Third-party risk management
TPRMAlso called third-party risk, outsourcing risk management
Third-party risk management is how a regulated firm finds, assesses and controls the risks created by the outside companies it relies on. These include suppliers, outsourcers, cloud providers and partners. It covers the whole relationship, from selection and contracts to ongoing monitoring and exit. Regulators hold the firm responsible for outsourced activity.
How it works
Most firms keep an inventory of every third party and give each one a risk tier. Tiering depends on how critical the service is, what data the supplier handles and how easily it could be replaced. High-tier suppliers face deeper due diligence, tougher contract terms, audit rights and more frequent reviews. Low-tier suppliers receive lighter checks. Ownership usually sits with the business, with oversight from risk and procurement.
Supervisors treat third-party failure as a direct threat to customers and markets. In the EU, DORA requires a register of all ICT providers and exit plans for critical services. In the UK, PRA SS2/21 sets expectations for outsourcing and material third parties. US banking agencies issued joint guidance in 2023. Outages, data breaches and supplier insolvency can all trigger supervisory scrutiny of the firm itself.
The rules
Requires ICT third-party risk management, contract terms, a register of information on all ICT providers and exit plans for critical services.
EU banks, insurers, investment firms, payment firms and other financial entitiesSets PRA expectations for due diligence, contracts, data security, ongoing oversight and exit planning across outsourcing and other material third-party arrangements.
UK banks, building societies, PRA-designated investment firms and insurersDescribes risk management across the third-party life cycle: planning, due diligence, contract negotiation, ongoing monitoring and termination, scaled to risk.
Banking organisations supervised by the Federal Reserve, FDIC and OCCRequires an outsourcing policy, pre-contract risk assessment, a register of outsourcing arrangements, audit rights and exit strategies for critical functions.
EU credit institutions, investment firms, payment and e-money institutionsCommon questions
What is the difference between TPRM and vendor risk management?
Vendor risk management usually covers suppliers a firm pays for goods or services. Third-party risk management is wider. It also covers partners, agents, distributors, intragroup providers and other relationships that create risk, even where no purchase is involved.
Does outsourcing transfer regulatory responsibility?
No. UK, EU and US rules state that a regulated firm stays fully responsible for meeting its obligations when it outsources a function. The board and senior management remain accountable for oversight of the third party.
What is fourth-party risk?
Fourth-party risk is the risk from a supplier's own suppliers and subcontractors. DORA and PRA SS2/21 expect firms to understand material subcontracting chains, particularly where a subcontractor supports a critical or important function.
How often are third parties reviewed?
Review frequency follows the risk tier. Critical suppliers are typically reviewed at least annually and monitored continuously between reviews. Lower-risk suppliers may be reviewed every two or three years or when their service changes.
Our coverage
News and analysis on third-party risk from RegTech Post.
Read the coverage →RegTech PostManaging Third-Party Risk: What Legal Teams Must Focus on in 2026Read the article →RegTech PostThird-Party Risk Management and AI: What Boards Need to KnowRead the article →
