Third-party risk management: what banks need to do differently

TL;DR: Federal Reserve third-party risk management now spans planning, due diligence, contracting, monitoring and termination, according to Panorays, with banks still accountable for outsourced functions and increasing scrutiny of AI-enabled vendors. The governance problem is no longer onboarding alone, but proving continuous oversight across fourth parties, changing models and exit scenarios.

Editorial analysis by NHI Mgmt Group, based on content published by Panorays: “Navigating Federal Reserve Third-Party Risk Management Guidance”.

Key questions

Q: What breaks when third-party risk management stops at onboarding?

A: When third-party risk management stops at onboarding, organisations lose sight of how access, integrations, and subcontractors change after approval.

Q: Why do banks remain accountable when a vendor performs a regulated function?

A: Because outsourcing changes the delivery model, not the accountability model.

Q: What do teams get wrong about fourth-party risk?

A: Teams often assume that if the direct vendor is approved, the access chain is controlled.

Practitioner guidance

• Tier vendors by operational criticality Separate mission-critical suppliers from low-risk utilities and align assessment depth, review cadence and escalation to the tier.
• Extend due diligence into the subcontractor chain Require disclosure of material subservice providers, data flows and approval rights for downstream changes that alter the risk profile.
• Write enforceable contract clauses for audit and exit Include audit rights, breach notification, regulatory-cause termination and data return or destruction obligations in every material contract.

Bottom line: The main governance gap is not whether a vendor was vetted once, but whether the bank can keep control as the relationship, subcontractors and technology stack change.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →