As financial institutions increasingly rely on third parties to deliver critical services, the nature and complexity of risks arising from these relationships have expanded significantly.
These risks are no longer confined to operational inefficiencies—they now directly threaten the delivery of Critical Business Services (CBS), regulatory compliance, and financial stability.
Regulators such as the Bangko Sentral ng Pilipinas (BSP) under Circular No. 1203 (2024) and Bank Negara Malaysia (BNM) in its Operational Resilience guidance emphasise the need for financial institutions to identify, assess, and manage risks arising from third-party dependencies.
These risks must be understood not only at the vendor level but also in terms of their potential impact on end-to-end service delivery.
This chapter aims to provide a structured understanding of the different types of third-party risks relevant to Operational Resilience. By the end of this chapter, readers will:
Third-party risks can be broadly categorised into the following key types:
Each of these risk types can independently—or collectively—affect the resilience of critical business services.
|
Risk Type |
Description |
Banking Example (CBS Impact) |
BSP 1203 / BNM Alignment |
|
Operational Risk |
Risk of service disruption due to failure in third-party operations, systems, or processes |
A payment processor outage disrupts CBS-2: Payments and Funds Transfer Services, causing transaction failures |
BSP requires identification of dependencies supporting CBS and scenario testing; BNM emphasises service continuity under severe disruptions |
|
Cybersecurity Risk |
Risk of cyber incidents originating from third parties (e.g., data breach, ransomware) |
A cloud service provider is compromised, exposing customer data and disrupting CBS-1: Deposit and Account Services |
Both BSP and BNM require integration of cyber resilience into OR and third-party oversight |
|
Compliance & Regulatory Risk |
Risk arising from third-party failure to comply with laws, regulations, or contractual obligations |
A KYC vendor fails to meet AML requirements, exposing the bank to regulatory penalties |
BSP 1203 mandates compliance across outsourcing arrangements; BNM stresses that regulatory accountability remains with the bank |
|
Financial Risk |
Risk of third-party financial instability affecting service delivery |
A critical vendor becomes insolvent, halting support for core banking systems |
Regulators expect due diligence and ongoing financial health monitoring of critical vendors |
|
Reputational Risk |
Risk of damage to the bank’s reputation due to third-party actions or failures |
A data breach at a fintech partner leads to loss of customer trust in the bank |
BSP and BNM highlight customer impact and trust as key resilience considerations |
|
Concentration Risk |
Risk arising from over-reliance on a single or a limited number of third parties |
Heavy dependence on one cloud provider creates a single point of failure across multiple CBS |
BNM explicitly addresses concentration risk; BSP requires mapping of dependencies and vulnerabilities |
|
Strategic Risk |
Risk that third-party relationships are misaligned with business objectives or resilience strategy |
Outsourcing critical operations without proper control reduces the bank’s ability to recover during disruptions |
Regulators emphasise governance, oversight, and alignment with risk appetite |
|
Fourth-Party Risk |
Risk arising from subcontractors or downstream providers used by third parties |
A telecom provider (fourth party) fails, disrupting connectivity for a bank’s digital banking vendor |
Both BSP and BNM expect visibility of extended supply chain dependencies |
BSP requires banks to:
👉 Key BSP Insight:
BNM emphasises:
👉 Key BNM Insight:
It is important to recognise that third-party risks are interconnected, not isolated.
A cloud provider outage may trigger:
This interconnected nature reinforces the need for a holistic TPRM approach aligned with Operational Resilience.
To operationalise TPRM within an OR framework, banks should:
Understanding the different types of third-party risks is the foundation of an effective TPRM programme. For banks operating in increasingly complex and interconnected ecosystems, these risks can no longer be treated as peripheral concerns.
Instead, they must be actively managed as part of the organisation’s core Operational Resilience strategy.
By aligning third-party risk identification and management with regulatory expectations, such as BSP Circular No. 1203 and BNM’s Operational Resilience framework, financial institutions can strengthen their ability to withstand disruptions—whether they originate internally or externally.
| C1 | C2 | C3 | C4 |
| C5 | C6 | C7 | C8 |
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|