Vendor due diligence
Also called supplier due diligence, third-party due diligence
Vendor due diligence is the set of checks a firm runs on a supplier before it signs a contract and again at renewal. It tests whether the vendor can deliver the service safely, stay solvent, protect data and meet regulatory requirements. The depth of the review rises with how critical the service is.
How it works
A business owner proposes a vendor and the third-party risk team classifies the service by criticality. The vendor then completes a questionnaire and supplies evidence such as audited accounts, security certifications, insurance and business continuity plans. Specialists in information security, legal, finance and compliance review the answers. Findings feed a risk rating, and the firm approves, rejects or approves the vendor with conditions written into the contract.
Due diligence matters because regulators hold the firm, not the supplier, accountable for an outsourced service. DORA requires EU financial entities to complete due diligence before entering an ICT contract. UK and US banking supervisors expect checks proportionate to the risk of each relationship. Weak checks surface later as outages, data breaches or failed exits, and supervisors treat them as governance failures.
The rules
Article 28(4) requires financial entities to undertake due diligence on a prospective ICT third-party service provider and assess its risks before entering a contract.
Banks, insurers, investment firms, payment firms and other EU financial entitiesSection 12 sets out due diligence on prospective service providers, covering business reputation, resources, financial standing and ability to perform critical functions. Replaced by EBA/GL/2026/09 once that applies.
Credit institutions, investment firms, payment and e-money institutions in the EUChapter 5 expects firms to carry out proportionate due diligence on potential service providers before entering material outsourcing and other third-party arrangements.
Banks, building societies, PRA-designated investment firms and insurersDescribes due diligence and third-party selection as a stage of the relationship life cycle, scaled to the risk and complexity of each relationship.
Banking organisations supervised by the Federal Reserve, FDIC and OCCCommon questions
What is the difference between vendor due diligence and vendor risk management?
Due diligence is the assessment carried out before a contract is signed and at set review points. Vendor risk management is the wider programme that covers inventory, tiering, contracting, ongoing monitoring and exit across the whole relationship.
What does a vendor due diligence review cover?
Typical reviews cover ownership and reputation, financial health, information security, data protection, business continuity, subcontractors, sanctions and anti-bribery checks, and regulatory status. Firms add topics such as ESG or cloud location when the service requires it.
How often is vendor due diligence repeated?
Firms set the frequency by tier. Critical vendors are often reviewed every year, lower tiers every two or three years. Material changes, such as an acquisition, a breach or a new subcontractor, trigger an earlier review.
Does the EBA still use the 2019 outsourcing guidelines?
Yes, for now. The EBA published new guidelines on third-party risk for non-ICT services, EBA/GL/2026/09, on 18 September 2026. They replace the 2019 outsourcing guidelines from the date they apply.
