---
title: [OR] [Pillar] [E4] [C2] Types of Third-Party Risks in Operational Resilience
description: [OR] [Pillar] [E4] [C2] Types of Third-Party Risks in Operational Resilience
image: https://blog.bcm-institute.org/hubfs/OR%20Pillar%20E4%20Morepost/%5BOR%5D%20%5BPillar%5D%20%5BE4%5D%20%5BC2%5D%20Types%20of%20Third-Party%20Risks.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Understanding Third-Party Risk Management (TPRM) in Operational Resilience
# \[OR\] \[Pillar\] \[E4\] \[C2\] Types of Third-Party Risks in Operational Resilience
[![\[Pillar\] \[Banner\] \[C4\] Third-Party Risk Management](https://no-cache.hubspot.com/cta/default/3893111/17b06bdf-83ed-4b7f-9778-61a40cbf17f0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/17b06bdf-83ed-4b7f-9778-61a40cbf17f0)As financial institutions increasingly rely on third parties to deliver critical services, the nature and complexity of risks arising from these relationships have expanded significantly.
These risks are no longer confined to operational inefficiencies—they now directly threaten the delivery of **Critical Business Services (CBS)**, regulatory compliance, and financial stability.
Regulators such as the **Bangko Sentral ng Pilipinas (BSP)** under *Circular No. 1203 (2024)* and **Bank Negara Malaysia (BNM)** in its Operational Resilience guidance emphasise the need for financial institutions to identify, assess, and manage risks arising from third-party dependencies.
These risks must be understood not only at the vendor level but also in terms of their potential impact on end-to-end service delivery.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/cb2bc914-636c-4d77-aa9f-06324259bc7c)
[![\[Pillar\] \[3_4\] \[Banner\] \[C4\] Third-Party Risk Management](https://no-cache.hubspot.com/cta/default/3893111/1ab1982e-100b-41e9-b830-23583eeb5b97.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1ab1982e-100b-41e9-b830-23583eeb5b97)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Apr 17, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![\[Pillar\] \[Banner\] \[C4\] Third-Party Risk Management](https://no-cache.hubspot.com/cta/default/3893111/17b06bdf-83ed-4b7f-9778-61a40cbf17f0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/17b06bdf-83ed-4b7f-9778-61a40cbf17f0)
### eBook 4: Chapter 2
### Types of Third-Party Risks in Operational Resilience
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/cb2bc914-636c-4d77-aa9f-06324259bc7c)
#### **Introduction**
[![\[OR\] \[Pillar\] \[E4\] \[C2\] Types of Third-Party Risks](https://no-cache.hubspot.com/cta/default/3893111/714cfc41-261a-42e0-9c2d-f517bd787323.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/714cfc41-261a-42e0-9c2d-f517bd787323)As financial institutions increasingly rely on third parties to deliver critical services, the nature and complexity of risks arising from these relationships have expanded significantly.
These risks are no longer confined to operational inefficiencies—they now directly threaten the delivery of **Critical Business Services (CBS)**, regulatory compliance, and financial stability.
Regulators such as the **Bangko Sentral ng Pilipinas (BSP)** under *Circular No. 1203 (2024)* and **Bank Negara Malaysia (BNM)** in its Operational Resilience guidance emphasise the need for financial institutions to identify, assess, and manage risks arising from third-party dependencies.
These risks must be understood not only at the vendor level but also in terms of their potential impact on end-to-end service delivery.
#### **Purpose of This Chapter**
This chapter aims to provide a structured understanding of the different types of third-party risks relevant to Operational Resilience. By the end of this chapter, readers will:
- Identify key categories of third-party risks
- Understand how these risks impact critical banking services
- Align risk types with regulatory expectations (BSP 1203 and BNM)
- Apply risk classification in TPRM and Operational Resilience frameworks
#### **Overview of Third-Party Risk Categories**
Third-party risks can be broadly categorised into the following key types:
1. Operational Risk
2. Cybersecurity Risk
3. Compliance and Regulatory Risk
4. Financial Risk
5. Reputational Risk
6. Concentration Risk
7. Strategic Risk
8. Fourth-Party (Supply Chain) Risk
Each of these risk types can affect the resilience of critical business services, independently or collectively.
#### **Detailed Types of Third-Party Risks (Banking Context)**
##### **Table: Types of Third-Party Risks with Banking-Specific Examples**
| Risk Type | Description | Banking Example (CBS Impact) | BSP 1203 / BNM Alignment |
| --- | --- | --- | --- |
| Operational Risk | Risk of service disruption due to failure in third-party operations, systems, or processes | A payment processor outage disrupts CBS-2: Payments and Funds Transfer Services, causing transaction failures | BSP requires identification of dependencies supporting CBS and scenario testing; BNM emphasises service continuity under severe disruptions |
| Cybersecurity Risk | Risk of cyber incidents originating from third parties (e.g., data breach, ransomware) | A cloud service provider is compromised, exposing customer data and disrupting CBS-1: Deposit and Account Services | Both BSP and BNM require integration of cyber resilience into OR and third-party oversight |
| Compliance & Regulatory Risk | Risk arising from third-party failure to comply with laws, regulations, or contractual obligations | A KYC vendor fails to meet AML requirements, exposing the bank to regulatory penalties | BSP 1203 mandates compliance across outsourcing arrangements; BNM stresses that regulatory accountability remains with the bank |
| Financial Risk | Risk of third-party financial instability affecting service delivery | A critical vendor becomes insolvent, halting support for core banking systems | Regulators expect due diligence and ongoing financial health monitoring of critical vendors |
| Reputational Risk | Risk of damage to the bank’s reputation due to third-party actions or failures | A data breach at a fintech partner leads to loss of customer trust in the bank | BSP and BNM highlight customer impact and trust as key resilience considerations |
| Concentration Risk | Risk arising from over-reliance on a single or a limited number of third parties | Heavy dependence on one cloud provider creates a single point of failure across multiple CBS | BNM explicitly addresses concentration risk; BSP requires mapping of dependencies and vulnerabilities |
| Strategic Risk | Risk that third-party relationships are misaligned with business objectives or resilience strategy | Outsourcing critical operations without proper control reduces the bank’s ability to recover during disruptions | Regulators emphasise governance, oversight, and alignment with risk appetite |
| Fourth-Party Risk | Risk arising from subcontractors or downstream providers used by third parties | A telecom provider (fourth party) fails, disrupting connectivity for a bank’s digital banking vendor | Both BSP and BNM expect visibility of extended supply chain dependencies |
#### **Regulatory Expectations: BSP 1203 and BNM**
##### **Bangko Sentral ng Pilipinas (BSP) – Circular No. 1203 (2024)**
BSP requires banks to:
- Identify **critical business services and their dependencies**, including third parties
- Conduct **Business Impact Analysis (BIA)** incorporating third-party risks
- Perform **scenario testing**, including third-party failure scenarios
- Ensure **end-to-end resilience**, even when services are outsourced
- Maintain accountability for outsourced activities
👉 **Key BSP Insight:**
###### *Third-party risk is not transferred—it remains the bank’s responsibility.*
#### **Bank Negara Malaysia (BNM) – Operational Resilience Framework**
BNM emphasises:
- **Mapping interdependencies**, including third and fourth parties
- Managing **concentration risk** and systemic vulnerabilities
- Ensuring **impact tolerance levels consider** third-party disruptions
- Embedding third-party risk into **governance and risk appetite frameworks**
- Conducting **severe but plausible scenario testing**, including vendor failures
👉 **Key BNM Insight:**
###### *Operational Resilience must account for risks across the **entire service ecosystem**, not just internal operations.*
#### **Interconnection of Risks**
It is important to recognise that third-party risks are **interconnected**, not isolated.
##### **Example Scenario**
A cloud provider outage may trigger:
- **Operational Risk** → Service downtime
- **Cyber Risk** → Potential data integrity concerns
- **Reputational Risk** → Customer dissatisfaction
- **Regulatory Risk** → Failure to meet service obligations
This interconnected nature reinforces the need for a **holistic TPRM approach** aligned with Operational Resilience.
#### **Applying Risk Types to Critical Business Services (CBS)**
To operationalise TPRM within an OR framework, banks should:
- **Map third-party risks to each CBS**
- **Assess risk impact on service delivery**
- **Define impact tolerances**
- **Incorporate into scenario testing**
- **Develop mitigation strategies**
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/76668289-a13a-4127-a21b-e2dadd588cb5)**
- Third-party risks are **multi-dimensional and interconnected**
- These risks directly affect the delivery of **critical banking services**
- Regulators (BSP and BNM) require **end-to-end visibility and accountability**
- Effective TPRM requires integrating risk types into **BIA, scenario testing, and governance frameworks**
- Managing third-party risk is essential to achieving **true Operational Resilience**
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/a87f934a-0808-4f9a-a6cf-dc1c897d31d4)**
Understanding the different types of third-party risks is the foundation of an effective TPRM programme. For banks operating in increasingly complex and interconnected ecosystems, these risks can no longer be treated as peripheral concerns.
Instead, they must be actively managed as part of the organisation’s core Operational Resilience strategy.
By aligning third-party risk identification and management with regulatory expectations, such as BSP Circular No. 1203 and BNM’s Operational Resilience framework, financial institutions can strengthen their ability to withstand disruptions, whether originating internally or externally.
[![\[Pillar\] \[3_4\] \[Banner\] \[C4\] Third-Party Risk Management](https://no-cache.hubspot.com/cta/default/3893111/1ab1982e-100b-41e9-b830-23583eeb5b97.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/1ab1982e-100b-41e9-b830-23583eeb5b97)
| **C1** | **C2** | **C3** | **C4** |
| --- | --- | --- | --- |
| [![\[OR\] \[Pillar\] \[E4\] \[C1\] Introduction to TPRM](https://no-cache.hubspot.com/cta/default/3893111/82945f27-604a-406d-83f2-9df0180e126f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/82945f27-604a-406d-83f2-9df0180e126f) | [![\[OR\] \[Pillar\] \[E4\] \[C2\] Types of Third-Party Risks](https://no-cache.hubspot.com/cta/default/3893111/714cfc41-261a-42e0-9c2d-f517bd787323.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/714cfc41-261a-42e0-9c2d-f517bd787323) | [![\[OR\] \[Pillar\] \[E4\] \[C3\] Framework and Lifecycle](https://no-cache.hubspot.com/cta/default/3893111/e8b02e92-416f-4ab2-bb4e-0499db349f40.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e8b02e92-416f-4ab2-bb4e-0499db349f40) | [![\[OR\] \[Pillar\] \[E4\] \[C4\] Governance and Operating Model](https://no-cache.hubspot.com/cta/default/3893111/34bdac31-acb4-4daa-8d16-ff1b5ab43747.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/34bdac31-acb4-4daa-8d16-ff1b5ab43747) |
| **C5** | **C6** | **C7** | **C8** |
| [![\[OR\] \[Pillar\] \[E4\] \[C5\] Tools, Templates and Scoring Models](https://no-cache.hubspot.com/cta/default/3893111/453d5c46-1981-4519-bfee-4d9e4aa32d21.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/453d5c46-1981-4519-bfee-4d9e4aa32d21) | [![\[OR\] \[Pillar\] \[E4\] \[C6\] Scenario Testing for Third-Party Failures](https://no-cache.hubspot.com/cta/default/3893111/dc829fbf-e80f-45bb-bfbd-fa660f70095b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/dc829fbf-e80f-45bb-bfbd-fa660f70095b) | [![\[OR\] \[Pillar\] \[E4\] \[C7\] Regulatory Compliance Checklist](https://no-cache.hubspot.com/cta/default/3893111/7e12ff2a-59e6-40cc-ac60-e0b17bcfd00e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7e12ff2a-59e6-40cc-ac60-e0b17bcfd00e) | [![\[OR\] \[Pillar\] \[E4\] \[C8\] Case Study_ Implementation in Banking](https://no-cache.hubspot.com/cta/default/3893111/51d31b0f-dbf9-44ef-a127-999420c9fbd4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/51d31b0f-dbf9-44ef-a127-999420c9fbd4) |
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-05-23T02:50:22.051Z",
"datePublished" : "2026-04-17T10:06:47.000Z",
"headline" : "[OR] [Pillar] [E4] [C2] Types of Third-Party Risks in Operational Resilience",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-pillar-e4-c2-types-of-third-party-risks-in-operational-resilience",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```