Vendor tiering
Also called vendor segmentation, third-party tiering, criticality tiering
Vendor tiering is the practice of sorting suppliers into risk tiers based on how critical their service is and how much risk they carry. The tier sets how deep due diligence goes, how often a vendor is reviewed and which contract terms and exit plans apply.
How it works
Firms score each vendor at onboarding on factors such as the function supported, data access, substitutability and regulatory status. Scores map to tiers, often critical, high, medium and low. A critical vendor gets full due diligence, audits, continuous monitoring and an exit plan. A low tier vendor may need only basic checks and a periodic refresh.
Tiering lets compliance and procurement teams spend effort where risk sits. Regulators do not prescribe tiers. Rules in the UK, EU and US all scale requirements to criticality, using terms such as material outsourcing or critical or important functions. Supervisors expect firms to show why each vendor sits in its tier.
The rules
Expects risk management commensurate with the risk and complexity of each relationship, with more comprehensive oversight for third parties supporting critical activities.
Banks supervised by the Federal Reserve, FDIC and OCCRequires proportionate ICT third-party risk management, with stricter contract, exit and reporting duties for services supporting critical or important functions.
EU financial entities using ICT third-party servicesExpects firms to assess the materiality and risk of each outsourcing and third-party arrangement and apply proportionate controls to match.
PRA-regulated banks, building societies, insurers and designated investment firmsCommon questions
How many tiers do firms use?
There is no regulatory standard. Most firms use three or four tiers, such as critical, high, medium and low. The number matters less than clear criteria, consistent scoring and oversight that differs meaningfully between tiers.
What makes a vendor critical?
A vendor is usually critical when its failure would disrupt an important business service, breach regulatory obligations or harm customers. Access to sensitive data and a lack of substitutes also push a vendor into the top tier.
How often are vendor tiers reviewed?
Many firms re-tier at contract renewal and at least annually for critical vendors. Material changes, such as a new service, a data breach or a change in the vendor's ownership, trigger an immediate reassessment.
