Enhancing Third-Party Risk Management and Oversight - A toolkit for financial institutions and financial authorities

Published date: 4 December 2023

	Executive summary
	Introduction
	1. Common terms and definitions
	2. Scope and general approaches
	2.1. Focus on critical services
	2.2. Holistic focus on third-party risk management
	2.3. Regulatory interoperability across jurisdictions and sectors
	2.4. Proportionality
	3. Financial institutions' third-party risk management
	3.1. Identification of critical services and assessment of criticality
	3.2. Onboarding and ongoing monitoring of service providers
	3.3. Incident reporting to financial institutions
	3.4. Financial institutions' registers of third-party service relationships
	3.5. Management of risks from service providers' supply chains
	3.6. Business continuity
	3.7. Exit strategies
	3.8. Management of concentration-related risks by individual financial institutions
	4. Financial authorities' oversight of third-party risks
	4.1. Financial authorities' supervision of financial institutions' third-party risk management
	4.2. Incident reporting to financial authorities
	4.3. Financial authorities' identification, monitoring and management of systemic third-party dependencies and potential systemic risks
	4.4. Cross-border supervisory cooperation and information sharing
	Annex 1: Relevant Developments at the Standard Setting Bodies
	Annex 2: Regimes pursuing supervision of certain critical third-party services and/or service providers
	Abbreviations

Request a trial