Feature | TPRM | Vendor Risk Management (VRM) | Vendor Management |
|---|---|---|---|
| Scope | All third parties: vendors, contractors, advisors, technology providers, JV partners, staffing agencies | Vendors and suppliers primarily | Vendors and suppliers only |
| Primary focus | Risk identification, assessment and mitigation across all risk domains | Cybersecurity and operational risk | Commercial performance, contracts, SLAs |
| Who owns it | Risk, Compliance or a dedicated third-party risk function | Procurement, IT Security or Compliance | Procurement or Operations |
| Regulatory driver | OCC 2023-17, NIST SP 800-161, FCA SYSC 8, DORA, GDPR Art. 28 | NIST CSF, ISO 27001, SOC 2 | Contract law, procurement policy |
| Assessment depth | Full risk-based due diligence: cyber, financial, regulatory, ESG, reputational, adverse media, fourth-party | Cybersecurity questionnaires, security ratings | Commercial performance metrics |
| Ongoing monitoring | Continuous, automated, risk-tiered | Periodic reassessment (typically annual) | Periodic contract review |
| Key output | Risk-tiered vendor register, board-level risk reporting, regulatory evidence pack | Risk scores, remediation plans | Vendor scorecards, contract register |
The practical distinction: vendor management asks “is this supplier delivering what we paid for?” Vendor risk management asks “is this supplier creating cybersecurity or operational risk?” TPRM asks both, plus: is this supplier creating regulatory risk, financial crime exposure, or reputational risk through adverse media or PEP connections? What risk flows from their sub-contractors? For regulated financial institutions, TPRM is a second-line risk function with direct regulatory accountability, not a procurement discipline.
Related: Full TPRM framework guide | Vendor risk assessment template
The 7 key third-party risk categories
A complete TPRM programme covers all 7 risk categories. Standard questionnaire-based programmes typically cover only cybersecurity and operational risk — leaving exposure in financial crime, ESG and reputational risk, the areas regulators now scrutinise most closely.
1. Cybersecurity and data risk
Vendor access points, API integrations, shared credentials and SaaS platform vulnerabilities create direct cybersecurity exposure. Key criteria: SOC 2 Type II, ISO 27001, penetration test results, breach history. Regulatory reference: NIST SP 800-161 | DORA Art. 28–30. The 2023 MOVEit vulnerability exposed data at over 2,700 organisations through a single file-transfer vendor — despite those organisations’ own controls being sound.
2. Financial stability and concentration risk
Vendor insolvency, over-dependence on a single supplier, and inadequate capital reserves create disruption risk. Key criteria: audited financial statements, credit ratings, client concentration, geographic concentration. Regulatory reference: OCC Bulletin 2023-17 | DORA Article 29.
3. Compliance and regulatory risk
A vendor’s own non-compliance — with GDPR, AML rules, sanctions requirements or sector-specific obligations — creates direct regulatory exposure for your organisation. Key criteria: regulatory status, data processing agreements, sanctions screening procedures, record of regulatory actions. Regulatory reference: GDPR Art. 28 | FCA SYSC 8.
4. Operational resilience risk
Service disruption, SLA failures, key-person dependency and single points of failure create resilience risk. Key criteria: business continuity plan, disaster recovery test results, SLA breach history, geographic redundancy. Regulatory reference: DORA Chapter III | FCA CP22/20.
5. Reputational and adverse media risk
Vendor misconduct, sanctions connections, corruption allegations and negative media coverage attach to your organisation by association. Standard database checks cover structured sanctions lists but miss newly emerging allegations, social-media red flags and foreign-language adverse media — the gap that intelligence-led OSINT screening fills. See how Neotas screens vendors →
6. ESG, ethics and financial crime risk
Modern slavery in vendor supply chains, environmental violations, and anti-bribery failures create regulatory and commercial exposure. Regulatory reference: UK Modern Slavery Act 2015 | US FCPA | EU CSDDD. ESG due diligence services →
7. Fourth-party and Nth-tier supply chain risk
Your vendors have their own vendors. Fourth-party risk is the exposure that flows through your direct suppliers to their sub-contractors and cloud infrastructure providers. Most existing vendor contracts do not even require sub-contractor disclosure. Supply chain risk management services →
The TPRM lifecycle: 7 stages (and the 5-phase shorthand)
A complete TPRM programme follows a structured lifecycle across every relationship. Neotas documents 7 stages; a commonly cited condensed model groups the same work into 5 phases — identification, due diligence, contracting, monitoring and offboarding. Both describe the same process at different levels of granularity. For the full methodology, see the Neotas TPRM lifecycle guide.
Stage 1: Third-party identification and inventory
Map every external party that accesses your data, systems or processes. Most organisations running their first inventory find 30–50% more active relationships than their procurement records show.
Stage 2: Risk tiering and classification
Assign every third party to a risk tier based on data access, operational criticality, regulatory sensitivity and financial dependency. Most regulated programmes use 3 or 4 tiers.
Stage 3: Due diligence and assessment
Depth matches the tier. Tier 1 vendors receive comprehensive assessment across financial health, cybersecurity, compliance, reputational screening and ESG. The most common failure here is relying entirely on vendor-completed questionnaires — self-reported data misses what a vendor will not or cannot disclose. Enhanced due diligence services → | TPRM questionnaire template →
Stage 4: Contract and commercial controls
Contracts must cover data protection terms, audit rights, incident notification, business continuity requirements and exit conditions. DORA specifies mandatory contractual provisions for ICT service providers under Article 30; US contracts should mirror the same standard even where DORA does not directly apply.
Stage 5: Ongoing monitoring
Vendors suffer breaches, face sanctions exposure and change ownership after onboarding. Continuous monitoring covers adverse media, sanctions and PEP list changes, and financial health signals. Critical vendors typically need monthly or real-time monitoring. See how Neotas runs continuous monitoring →
Stage 6: Issue management and remediation
When an alert fires, the programme needs defined escalation paths and board-level reporting. Poor issue management is where most regulatory enforcement actions in this space originate.
Stage 7: Offboarding and termination
Data return or certified destruction, access revocation, and formal written confirmation the relationship is closed. Poorly managed offboarding leaves residual data and access risk that persists for years.
Running the lifecycle on spreadsheets?
See how the Neotas platform automates risk tiering, due diligence tracking and continuous monitoring across all 7 stages in one workflow.
Explore the TPRM solution →TPRM regulatory requirements: US, UK and EU
No single questionnaire or platform satisfies every regulatory regime at once. A US firm with UK or EU operations typically needs to satisfy OCC guidance, GLBA, DORA and GDPR across the same vendor population.
| Regulation | Where it applies | In force | Core TPRM obligation |
|---|---|---|---|
| OCC Bulletin 2023-17 | US national banks | 2023 | Lifecycle-based third-party risk programme, risk-tiered due diligence, board oversight |
| NIST SP 800-161 Rev.1 | US federal agencies and contractors | 2022 | Cyber Supply Chain Risk Management programme |
| GLBA Safeguards Rule | US financial institutions | 2023 (amended) | Written information security programme covering service provider oversight |
| NYDFS 23 NYCRR 500 | NY-regulated financial entities | 2017, amended 2023 | Third-party service provider security policy, annual certification |
| DORA | EU financial services | Jan 2025 | ICT third-party risk programme, Art. 30 contractual requirements, concentration risk reporting |
| FCA SYSC 8 | UK regulated firms | Ongoing | Outsourcing governance, operational resilience, senior manager accountability |
| EBA Outsourcing Guidelines | EU banks and investment firms | 2019/2023 | Outsourcing register, contractual requirements, supervisory notification |
| GDPR / UK GDPR Art. 28 | EU and UK | 2018 | Mandatory data processing agreement with all vendors processing personal data |
| UK Modern Slavery Act | UK, £36m+ turnover | 2015 | Annual supply chain transparency statement; active third-party due diligence |
| US FCPA | US-listed companies, extraterritorial | Active | Third-party due diligence for any agent acting on behalf of a US issuer |
| EU CSDDD | EU, phased | From 2027 | Human rights and environmental due diligence across supply chains |
Related: TPRM framework | TPRM policy guide
How to build a TPRM programme in 2026
Eight steps. The order matters — most firms fail by buying software before they have a risk-tiering model.
- Define scope and governance: establish ownership (Risk or Compliance), define what counts as a third party, get board sign-off.
- Build the third-party inventory: combine procurement records, accounts-payable data and IT access logs.
- Design the risk-tiering model: score inherent risk by data sensitivity, operational criticality, regulatory exposure and financial dependency — not vendor category alone.
- Design due diligence by tier: Tier 1 gets full intelligence-led assessment; Tier 3–4 may need only a questionnaire. See enhanced due diligence.
- Select tools and technology: manual-only programmes typically fail regulatory review at scale.
- Establish contractual standards: embed audit rights, incident notification timelines and exit obligations; review legacy contracts at next renewal.
- Implement continuous monitoring: automate adverse media and sanctions alerts for Tier 1 and 2 before the first alert fires.
- Define governance and reporting: board-level TPRM reporting, KRI dashboard, outsourcing register. Document the programme in a TPRM policy.
TPRM maturity model
Most regulated firms sit at Level 2 or 3. OCC and FCA guidance effectively require Level 4.
| Level | Name | What it looks like | What’s missing |
|---|---|---|---|
| 1 | Ad hoc | No formal programme, reactive vendor management | Inventory, risk tiering, documentation |
| 2 | Developing | Questionnaire-based, partial inventory, limited monitoring | Independent screening, board reporting |
| 3 | Defined | Full inventory, documented risk tiering, periodic reassessment | Automation, fourth-party visibility |
| 4 | Managed | Automated monitoring, integrated risk reporting, regulator-aligned documentation | Intelligence-led screening |
| 5 | Optimised | OSINT-enhanced screening, fourth-party visibility, continuous improvement | – |
TPRM best practices
| Best practice | What it means in practice |
|---|---|
| Tier by inherent risk, not vendor category | A low-spend SaaS provider with access to regulated data is higher risk than a high-spend supplier with none. |
| Do not rely on questionnaires alone | Independent adverse media screening and financial checks catch what self-reported data misses. |
| Build monitoring before you need it | Most incidents happen between annual review cycles, not at onboarding. |
| Embed TPRM in procurement, not after it | Risk assessment running parallel to negotiation gives you leverage; assessment after signature gives you none. |
| Map fourth-party exposure | Undocumented sub-contractors are a concentration-risk blind spot. |
| Document the evidence trail | Due diligence reports and escalation records are what supervisors examine in an exam or visit. |
Common TPRM mistakes
- Tiering by contract value, not risk. A low-spend SaaS vendor with access to regulated data is higher risk than a high-spend supplier with none.
- Treating the questionnaire as the assessment. Self-reported data misses what a vendor will not or cannot disclose — it is a starting point, not a control.
- No monitoring between annual reviews. Most vendor-linked incidents happen in the gap between scheduled reassessments.
- No fourth-party visibility. Most contracts do not require sub-contractor disclosure, leaving concentration risk invisible until an incident traces back to it.
- Buying the platform before the risk-tiering model. Technology automates a bad process just as fast as a good one — sequence matters.
TPRM solutions: what to look for in a platform
Standard TPRM software runs structured database checks: sanctions lists, PEP databases, credit reports, cybersecurity ratings. These are necessary. They are not sufficient — they miss adverse media in emerging sources, financial crime indicators that have not yet reached a structured database, and fourth-party relationships that never appear in procurement records.
The Neotas Third-Party Risk Management platform combines configurable, no-code lifecycle automation — onboarding, questionnaires, dynamic risk assessment, screening and continuous monitoring — with OSINT-enhanced screening across 200+ languages, built for organisations replacing manual, spreadsheet-based programmes.
| Capability | What it covers |
|---|---|
| Intelligence-led vendor due diligence | Tier 1/2 assessments across all 7 risk categories with OSINT screening |
| Adverse media and reputational screening | 200+ languages, traditional, social and emerging sources |
| Financial crime compliance integration | AML, KYC and sanctions screening embedded in TPRM due diligence |
| ESG and ethics due diligence | Modern slavery, ABAC, environmental violations |
| Configurable, no-code lifecycle automation | Onboarding, questionnaires, workflow and approvals without engineering resource |
| Continuous monitoring | Adverse media and sanctions alerts with escalation support |
See the full TPRM platform
Onboarding, questionnaires, risk assessment, screening and continuous monitoring — in one configurable, audit-ready platform.
Visit the Neotas TPRM solution page →TPRM in practice: case studies
Third-party risk found through open-source intelligence
OSINT screening surfaced adverse media and undisclosed corporate connections invisible to structured data sources.
Read the case study →Supply chain risk identified before contract signature
OSINT screening discovered hidden operational and reputational risk before a high-value contract was signed.
Read the case study →PEP screening reveals undisclosed political connections
Standard PEP database checks returned clean; intelligence analysis identified undisclosed political links.
Read the case study →Network analysis uncovers international credit risk links
Standard financial checks returned clean; network analysis mapped undisclosed corporate relationships creating credit risk.
Read the case study →FAQs on TPRM
What is TPRM and what does it stand for?
TPRM stands for Third-Party Risk Management. It is the process organisations use to identify, assess and manage the risks that come from working with external vendors, suppliers, contractors and service providers — the structured discipline that sits between your organisation and everyone outside it who touches your data, systems or operations.
What is the TPRM process?
The TPRM process runs in seven stages: identify all third parties, tier them by inherent risk, conduct due diligence, embed controls in contracts, monitor continuously, manage issues when they arise, and formally offboard vendors when relationships end. It is a continuous cycle, not a one-time assessment. See the full TPRM lifecycle guide.
What is a TPRM system?
A TPRM system is the software or platform used to run a third-party risk programme — vendor inventory, risk tiering, questionnaire distribution, due diligence tracking, monitoring alerts and board reporting in one place. It is the tooling layer, not the programme itself; a TPRM system supports the process defined in a TPRM framework but does not replace it. See the Neotas TPRM system →
What is TPRM in KPMG?
KPMG, like other major advisory firms, defines TPRM as the structured discipline of identifying, assessing and mitigating risk from third-party relationships, and publishes benchmark surveys and maturity assessments on the topic. KPMG’s usage aligns with the industry-standard definition used across OCC, NIST and FCA guidance: TPRM covers the full relationship lifecycle, not just onboarding due diligence.
What are the 5 phases of the TPRM lifecycle?
A commonly cited condensed model groups TPRM into 5 phases: risk identification and vendor inventory, due diligence and risk assessment, contracting and onboarding, ongoing monitoring, and offboarding. Neotas documents a more granular 7-stage model that separates risk tiering from identification and adds issue management as a distinct stage — see the full 7-stage lifecycle for the version regulators expect to see documented.
What is the difference between ERM and TPRM?
ERM (Enterprise Risk Management) is the umbrella framework covering all risk types across an organisation — strategic, operational, financial, credit and third-party risk. TPRM is a specialised subset of ERM focused specifically on risk introduced by external vendors, suppliers and contractors. A mature ERM programme incorporates TPRM outputs into its enterprise risk register rather than treating third-party risk as separate or siloed.
What is the difference between TPRM and vendor risk management?
TPRM covers all external relationships: vendors, contractors, advisors, JV partners, staffing agencies. Vendor Risk Management (VRM) covers vendors only, typically focused on cybersecurity and operational risk. TPRM adds financial crime, ESG, reputational and fourth-party risk. For OCC, FCA and DORA compliance, TPRM is the correct framework — VRM alone will not satisfy those obligations.
What is a TPRM framework?
A TPRM framework is the structured set of policies, processes and controls an organisation uses to manage third-party risk consistently. It defines how vendors get inventoried, tiered, assessed, contracted and monitored. A good framework aligns with OCC 2023-17, NIST SP 800-161 and FCA SYSC 8 requirements and produces the documented evidence trail regulators expect. See the Neotas TPRM framework guide.
What regulations require third-party risk management?
In the US: OCC Bulletin 2023-17 for national banks, NIST SP 800-161 for federal agencies and contractors, GLBA for financial institutions, and NYDFS 23 NYCRR 500 for New York-regulated entities. In the EU: DORA for financial services. In the UK: FCA SYSC 8. GDPR Article 28 applies to any organisation handling EU or UK personal data. Non-compliance carries financial penalties and, in some regimes, personal senior-manager liability.
What is third-party risk monitoring?
Third-party risk monitoring is the ongoing surveillance of active vendor relationships after onboarding — adverse media alerts, sanctions and PEP list changes, financial health signals and regulatory action notices. Critical vendors typically require continuous or monthly monitoring; lower-risk vendors, quarterly or annual review. Most TPRM programme failures happen between annual review cycles, not at onboarding.
What is a TPRM questionnaire?
A TPRM questionnaire is a structured set of questions sent to vendors to collect information on their security controls, financial health, compliance status and data handling practices. It is a core due diligence tool with one major limitation: it is entirely self-reported. Independent screening is what catches the gaps a questionnaire cannot. See the TPRM questionnaire guide.
What is TPRM software and what does it do?
TPRM software manages the processes inside a third-party risk programme: vendor inventory, risk tiering, questionnaire distribution, due diligence tracking, monitoring alerts and board reporting. Options range from standalone TPRM platforms to GRC modules to specialist intelligence-led screening tools. Manual-only approaches typically fail regulatory review at scale. See the Neotas TPRM platform →
What is fourth-party risk in TPRM?
Fourth-party risk is the exposure that flows through your direct vendors to their own sub-contractors and technology providers. Your contract is with the vendor, but the risk can sit two levels down — a cloud provider using a sanctions-linked data centre is a real example. Most TPRM programmes currently have no visibility here at all.
What is a TPRM maturity model?
A TPRM maturity model is a five-level scale describing how sophisticated a third-party risk programme is, from Level 1 (no formal programme) to Level 5 (intelligence-led, continuous monitoring, fourth-party visibility). Most regulated firms sit at Level 2 or 3; OCC and FCA guidance effectively require Level 4 as a practical minimum.
Why is third-party risk management important?
61% of data breaches involve a third party (IBM Cost of a Data Breach Report 2024). 60% of global AML fines in 2023 were linked to third-party control failures. For regulated firms, TPRM is a legal obligation with direct financial penalties. For any organisation, vendor relationships are the most common source of data breaches, compliance failures and operational disruption, and the least visible.
What is TPRM in financial services?
In US financial services, TPRM is a binding supervisory expectation: OCC Bulletin 2023-17 requires a lifecycle-based programme for national banks, and GLBA requires a written information security programme covering service providers. In the UK and EU, FCA SYSC 8 and DORA impose equivalent, and in places more prescriptive, obligations. Financial crime screening — adverse media, sanctions, PEP checks — is embedded in due diligence for higher-risk vendor relationships.
Related reading
What is TPRM? Definition and meaning
Navigating Third-Party Risk Management in the United States
TPRM – Third-Party Risk Management is the structured process an organisation uses to identify, assess, monitor and manage the risks created by working with external parties, including vendors, suppliers, contractors, consultants, technology providers and outsourced service functions.
A complete TPRM programme runs across the full vendor relationship lifecycle: from pre-onboarding due diligence through continuous in-life monitoring to formal offboarding. It covers cybersecurity risk, financial stability, regulatory compliance, reputational exposure, ESG obligations and fourth-party (sub-vendor) risks simultaneously.
TPRM is most commonly used in regulated industries – financial services, insurance, healthcare, critical infrastructure and professional services where regulators including the FCA, OCC, EBA and DORA impose explicit, legally binding obligations to manage third-party risk.
Third-Party Risk Management is also known as ‘vendor risk management’, ‘supply chain risk management’, or ‘supplier risk management’, stands as a vital subset within the broader domain of risk management.TPRM (Third-Party Risk Management) is the process an organisation uses to identify, assess and control the risks arising from external vendors, suppliers, contractors and service providers across the full relationship lifecycle, from due diligence through continuous monitoring to offboarding.Related: What is supply chain risk management? | Enhanced due diligence explained | Third-party risk management framework
IN THIS GUIDE
What does TPRM stand for?
TPRM stands for Third-Party Risk Management.
Breaking down the term:
- Third-Party: Any external organisation or individual providing goods, services, data access or operational capability to your organisation. This includes direct vendors, software-as-a-service providers, outsourced operational functions, joint venture partners, professional advisors, cloud infrastructure providers and staffing agencies.
- Risk Management: The structured discipline of identifying, evaluating, treating and monitoring risks – before a relationship starts, during the engagement and after it ends.
The term appears in several forms across regulatory guidance and industry usage:
| Term | Meaning |
|---|---|
| TPRM | Third-Party Risk Management |
| VRM | Vendor Risk Management (narrower scope) |
| TPVRM | Third-Party Vendor Risk Management |
| 3rd party risk management | Informal variant of TPRM |
| Supplier risk management | Procurement-led variant, typically supply chain focused |
| Third-party due diligence | The assessment component of TPRM |
Related: TPRM vs Vendor Risk Management: Full comparison | What is a Vendor Risk Assessment? | TPRM Questionnaire Guide
Why TPRM matters in 2026
Third parties are now the primary attack surface for data breaches, financial crime and regulatory failure.
61% of data breaches now involve a third party. (IBM Cost of a Data Breach Report 2024) This is not a new trend – it has been rising consistently since 2020 as organisations outsource more critical functions and expand their vendor ecosystems.
60% of global AML fines in 2023 were linked to failures in third-party screening and vendor oversight. Regulators are no longer accepting “we didn’t know” as a defence for vendor-linked compliance failures.
The regulatory environment tightened sharply in 2025. DORA – the Digital Operational Resilience Act came into full force across EU financial services in January 2025 (European Banking Authority), creating binding requirements for ICT third-party risk management, mandatory incident reporting and formal concentration risk controls. The OCC’s Third-Party Relationships Interagency Guidance (OCC Bulletin 2023-17) updated the US framework in the same period, with the FCA’s operational resilience rules (FCA PS21/3) embedding parallel requirements in the UK.
TPRM programme gaps carry real financial consequences. In 2024, the FCA issued fines totalling £57.4m related to inadequate third-party and outsourcing controls. (FCA Annual Report 2023/24) Individual senior managers face personal liability under the Senior Managers and Certification Regime (SMCR) for TPRM failures in their area of responsibility.
The ICP reality check: Most UK and EU regulated firms are still operating TPRM programmes built for a 2015 regulatory environment. DORA alone requires significant programme redesign for the majority of financial institutions particularly around ICT concentration risk, contractual requirements and fourth-party visibility.
Related: How to build a TPRM programme: 8-step guide
Is your TPRM programme DORA-ready? Neotas has helped regulated firms across the UK and EU assess and redesign their third-party risk programmes for DORA compliance. Request a DORA readiness review → Read our Guide on DORA Compliance for Third-Party Risk Management: What Financial Services Firms Must Do in 2026→
TPRM vs. Vendor Risk Management vs. Vendor Management: what’s the difference?
These three terms are frequently used interchangeably. They are not the same thing.
| Feature | TPRM | Vendor Risk Management (VRM) | Vendor Management |
|---|---|---|---|
| Scope | All third parties: vendors, contractors, advisors, technology providers, JV partners, staffing agencies | Vendors and suppliers primarily | Vendors and suppliers only |
| Primary focus | Risk identification, assessment and mitigation across all risk domains | Cybersecurity and operational risk focus | Commercial performance, contracts, SLAs |
| Who owns it | Risk, Compliance or a dedicated Third-Party Risk function | Procurement, IT Security or Compliance | Procurement or Operations |
| Regulatory driver | FCA SYSC 8, DORA, OCC 2023-17, NIST SP 800-161, GDPR Art. 28 | NIST CSF, ISO 27001, SOC 2 | Contract law, procurement policy |
| Assessment depth | Full risk-based due diligence: cyber, financial, regulatory, ESG, reputational, adverse media, fourth-party | Cybersecurity questionnaires, security ratings | Commercial performance metrics |
| Ongoing monitoring | Continuous, automated, risk-tiered | Periodic reassessment (typically annual) | Periodic contract review |
| Financial crime lens | Yes – sanctions, adverse media, PEP screening for high-risk vendors | Rarely | No |
| ESG obligations | Yes – modern slavery, ABAC, CSDDD | Rarely | Rarely |
| Key output | Risk-tiered vendor register, board-level risk reporting, regulatory evidence pack | Risk scores, remediation plans | Vendor scorecards, contract register |
The practical distinction:
Vendor Management asks: “Is this supplier delivering what we paid for?”
Vendor Risk Management asks: “Is this supplier creating cybersecurity or operational risk?”
TPRM asks both of those questions, plus: Is this supplier creating regulatory risk? Financial crime exposure? Reputational risk through adverse media or PEP connections? ESG obligations through modern slavery or corruption links? What risks flow from their sub-contractors?
For regulated financial institutions, TPRM is not a procurement discipline – it is a second-line risk function with direct regulatory accountability.
What about TPRM vs GRC?
GRC (Governance, Risk and Compliance) is an enterprise-wide framework covering all risk types. TPRM sits within GRC specifically as the component that manages external relationship risk. A GRC platform may house your TPRM programme data, but it is not a substitute for a purpose-built TPRM process.
Related: Full TPRM framework guide | Vendor risk assessment template
What is Third-Party Vendor Risk Management (TPVRM)?
Third-Party Vendor Risk Management (TPVRM) is the application of TPRM disciplines specifically to vendor and supplier relationships. It covers the same lifecycle – identification, risk tiering, due diligence, contract controls, monitoring and offboarding, scoped to organisations that provide goods, services or technology under a commercial contract.
In most regulated firm contexts, TPVRM and TPRM are used interchangeably. Where a distinction is drawn: TPVRM is the vendor management function’s risk responsibilities (procurement-led, commercially focused). TPRM is the second-line risk function’s oversight of all external relationships, including non-vendor third parties such as advisors, JV partners and staffing agencies.
The 7 steps in an effective TPVRM programme:
- Vendor identification and classification: Full inventory of all vendors, categorised by service type, data access, operational criticality and regulatory sensitivity.
- Risk assessment: Score each vendor’s inherent risk using consistent criteria. Use questionnaires, audits and independent screening to gather evidence.
- Due diligence: Pre-onboarding assessment covering financial health, cybersecurity posture, compliance track record, adverse media and beneficial ownership. Depth matches the risk tier. See enhanced due diligence services at Neotas.
- Contract management: Contracts must cover performance expectations, security obligations, audit rights, data protection terms (GDPR Art.28) and exit conditions. DORA adds binding ICT contractual requirements on top. (EBA DORA Art.30)
- Continuous monitoring: Ongoing oversight of vendor performance, financial health, regulatory status and adverse media. Automated for critical vendors, periodic for lower-risk relationships. See TPRM lifecycle guide.
- Incident response: Defined protocols for vendor-linked incidents: data breaches, service failures, sanctions exposure. Response plans must exist before an incident, not get drafted during one.
- Offboarding: Data return or certified destruction, access revocation, contractual closeout. All confirmed in writing and documented.
For the full implementation methodology, see the Neotas TPRM framework guide and TPRM policy template.
Need to upgrade a vendor risk programme that’s still questionnaire-only? Neotas provides vendor due diligence and ongoing monitoring combining OSINT screening, adverse media, financial crime checks and ESG assessment in one workflow. See how it works
The 7 key third-party risk categories
A complete TPRM programme must cover all 7 risk categories. Standard questionnaire-based programmes typically cover only cybersecurity and operational risk. That leaves significant exposure in financial crime, ESG and reputational risk domains, precisely the areas regulators are now scrutinising most closely.
1. Cybersecurity and data risk
Vendor access points, API integrations, shared credentials, data processing agreements and SaaS platform vulnerabilities all create direct cybersecurity exposure. A vendor breach can expose your customer data and systems even when your own controls are sound.
Key assessment criteria: SOC 2 Type II certification, ISO 27001 certification, penetration test results (within 12 months), data breach history, incident response procedures, data residency.
Regulatory reference: DORA Articles 28-30 (EBA) | NIST SP 800-161 (NIST) | FCA PS7/23
Real example: The MOVEit vulnerability in 2023 exposed data at over 2,700 organisations globally through a single file-transfer vendor – despite those organisations having their own robust internal security controls. (Progress Software / Cl0p ransomware incident, CISA)
Related: Third-party cyber risk assessment services at Neotas
2. Financial stability and concentration risk
Vendor insolvency, financial instability, over-dependence on a single supplier for a critical function and inadequate capital reserves all create operational disruption risk. Concentration risk where too many critical processes depend on one vendor is explicitly flagged by DORA as a systemic risk requiring active monitoring and formal controls.
Key assessment criteria: Audited financial statements (2-3 years), credit ratings, liquidity position, client concentration (what % of their revenue is your contract), geographic concentration of operations.
Regulatory reference: DORA Article 29 (concentration risk) (EBA) | OCC Bulletin 2023-17 (OCC)
Related: Financial crime compliance services | Supply chain risk management
3. Compliance and regulatory risk
Vendors that handle regulated data, operate in regulated jurisdictions or provide services covered by sector-specific rules must themselves comply with GDPR, DORA, FCA rules, AML regulations, sanctions requirements and sector-specific obligations. A vendor non-compliance event creates direct regulatory exposure for your organisation including personal liability for your Senior Managers even without your direct involvement.
Key assessment criteria: Regulatory status and licences, GDPR Article 28 Data Processing Agreement, AML programme, sanctions screening procedures, record of regulatory actions or fines.
Regulatory reference: GDPR Article 28 (ICO) | DORA Article 30 (EBA) | FCA SYSC 8 (FCA)
4. Operational resilience risk
Service disruption, SLA failures, key-person dependency, single points of failure and geographic concentration of operations (for example, critical services hosted in a single data centre region) all create operational resilience risk. DORA requires regulated firms to formally map, test and document their exposure to third-party operational failure including business continuity and disaster recovery capabilities at the vendor level.
Key assessment criteria: Business continuity plan, disaster recovery procedures and test results, SLA definitions and breach history, geographic redundancy, key-person dependency assessment.
Regulatory reference: DORA Chapter III (EBA) | FCA CP22/20 (FCA)
5. Reputational and adverse media risk
Vendor misconduct, political exposure (PEPs and their associates), sanctions connections, corruption allegations, data privacy violations and negative media coverage all create reputational risk that can attach to your organisation by association. Adverse media screening across traditional press, social media and emerging sources is a regulatory requirement for higher-risk vendor relationships in financial services.
Standard database checks miss most of this. They cover structured sanctions lists and known adverse records but they cannot surface newly emerging allegations, social media red flags, foreign-language adverse media or politically motivated exposure. This is the gap that intelligence-led OSINT screening fills.
Key assessment criteria: Adverse media screening (traditional + social + dark web), PEP and sanctions screening, beneficial ownership verification, media sentiment analysis, reputational risk classification.
Neotas capability: Neotas’s OSINT-enhanced adverse media screening covers 200+ languages, social media platforms, open-web sources and structured databases simultaneously surfaces risks that no single database check or questionnaire reveals. See how Neotas screens vendors →
6. ESG, ethics and financial crime risk
Modern slavery and forced labour in vendor operations or supply chains, environmental violations, anti-bribery and corruption (ABAC) failures, and human rights abuses now create both regulatory and commercial exposure. The UK Modern Slavery Act 2015, the EU Corporate Sustainability Due Diligence Directive (CSDDD) (European Commission), the US Foreign Corrupt Practices Act (DOJ) and the UK Bribery Act 2010, all require evidence of active ESG due diligence across third-party relationships.
Key assessment criteria: Modern slavery statement, ABAC policy and training evidence, environmental certifications, labour practice documentation, FCPA/Bribery Act compliance procedures, beneficial ownership transparency.
Related: ESG due diligence services at Neotas | Financial crime compliance
Running a regulated procurement process? Neotas provides ESG and financial crime due diligence reports on third-party suppliers that satisfy CSDDD, UK Modern Slavery Act and ABAC requirements. Request an ESG vendor screening →
7. Fourth-party and Nth-tier supply chain risk
Your vendors have their own vendors. Fourth-party risk is the exposure that flows through your direct suppliers to their sub-contractors, cloud infrastructure providers, data processors and technology partners. Most TPRM programmes have almost no visibility here.
DORA explicitly requires regulated firms to understand and manage ICT supply chain concentration risk at the fourth-party level (EBA DORA RTS), including identification of critical sub-contractors and assessment of cascading failure scenarios. This is new territory for most firms, the majority of existing vendor contracts do not even require sub-contractor disclosure.
Key assessment criteria: Sub-contractor disclosure requirements in contracts, mapping of critical fourth-party relationships, cloud infrastructure concentration (AWS/Azure/GCP dependency), ICT supply chain risk assessment.
Related: Supply chain risk management services
Want a full third-party risk assessment across all 7 categories? Neotas runs intelligence-led vendor assessments that cover cybersecurity, financial, regulatory, reputational, ESG and fourth-party risks in a single integrated report. See a sample vendor risk report →
The TPRM lifecycle: 7 stages
A complete TPRM programme follows a structured lifecycle across every third-party relationship. Below is a summary of each stage. For the full methodology, see the Neotas TPRM lifecycle guide.
Stage 1: Third-party identification and inventory
Map every external party that accesses your data, systems, or processes. Without a complete inventory, you cannot risk-tier or monitor what you have not found. Most organisations running their first inventory discover they have 30-50% more active third-party relationships than documented in their procurement records.
Include direct vendors, sub-contractors with system access, cloud service providers, professional advisors with data access and any third party that could affect your operational resilience.
Stage 2: Risk tiering and classification
Assign every third party to a risk tier based on their inherent risk to your organisation. A critical SaaS provider processing personal financial data is categorically different from a stationery supplier.
Risk tiering uses inherent risk factors: type of data accessed, criticality to operations, regulatory sensitivity of services, jurisdictional exposure and financial dependency. Most regulated programmes use 3 or 4 tiers. Higher tiers receive more intensive due diligence and more frequent ongoing monitoring.
Related: TPRM risk tiering methodology
Stage 3: Due diligence and assessment
Due diligence depth matches the risk tier. Tier 1 (critical) vendors receive comprehensive assessment covering financial health, cybersecurity posture, regulatory compliance, reputational screening, adverse media, beneficial ownership and ESG obligations. Tier 3 (low risk) vendors may need only a self-certification questionnaire.
The most common programme failure at this stage is relying entirely on vendor-completed questionnaires. Self-reported information misses the risks vendors will not or cannot disclose. Independent intelligence-led screening is the control that catches what questionnaires miss.
Related: Enhanced due diligence services | TPRM questionnaire template | Vendor risk assessment template
Upgrade from questionnaire-only to intelligence-led: Neotas runs independent vendor due diligence that combines structured assessment with OSINT screening, adverse media analysis and financial crime checks. See how it works →
Stage 4: Contract and commercial controls
TPRM obligations must be embedded in vendor contracts. Contracts should cover: data protection terms (GDPR Article 28 compliant), audit rights, incident notification obligations, business continuity requirements, sub-contractor disclosure requirements, and exit and termination rights.
DORA specifies mandatory contractual requirements for all ICT third-party service providers to regulated financial entities including minimum provisions on service descriptions, data locations, audit cooperation and exit assistance. (DORA Article 30) Existing vendor contracts that predate DORA need reviewing and updating before the next renewal.
Stage 5: Ongoing monitoring
Third-party risk does not stop at onboarding. Circumstances change: vendors suffer data breaches, face sanctions exposure, enter financial distress, receive regulatory fines, acquire new sub-contractors or change beneficial ownership. All of these change the risk profile of an existing relationship.
Continuous monitoring covers: adverse media alerts, sanctions and PEP list changes, financial health indicators, regulatory action notices and changes to fourth-party relationships. Monitoring frequency is risk-tiered critical vendors typically require monthly or real-time monitoring, lower-risk vendors quarterly or annual review.
Related: Third-party risk monitoring services at Neotas
Stage 6: Issue management and remediation
When a monitoring alert fires, the programme must have defined escalation paths, remediation timelines and board-level reporting obligations. Regulators examine issue management records closely during supervision a good issue management trail demonstrates a functioning programme. Poor issue management is where most regulatory enforcement actions in this space originate.
Stage 7: Offboarding and termination
When a vendor relationship ends, offboarding must ensure: data return or certified destruction, access revocation confirmed and documented, final financial settlement, contractual obligations discharged and formal written confirmation the relationship is closed. Poorly managed offboarding leaves residual data and access risks that persist years after the relationship has ended.
Related: Full TPRM lifecycle guide | TPRM questionnaire | Enhanced due diligence
TPRM regulatory requirements
No questionnaire or platform satisfies all of these simultaneously. A UK financial institution operating in the EU typically needs to satisfy FCA SYSC 8, DORA, GDPR, the Modern Slavery Act and the Bribery Act across the same vendor population.
| Regulation | Where it applies | In force | Core TPRM obligation |
|---|---|---|---|
| DORA (EBA) | EU financial services | Jan 2025 | ICT third-party risk programme, Art.30 contractual requirements, concentration risk reporting, ICT contract register |
| FCA SYSC 8 (FCA) | UK regulated firms | Ongoing | Outsourcing governance, operational resilience, senior manager accountability |
| OCC Bulletin 2023-17 (OCC) | US national banks | 2023 | Lifecycle-based third-party risk programme, risk-tiered due diligence, board oversight |
| NIST SP 800-161 Rev.1 (NIST) | US federal + private sector | 2022 | Cyber Supply Chain Risk Management programme |
| EBA Outsourcing Guidelines (EBA) | EU banks and investment firms | 2019/2023 | Outsourcing register, contractual requirements, supervisory notification for material outsourcing |
| GDPR / UK GDPR Art.28 (ICO) | EU and UK | 2018 | Mandatory DPA with all vendors processing personal data |
| UK Modern Slavery Act | UK, £36m+ turnover | 2015 | Annual supply chain transparency statement; active third-party due diligence |
| UK Bribery Act | UK | 2010 | Adequate procedures defence requires third-party ABAC due diligence |
| US FCPA (DOJ) | US-listed companies, extraterritorial | Active | Third-party due diligence for any agent acting on behalf of a US issuer |
| EU CSDDD (European Commission) | EU, phased | From 2027 | Human rights and environmental due diligence across supply chains |
Related: TPRM framework | TPRM policy guide
Operating across multiple regulatory jurisdictions? Neotas produces third-party risk assessments that satisfy DORA, FCA and OCC requirements in a single workflow. Speak to a specialist →
DORA and third-party risk management
DORA – the Digital Operational Resilience Act (EU) 2022/2554 is the most significant regulatory development for third-party risk management in a decade. It came into full force across EU financial services in January 2025 and sets binding, enforceable obligations for how regulated firms identify, assess, monitor and contract with ICT third-party service providers.
If your firm is an EU-regulated financial entity, or a UK firm with EU operations, DORA directly governs your TPRM programme.
What DORA requires for third-party risk:
| DORA obligation | Article | What it means in practice |
|---|---|---|
| ICT third-party risk programme | Art. 28 | Formal, documented programme covering all ICT vendors – not optional, not informal |
| Risk-based due diligence | Art. 28 | Pre-contractual and ongoing assessment proportionate to vendor criticality |
| Mandatory contractual provisions | Art. 30 | All ICT contracts must include: service descriptions, data locations, audit rights, incident notification timelines, exit assistance and sub-contractor disclosure |
| Register of ICT contracts | Art. 28 | Maintained and reported to regulators – covers all ICT third-party arrangements |
| Concentration risk monitoring | Art. 29 | Identify and report where critical functions depend on a single provider or geography |
| Critical ICT provider designation | Art. 31 | Regulators can designate providers as “critical” – triggering direct supervisory oversight |
| Incident reporting | Art. 19 | ICT-related incidents caused by or involving third parties must be reported within defined timeframes |
| Sub-contractor visibility | RTS on subcontracting | Map and assess fourth-party ICT sub-contractors for critical services |
Does DORA apply to UK firms?
DORA is EU law. It does not apply directly to UK-regulated firms unless they operate EU branches, serve EU clients through EU-authorised entities or are ICT service providers to EU-regulated firms. The FCA’s operational resilience framework (PS21/3) and SYSC 8 cover equivalent ground for UK firms. (FCA) UK firms with EU operations need to satisfy both.
The three DORA gaps most firms have right now:
- Contractual gaps. Legacy ICT contracts predate DORA’s Article 30 requirements. Audit rights, incident notification timelines, exit assistance and sub-contractor disclosure clauses are frequently absent. Every ICT contract needs reviewing at next renewal.
- The ICT register. DORA requires a maintained register of all ICT third-party arrangements, reported to regulators. Most firms have procurement records – few have a DORA-compliant register with the required data fields.
- Concentration risk visibility. DORA Article 29 requires firms to identify and manage situations where critical functions depend on a single ICT provider or a single geographic region. Most TPRM programmes track individual vendors, not concentration patterns across the portfolio.
Related: TPRM regulatory requirements table | TPRM framework guide | TPRM policy template
Is your TPRM programme DORA-compliant? Neotas runs DORA gap assessments for regulated firms -covering ICT register completeness, contractual compliance, concentration risk mapping and fourth-party sub-contractor visibility.
Request a DORA readiness review →
How to build a TPRM programme in 2026
Eight steps. The order matters – most firms fail by jumping to technology before they have a risk tiering model.
For the full implementation roadmap, see the Neotas TPRM framework guide.
- Define scope and governance: Establish ownership (typically Risk or Compliance), define what counts as a third party, get board sign-off, assign Senior Manager accountability under SMCR.
- Build the third-party inventory: Combine procurement records, AP data and IT access logs. Expect to find more vendors than documented. (Deloitte 2024)
- Design the risk tiering model: Score inherent risk using: data sensitivity, operational criticality, regulatory exposure, jurisdictional risk and financial dependency. Avoid tiering by vendor category alone.
- Design due diligence by tier: Tier 1: full intelligence-led assessment. Tier 2: structured questionnaire plus independent screening. Tier 3: questionnaire. Tier 4: self-certification. See enhanced due diligence and TPRM questionnaire.
- Select tools and technology: Manual-only programmes typically fail regulatory review at scale. Options: standalone TPRM platform, GRC module, specialist screening provider, or a combination. See TPRM software guide.
- Establish contractual standards: Embed GDPR Art.28, audit rights, DORA Art.30 ICT provisions, incident notification timelines and exit obligations. Review legacy contracts at next renewal.
- Implement continuous monitoring: Automate adverse media and sanctions alerts for Tier 1 and 2. Define escalation paths and response timelines before the first alert fires.
- Define governance and reporting: Board-level TPRM reporting, KRI dashboard, outsourcing register (required under EBA Guidelines and DORA). Document the programme in a TPRM policy.
Starting from scratch or upgrading an existing programme? Neotas runs TPRM programme assessments and gap analyses against DORA, FCA and OCC requirements. Request a programme review →
TPRM maturity model
Most regulated firms sit at Level 2 or 3. DORA and FCA guidance effectively require Level 4. The gap is real and closing it before a regulatory visit is significantly cheaper than closing it after.
| Level | Name | What it looks like | What’s missing |
|---|---|---|---|
| 1 | Ad hoc | No formal programme, reactive vendor management | Inventory, risk tiering, documentation |
| 2 | Developing | Questionnaire-based, partial inventory, limited monitoring | Independent screening, board reporting, continuous monitoring |
| 3 | Defined | Full inventory, documented risk tiering, periodic reassessment | Automation, financial crime integration, fourth-party visibility |
| 4 | Managed | Automated monitoring, integrated risk reporting, DORA/FCA-aligned documentation | Intelligence-led screening, programme optimisation |
| 5 | Optimised | OSINT-enhanced screening, fourth-party visibility, financial crime integration, continuous improvement | – |
TPRM best practices
These apply regardless of where your programme sits on the maturity scale.
| Best practice | What it means in practice |
|---|---|
| Tier by inherent risk, not vendor category | A low-spend SaaS provider with access to regulated customer data is higher risk than a high-spend stationery supplier. Tier on data sensitivity, operational criticality and regulatory exposure, not contract value. |
| Don’t rely on questionnaires alone | Self-reported data misses what vendors won’t or can’t disclose. Independent adverse media screening, financial health checks and beneficial ownership verification catch what questionnaires don’t. |
| Build monitoring before you need it | Most incidents happen between annual review cycles. Automate adverse media alerts, sanctions list changes and financial health signals for Tier 1 and 2 vendors now, before an incident forces the conversation. |
| Embed TPRM in procurement, not after it | Risk assessment running parallel to commercial negotiation gives you leverage. Risk assessment after contract signature gives you nothing. See TPRM framework. |
| Map your fourth-party exposure | If you don’t know what cloud providers, data processors and sub-contractors your critical vendors use, you have a concentration risk blind spot. DORA requires you to close it. |
| Document the evidence trail | A well-run programme that isn’t documented fails regulatory review. Due diligence reports, monitoring records and issue escalations are what supervisors examine in an FCA or ECB visit. |
| Assign named accountability | Under FCA SMCR and equivalent regimes, a Senior Manager is personally accountable for TPRM failures. Name them before a regulator asks. See TPRM policy guide. |
| Update contracts at renewal | DORA Article 30 requirements apply to new and renewed ICT contracts. Legacy contracts without audit rights, incident notification timelines and exit obligations need updating at next renewal. |
Related: TPRM framework | TPRM policy template | TPRM software options | TPRM questionnaire guide
Want a gap assessment of your current TPRM practices against DORA, FCA and OCC requirements? Neotas runs programme maturity reviews for regulated firms across the UK and EU. Request a TPRM review
How Neotas delivers intelligence-led TPRM
Standard TPRM platforms run structured database checks: sanctions lists, PEP databases, credit reports, cybersecurity ratings. These are necessary. They’re not sufficient.
They miss adverse media in 200+ languages, emerging financial crime indicators, ESG red flags embedded in supply chains, and fourth-party relationships that never appear in any database.
Neotas addresses this gap by combining OSINT-enhanced screening with analyst-led investigation, rated in the Chartis FCC50 as a leading financial crime compliance technology provider.
| Capability | What it covers |
|---|---|
| Intelligence-led vendor due diligence | Full Tier 1/2 assessments across all 7 risk categories with OSINT screening |
| Adverse media and reputational screening | 200+ languages, traditional + social + emerging sources |
| Financial crime compliance integration | AML, KYC and sanctions screening embedded in TPRM due diligence |
| ESG and ethics due diligence | Modern slavery, ABAC, environmental violations, beneficial ownership |
| DORA readiness assessments | ICT register review, concentration risk mapping, contractual gap analysis |
| Ongoing monitoring | Continuous adverse media and sanctions alerts with escalation support |
Built for regulated financial services, insurance, legal and professional services firms where questionnaire-only programmes no longer satisfy regulatory expectations.
See how Neotas works for your programme. Request a demonstration → View TPRM case studies →
Neotas Due Diligence Platform
TPRM in practice: real cases from Neotas
- Third-party risk found through open-source intelligence A regulated firm needed vendor due diligence beyond standard database checks. Neotas OSINT screening surfaced adverse media, undisclosed corporate connections and reputational red flags invisible to structured data sources. Read the full TPRM case study
- Supply chain risk identified before contract signature An organisation screening a prospective supply chain partner discovered hidden operational and reputational risks through open-source intelligence – before any contract was signed. The engagement prevented a high-value relationship with a materially compromised vendor. Read the supply chain OSINT case study
- ESG due diligence uncovers supply chain exposure A global firm commissioned ESG risk screening on its vendor population. Neotas investigation uncovered labour practice violations and environmental breaches embedded in a Tier 2 supplier – exposure that standard ESG questionnaires had not flagged. Read the ESG supply chain case study
- ESG framework assessment with OSINT integration A client needed an ESG risk management framework that went beyond self-reported vendor data. Neotas integrated OSINT-based screening into their existing ESG assessment process, providing independent verification across the vendor population. Read the ESG framework case study
- PEP screening reveals undisclosed political connections A European organisation screening a prospective third party found no flags on standard PEP database checks. Neotas intelligence analysis identified undisclosed political links that created direct regulatory and reputational exposure. Read the PEP screening case study
- Dangerous senior manager identified before appointment A firm conducting pre-engagement due diligence on a prospective senior manager used Neotas to go beyond CV verification. The investigation surfaced a pattern of conduct that standard reference checks had not identified. Read the senior manager due diligence case study
- Network analysis uncovers international credit risk links Standard financial checks on a counterparty returned clean results. Neotas network analysis mapped undisclosed international corporate relationships that created material credit risk exposure the client had no visibility of. Read the network analysis case study
- AML compliance strengthened through OSINT A financial institution needed to validate AML due diligence on third-party relationships beyond transaction monitoring. Neotas open-source intelligence provided independent verification of customer and counterparty backgrounds across multiple jurisdictions. Read the AML compliance case study
Every case above started with a vendor or counterparty that looked clean on paper. Neotas intelligence screening goes where databases don’t. See how it works for your TPRM programme →
TPRM and due diligence checklists
Practical tools for risk and compliance teams running third-party assessments. All checklists are available on the Neotas due diligence resource page.
| Checklist | Who it’s for | What it covers |
|---|---|---|
| Due Diligence Checklist | Risk teams, compliance officers, procurement leads | Full due diligence process: identity verification, financial health, regulatory status, adverse media, red flags – audit-ready format |
| Vendor Due Diligence Checklist | TPRM teams, procurement, second-line risk functions | Vendor-specific due diligence across all stages: onboarding, periodic review, contract renewal and exit – structured for TPRM lifecycle use |
| Enhanced Due Diligence (EDD) Checklist | Compliance officers, financial crime teams | Standardised EDD process for high-risk vendors and third parties aligned to FCA Financial Crime Guide and Money Laundering Regulations 2017 |
Running EDD on a high-risk vendor? Neotas combines the checklist framework with OSINT Explore our EDD Solutions →
FAQs on TPRM
What is TPRM and what does it stand for?
TPRM stands for Third-Party Risk Management. It’s the process organisations use to identify, assess and manage the risks that come from working with external vendors, suppliers, contractors and service providers. Think of it as the structured discipline that sits between your organisation and everyone outside it who touches your data, systems or operations.
What is the TPRM process?
The TPRM process runs in seven stages: identify all third parties, tier them by inherent risk, conduct due diligence, embed controls in contracts, monitor continuously, manage issues when they arise, and formally offboard vendors when relationships end. It’s a continuous cycle, not a one-time assessment. See the full TPRM lifecycle guide.
What is the difference between TPRM and vendor risk management?
TPRM covers all external relationships: vendors, contractors, advisors, JV partners, staffing agencies. Vendor Risk Management (VRM) covers vendors only, typically focused on cybersecurity and operational risk. TPRM goes further it adds financial crime, ESG, reputational and fourth-party risk. For FCA, DORA and OCC compliance, TPRM is the correct framework. VRM alone won’t satisfy those obligations.
What is a TPRM framework?
A TPRM framework is the structured set of policies, processes and controls an organisation uses to manage third-party risk consistently. It defines how vendors get inventoried, tiered, assessed, contracted and monitored. A good framework aligns with DORA, FCA SYSC 8 and OCC 2023-17 requirements and produces the documented evidence trail regulators expect to see. See the Neotas TPRM framework guide.
What regulations require third-party risk management?
The main ones: DORA for EU financial services (EBA), FCA SYSC 8 for UK regulated firms (FCA), OCC Bulletin 2023-17 for US national banks (OCC), GDPR Article 28 for any organisation handling personal data, and the UK Modern Slavery Act for firms above £36m UK turnover. Non-compliance carries financial penalties and personal senior manager liability.
What is third-party risk monitoring?
Third-party risk monitoring is the ongoing surveillance of active vendor relationships after onboarding. It covers adverse media alerts, sanctions and PEP list changes, financial health signals and regulatory action notices. For critical vendors, this runs continuously. For lower-risk vendors, quarterly or annual review is typical. Most TPRM programme failures happen between annual review cycles not at onboarding.
What is a TPRM questionnaire?
A TPRM questionnaire is a structured set of questions sent to vendors to collect information on their security controls, financial health, compliance status and data handling practices. It’s a core due diligence tool but has one major limitation: it’s entirely self-reported. Vendors can’t always disclose what they don’t know, and some won’t disclose what they do. Independent screening is what catches the gaps. See the TPRM questionnaire guide.
What is TPRM software and what does it do?
TPRM software manages the processes inside a third-party risk programme: vendor inventory, risk tiering, questionnaire distribution, due diligence tracking, monitoring alerts and board reporting. Options range from standalone TPRM platforms to GRC modules to specialist intelligence-led screening tools. Manual-only approaches typically fail regulatory review at scale. See the TPRM software guide
What is fourth-party risk in TPRM?
Fourth-party risk is the exposure that flows through your direct vendors to their own sub-contractors and technology providers. Your contract is with the vendor but the risk can sit two levels down. A cloud provider using a sanctions-linked data centre is a real example. DORA requires regulated firms to map and manage fourth-party ICT concentration risk explicitly. (EBA DORA RTS) Most TPRM programmes currently have no visibility here at all.
What is a TPRM maturity model?
A TPRM maturity model is a five-level scale that describes how sophisticated a third-party risk programme is from Level 1 (no formal programme, entirely reactive) to Level 5 (intelligence-led, continuous monitoring, fourth-party visibility, financial crime integration). Most regulated firms sit at Level 2 or 3. DORA and FCA guidance require Level 4 as a practical minimum.
Why is third-party risk management important?
61% of data breaches involve a third party. (IBM Cost of a Data Breach Report 2024) 60% of global AML fines in 2023 were linked to third-party control failures. For regulated firms, TPRM is a legal obligation with direct financial penalties and personal senior manager liability under SMCR. For any organisation, vendor relationships are the most common source of data breaches, compliance failures and operational disruptions and the least visible.
What is TPRM in financial services?
In financial services, TPRM is a binding regulatory requirement with named senior manager accountability. FCA SYSC 8 requires formal outsourcing governance. DORA requires an ICT third-party risk programme, a register of all ICT contracts and documented concentration risk controls all in force since January 2025. (EBA) OCC 2023-17 requires US national banks to run a lifecycle-based programme for all third-party relationships. (OCC) Financial crime screening adverse media, sanctions, PEP checks is embedded in due diligence for higher-risk vendor relationships.
