New international principles to strengthen third-party risk management by banks

In the ongoing digitalisation of the banking sector and the rapid growth of financial technology, banks increasingly rely on third-party service providers (TPSPs), including for some of their critical functions. This dependency introduces significant risks, as banks do not always have direct control over these external entities. These risks are further exacerbated by cyber threats, which can target both banks and their service providers.

To ensure the operational resilience of the banking sector, the effective management of outsourcing and TPSPs has become a priority for international standard setters, regulators, and supervisors. In July 2024, the Basel Committee on Banking Supervision (BCBS) introduced new principles to help strengthen third-party risk management by banks. The European Central Bank (ECB) is also expected to maintain a strong focus on the topic in 2025. Banks must therefore continue to prepare for these evolving requirements and expectations. We discuss below some of these new developments.

“Growing cyber threats, fuelled by current geopolitical tensions, and the increasing reliance on third-party service providers underline the need for banks to stay resilient and ensure continuity of their critical services even in the event of severe operational disruptions.”

European Central Bank, SSM Supervisory Priorities 2024-2026

The digitalisation of the banking sector has accentuated the risks of third-party service reliance

The practice of outsourcing to TPSPs is not new for banks, as they use it to gain flexibility and expertise, improve scalability and efficiency, decrease costs, and focus on their core business.

However, the digitalisation of the economy and the banking sector has introduced new tools, market rules, competitors, and a demand for new services, necessitating rapid adaptation by banks. Consequently, banks have increasingly relied on TPSPs, making them critical partners in their supply chain and activities. The setup or provision of IT infrastructures, supporting software, payment and transaction systems, digital banking platforms, data management, and cloud storage are just a few examples.

In recent years, the ECB significantly increased its focus on the digitalisation of the banking sector, making the link to the rising dependency of banks to third-party servicing. Through its diverse supervisory activities, digitalisation survey, and ongoing dialogue with the industry, the ECB concluded that digitalisation in the eurozone has made banks’ supply-chains more complex, more reliant on TPSPs, and subject to important third-party concentration-risks. Such risks are amplified by the current geopolitical environment, and the growing number of cyber threats – not only on banks but also on TPSPs. The ECB set clear expectations from banks to mitigate those risks.

The joint-ESA report from February 2024 also emphasised the significant role BigTech companies currently play in the EU financial sector as technology providers (e.g., cloud services, platforms, artificial intelligence/machine learning applications). The report highlights the significant operational, concentration, and regulatory risks posed by the reliance on these companies.

“Reliance on TPSPs is not without consequences. These firms, ranging from major tech companies (“BigTechs”) to small-scale start-ups, are themselves vulnerable to market, political and operational shocks. Disruptions affecting TPSPs can quickly propagate to banks- thus the importance of having contingency plans in place.”

Eric Cloutier, Group Head of Banking Regulations/ Head of Global FS RegCentre, Forvis Mazars in the UK

The example of Amsterdam Trade Bank underscores the critical need for robust third-party risk management and operational resilience in today’s volatile environment. In the spring of 2022, following the Russian attack on Ukraine and the subsequent sanctions on the Russian financial market, one of its main TPSPs was targeted, leading to the bank losing access to its IT systems. Despite being adequately capitalised and having sufficient liquidity, the bank was forced to cease operations and was ultimately declared bankrupt.

Sound third-party risks management is essential to operational resilience of the banking sector

Operational resilience has been a key priority for regulatory authorities since the events and fallout from the global financial crisis, and significant progress has been made by banks over the past decade to better withstand and recover from operational threats or shocks.

The environment under which banks are operating has however significantly evolved since then. In response to the increasing reliance of banks on TPSPs, setting adequate methodologies for identifying and managing third-party risks have become crucial.

The Covid-19 crisis also necessitated a swift adaptation to remote working, exposing banks to heightened Information and Communication Technology (ICT) risks. The Basel Committee Principles for Operational Resilience, released in 2021, were partly a response to these concerns, which were further exacerbated by Russia’s war of aggression against Ukraine, prompting Western banks to remain vigilant against potential cyber-attacks.

Please refer to our previous article for further information on where we stand on operational resilience and what this means for cross-border banks.

Evolving international standards for the sound management of third-party risk in the banking sector

In response to those changes, international standard setters, regulators, and supervisors have been monitoring the topic closely in recent years and setting new rules and expectations from banks to mitigate those risks.

In the EU, the EBA has already issued in 2019 its revised guidelines on outsourcing arrangements, emphasising robust management and continuous monitoring of third-party risks. These guidelines aim to create a harmonised framework for outsourcing across all financial institutions within the EU.

In December 2023, the Financial Stability Board (FSB) published a report on enhancing third-party risk management and oversight, described as a toolkit for financial institutions and financial authorities to providing them key guidelines on the topic. The report aims to enhance the resilience of financial institutions and ensure a consistent approach to third-party risk management across different jurisdictions and sectors.

The FSB report introduces the notion of critical services which are crucial for the bank’s “viability, critical operations and/or ability to meet key legal and regulatory obligations”, specifying methodologies to identify these critical third-party services and managing potential risks throughout the lifecycle of these relationships. This includes tools for incident reporting, criteria for identifying systemic third-party dependencies, and frameworks for incident response coordination.

In July 2024, the BCBS also developed on the topic by proposing in a consultative document principles for the sound management of third-party risk in the banking sector.

For banks, the BCBS document provides a clear application of the FSB’s tools to manage third-party risk across nine main principles:

1. Board Involvement: Ensure the board is actively involved in TPSP arrangements and risk strategy, including setting the risk appetite.
2. Sound Governance: Implement a third-party risk management framework that defines roles, processes, and documentation, aligning with the institution’s global risk framework.
3. Efficient Risk Assessments: Conduct risk assessments and controls in accordance with the TPRMF.
4. Appropriate Due Diligence: Perform thorough due diligence on TPSPs before onboarding, assessing their capabilities, financial health, legal compliance, and adherence to terms throughout the relationship.
5. Adequate Contracts: Establish contracts with TPSPs that clearly define roles, responsibilities, service levels, compliance requirements, data protection, confidentiality, and termination rights.
6. Sufficient Resources: Allocate sufficient resources to manage new TPSPs, integrating them into the TPRMF.
7. Comprehensive Monitoring: Implement ongoing monitoring systems to ensure TPSPs meet contractual and regulatory obligations, with regular reporting to senior management and procedures for issue escalation.
8. Robust Business Continuity Management (BCM): Develop a BC plan addressing potential TPSP service disruptions and recovery strategies, including assessing the TPSP’s own BC plan.
9. Preparedness for Termination: Establish clear policies for terminating TPSP arrangements, including exit strategies to ensure continuity of critical services during transitions.

For supervisors, this means providing effective oversight of third-party risk management framework:

1. Effective Supervision: Supervisors should allocate specific resources for third-party risk supervision.
2. Systemic TPSP Assessment: Assess TPSPs that service a significant part of the banking sector for systemic risk.
3. International Cooperation: Foster international cooperation, particularly concerning systemic risk.

What EU banks need to expect from the latest supervisory and regulatory developments?

The ECB increased focus on digitalisation and operational resilience has underscored the growing complexity and concentration risks in banks’ supply chains. Consequently, the ECB identified third-party risk as part of its supervisory priorities for the coming years. This involves additional supervisory activities for banks, including sector-wide data collection exercises, targeted reviews, and on-site inspections (OSIs) on outsourcing arrangements and third-party risk management. In recent months, European banks have been required to demonstrate their ability to respond to and recover from potential adverse events in this area.

Looking ahead, banks will increasingly be challenged against these new international and EU standards, potentially impacting their Supervisory Review and Evaluation Process (SREP) scores and capital requirements. Cloud services in particular are under high scrutiny from the ECB, which has identified concentration risks and vulnerabilities, such as data loss or service interruptions. The ECB has issued a dedicated ECB Guide on outsourcing cloud services, but further activities are expected to understand the extent of banks’ use of cloud technology and the associated risks.

DORA as the new legal basis to third-party risk management enforcement

The Digital Operational Resilience Act (DORA), set to become applicable on 17 January 2025, marks a significant advancement in third-party risk management regulation. DORA establishes a comprehensive EU oversight framework for critical ICT third-party service providers to EU financial entities. This framework aims to enhance the operational resilience of the financial sector by ensuring robust management of third-party risks.

DORA emphasises the necessity for institutions to gain a thorough understanding of their data and service flows. This entails a deep dive into their supply chains, TPSP activities, and associated risks. Banks must identify and integrate these risks into their global risk management frameworks and subsequent risk processes, such as the documentation of systems and business processes.

A key requirement under DORA is for financial institutions to maintain a comprehensive register of their contractual arrangements with TPSPs, available at entity, sub-consolidated, and consolidated levels. To facilitate this, DORA provides a dedicated ICT template and ongoing dry run exercises to help institutions prepare for compliance.

“The Digital Operational Resilience Act (DORA) and other regulatory frameworks now mandate robust governance and IT security measures. Recent ECB speeches emphasise the need for banks to enhance their risk management practices to ensure business continuity amid geopolitical tensions and cyber threats.”

David Labella, Director and Head of Regulatory Watch, Global FS RegCentre at Forvis Mazars

Other main jurisdictions are also considering specific frameworks for third-party risk management

Other major jurisdictions are also developing specific frameworks for third-party risk management, recognising the significant risks involved.

In the UK, the Prudential Regulation Authority (PRA), the Financial Conduct Authority (FCA), and the Bank of England (BoE) issued a consultation paper in December 2023. This paper focuses on critical third parties (CTPs) and builds on the amended Financial Services and Markets Act 2023. The Act grants HM Treasury the power to designate certain third-party service providers as CTPs and empowers regulators to establish rules and enforce actions against them. The UK supervisory authorities seek to impose minimum resilience requirements on the critical services provided to the financial sector and propose various tools to test these services’ resilience, potentially in collaboration with other jurisdictions’ national competent authorities.

In the United States, the Bank Service Company Act (BSCA) authorises federal banking agencies to supervise and regulate bank services provided by third parties. The BSCA stipulates that when a bank outsources services, these services are subject to the same level of supervision as if they were performed directly by the bank. This ensures that third-party service providers meet the same regulatory standards, thereby mitigating risks associated with outsourcing.

“For international banks, mitigating outsourcing risks across multiple jurisdictions is complex. Ensuring consistent implementation of business continuity plans and third-party dependency management is essential.”

Gregory Marchat, Group Head of Financial Services Advisory, Forvis Mazars in the UK

Banks must develop their resilience to TPSPs to “bend without breaking”

As Frank Elderson emphasised in his recent speech, banks must develop their resilience to “bend without breaking” under the pressures of cyber incidents, technology disruptions, and other operational headwinds.

The sector-wide concentration of TPSPs, especially in cloud technology, is a critical issue that requires coordinated efforts from international standard setters, regulatory agencies, and banks’ supervisors. Banks must ensure they have reliable options when choosing their providers.

Banks do face significant challenges in this area, particularly in their governance arrangements regarding TPSPs and in dedicating sufficient resources to reinforce their risk control frameworks. Assessing TPSP reliance, addressing concentration issues, or implementing exit strategies can be costly to implement but are all essential to safeguard operational stability. 

By dedicating adequate resources and expertise to these areas, banks can navigate the evolving regulatory landscape, strengthen their operational resilience, and meet the ECB’s stringent expectations.