Third-Party & Supply Chain

The OCC issued proposed third-party risk management guidance that would let banks scale oversight to the magnitude and likelihood of harm from each relationship, rather than following broad, process-driven approaches. It also clarified its risk-based supervision and enforcement of core service providers to help community banks facing due diligence, monitoring, and contract challenges. Compliance teams should assess how their current frameworks would change and consider submitting comments.

The European Banking Authority has finalized its Guidelines on third-party risk management, concentrating the new framework on the outside relationships that matter most when something goes wrong.

The Federal Reserve Board, Federal Deposit Insurance Corporation, National Credit Union Administration, and Office of the Comptroller of the Currency on Friday requested comment on proposed guidance for managing risks associated with third-party relationships. The proposal draws on the agencies’ supervisory experience and what they have learned examining financial institutions’ third-party risk management practices.

Privacy Commissioner of Canada, Philippe Dufresne, released new guidance for organizations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), laying out how businesses should assess the privacy practices of prospective third-party service providers. The guidance applies when an outside product, service, or technology will involve the collection, use, or disclosure of personal information, whether the provider is processing information directly, supplying technology that handles it, or working somewhere further down the chain.

Regulatory compliance and cyber risk are driving third-party risk management strategies. Supply chain leaders, meanwhile, rank cybersecurity as their top perceived risk and managing risk and geopolitical uncertainty as their leading transformation objective. Companies are preparing to expand their partner networks and automate more of the work that holds those networks together. Their risk functions are not always keeping pace.

Every risk discipline carries a habit that outlives its usefulness. In third-party risk management, that habit is the self-attested questionnaire. It is the artifact the whole practice is organized around. A relationship begins, a security questionnaire goes out, the vendor returns a few hundred answers, an analyst reviews them, and the file is closed until next year's cycle. The ritual is so established that it is easy to forget it was built for a smaller, slower, more stable world than the one we operate in now

Britain’s financial regulators will begin overseeing four of the world’s largest technology providers on Monday, extending their reach into the cloud infrastructure that banks and other financial institutions increasingly rely on to keep operating.