Third-party vendor risk management for financial institutions

Examiners changed the question. Until 2023 they asked whether a bank had a vendor management policy. Now they ask how the institution verified a partner’s ownership, financial condition and regulatory history, and the enforcement record shows what happens when the answer is a questionnaire.

This guide covers third party vendor risk management for financial institutions end to end: every US, UK and EU obligation in force in 2026, the five-stage lifecycle examiners test against, how deep due diligence has to go at each risk tier, and how to choose vendor management software for financial institutions that produces evidence, not paperwork.

Who this guide serves

Three roles carry the weight of third-party risk management in financial institutions. If one of these is your desk, this page was built for the decision in front of you.

What is third-party risk management in financial services?

Third-party risk management (TPRM) in financial services is the discipline of identifying, assessing, monitoring and controlling the risks that vendors, fintech partners, outsourcers and other service providers introduce to a bank, credit union, insurer or investment firm. It covers operational, cyber, compliance, financial, reputational and concentration risk across the full relationship, from selection to exit.

The same program goes by several names. Third party vendor risk management for financial institutions is the phrase US regulators and buyers use most; bank vendor management and vendor risk management in financial services describe the same obligations. Whatever the label, the requirements below are identical.

The regulatory baseline differs by market but the expectation is the same: the institution owns the risk even when a third party performs the activity. US agencies restated this in the Interagency Guidance on Third-Party Relationships in June 2023, and the Financial Stability Board built the same principle into its 2023 global toolkit for financial institutions and authorities. ^[15] For the discipline in general, outside the financial-services context, start with the Neotas guide to third-party risk management.

How is TPRM different from vendor risk management in banking?

Vendor risk management covers suppliers under contract. TPRM in banking is wider: the Interagency Guidance applies to any business arrangement, including fintech partnerships, referral arrangements, appointed agents and services where no formal vendor contract exists. ^[5] A bank sponsoring a Banking-as-a-Service program carries third-party obligations for that fintech even though the fintech is a revenue partner, not a supplier.

Why third-party risk is now a board issue for financial institutions

Third-party risk moved from a procurement checklist to a board agenda item because vendor failures now stop banking operations and freeze customer money. According to the Verizon 2025 Data Breach Investigations Report, the share of breaches involving a third party doubled from 15% to 30% in one year. ^[1] SecurityScorecard’s 2025 Global Third-Party Breach Report puts third-party involvement at 35.5% of all 2024 breaches. ^[2]

Four incidents between 2023 and 2024 changed how examiners, boards and courts view third-party risk management in banking. Each one traces a different failure mode.

Fourth-party and concentration risk

Fourth-party risk is the exposure created by your vendors’ own subcontractors and suppliers. MOVEit reached most victims this way: through a tool their vendors used, not one they bought. Concentration risk compounds the problem when many institutions depend on the same provider, which is the exact scenario the EU’s critical-provider regime and the UK Critical Third Parties regime were built for. Neotas covers the wider discipline in its guide to supply chain risk management and the companion supply chain risk assessment guide.

US regulatory requirements for third-party risk management

US third-party risk management requirements for financial institutions come from four main sources: the Interagency Guidance on Third-Party Relationships, NYDFS Part 500, the GLBA Safeguards Rule and SEC disclosure rules. The Interagency Guidance, finalised on June 6, 2023 by the OCC, Federal Reserve and FDIC, replaced OCC Bulletin 2013-29 and the agencies’ earlier separate guidance with one lifecycle standard. ^{[5] [6]}

The guidance is principles-based and risk-based. It names the due diligence factors examiners expect institutions to evaluate: strategy and goals, legal and regulatory compliance, financial condition, business experience, qualifications of key personnel, risk management, information security, reliance on subcontractors, insurance and, for relevant relationships, AML/CFT exposure. The Federal Reserve’s May 2024 publication and the OCC’s community bank guide translate those factors into worked examples for smaller institutions. ^{[8] [7]}

Two practical implications follow. First, examiners test evidence, not policy documents: they ask how the institution verified a partner’s financial condition, ownership and regulatory history, which is where enhanced due diligence earns its keep. Second, the AML/CFT due diligence factor pulls TPRM into financial crime compliance territory: sanctions exposure, beneficial ownership and adverse media on the third party itself, not just its controls. A documented third-party risk management policy ties both threads to board accountability.

UK and EU requirements: DORA, SS2/21 and the Critical Third Parties regime

The EU’s Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied to financial entities since 17 January 2025 and is the strictest third-party regime in force. ^[11] It requires an ICT third-party risk strategy, a register of information covering every ICT contract, mandatory contractual terms, incident reporting and tested exit plans. On 18 November 2025 the European Supervisory Authorities designated the first 19 critical ICT third-party providers, including the major cloud platforms, for direct EU-level oversight, with the list refreshed annually. ^[4]

The UK runs a parallel track. PRA Supervisory Statement SS2/21 sets outsourcing and third-party expectations for banks and insurers, including materiality assessment, due diligence, sub-outsourcing controls and exit planning. ^[13] On top of firm-level rules, the Bank of England, PRA and FCA began direct oversight of HM Treasury-designated Critical Third Parties on 13 July 2026. ^[12] Designation does not reduce a firm’s own obligations; it adds supervisory reach over the providers everyone depends on. For a requirement-by-requirement breakdown, see the Neotas guides to DORA compliance requirements and DORA compliance for third-party risk management.

The third-party risk management lifecycle for financial institutions

The Interagency Guidance structures third-party risk management as five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. ^[5] Governance, documentation and independent review run through all five. The Neotas TPRM lifecycle guide and TPRM methodology cover each stage in depth; here is the financial-services version.

Risk tiering and vendor due diligence depth

Risk tiering assigns each third party a level, usually critical, high, medium or low, based on data sensitivity, operational criticality, customer impact and substitutability, and then sets the due diligence depth and monitoring cadence for that level. A bank overseeing 300 vendors cannot investigate all of them equally, and the guidance does not ask it to; it asks for depth proportionate to risk. A third-party risk assessment sets the tier; a vendor risk assessment template keeps the scoring consistent.

The practical question is what “depth” means at each tier. The Neotas Vendor Due Diligence Depth Scorecard maps five evidence levels to the guidance’s due diligence factors. The level, not the questionnaire score, is what an examiner can audit.

Due diligence for bank-fintech partnerships

Fintech partners warrant L4 depth at minimum. The July 2024 joint statement and the Evolve order both centre on the same gaps: partner financial condition, recordkeeping, ownership and compliance capability. ^[9] Verifying an ultimate beneficial owner matters because a sanctioned or previously banned individual behind a partner never shows up in a SIG questionnaire, and rarely in a name-only database screen against the corporate entity.

Where questionnaires and database checks fall short

A questionnaire records what a vendor chooses to say about itself on one day. A database screen finds exact-name matches on structured lists. Both are necessary, and both share five blind spots that matter most in financial services, where the due diligence factors include reputation, ownership and AML/CFT exposure. A standard TPRM questionnaire covers controls; it does not investigate the counterparty.

Open-source intelligence (OSINT) closes these gaps by investigating what exists about the vendor in the public domain rather than what the vendor submits. In Neotas engagements, analyst-reviewed OSINT background checks and adverse media screening have surfaced undisclosed ownership links, director litigation histories and foreign-language press coverage that questionnaire-and-database processes had already passed. Our case studies document the pattern across financial-services engagements.

Continuous monitoring: what regulators expect between assessments

Regulators expect institutions to detect material change in a third party when it happens, not at the next annual review. The Interagency Guidance describes ongoing monitoring as commensurate with risk and continuing for the duration of the relationship. ^[5] NYDFS requires periodic reassessment of third-party providers, and DORA requires financial entities to monitor ICT third-party risk throughout the arrangement. ^{[10] [11]}

Neotas runs this as continuous monitoring across its integrated sources, with configurable alerting, dashboards and a full audit trail, alongside online reputation monitoring for reputationally sensitive relationships. The general principles are covered in the Neotas guide to risk intelligence.

Vendor management software for financial institutions: how to choose

Vendor management software for financial institutions falls into three categories: GRC platforms that run questionnaires and workflow at scale, security ratings tools that observe cyber posture continuously, and intelligence-led platforms that investigate the counterparty itself. Most FI programs need workflow plus depth; the common buying mistake is paying for workflow and assuming depth comes with it. The Neotas TPRM software page covers the platform side; screening software and the OSINT investigation platform cover the investigation side.

What bank vendor management software must include

Bank vendor management software must produce evidence an examiner can audit against the Interagency Guidance: a complete vendor inventory with risk tiers, due diligence records against the named factors, contract obligations tracked to expiry, monitoring alerts with analyst decisions, and exit plans on file. ^[5] Credit unions weigh the same criteria at smaller vendor counts, with NCUA examination in place of OCC review.

Price the software on cost per assessed vendor at your required depth level, not per seat. A platform that manages 300 questionnaires cheaply but leaves fintech partners at L1 evidence costs more at exam time than it saves at renewal.

Common third-party risk management mistakes in financial services

These five failures recur across the programs Neotas reviews and across the public enforcement record. Each one is cheap to fix before an exam and expensive after.

Related reading

Third-party risk management in financial services: FAQs