The regulatory and geopolitical landscapes
today demand a fundamental shift in how we think about third-party risk
management and operational resilience. After two decades in legal, risk, and
compliance roles across global investment banks, financial market
infrastructures, and fintechs, I have witnessed the cycles of regulatory
evolution firsthand. Yet today’s environment feels markedly different, and it
calls for a more streamlined, proactive approach that balances complexity with
clarity.
One of the most urgent areas we must
address is the way geopolitical tensions intersect with third-party risk. The
ongoing conflicts involving Russia and Ukraine, alongside the turmoil in Israel
and Palestine, highlight how fragile supply chains and service arrangements can
become under jurisdictional stress. Financial institutions must ensure that
critical and important functions continue uninterrupted, no matter where
services originate. The key lies in building resilience through jurisdictional
awareness and service continuity planning. If all else fails, institutions must
be prepared with credible, tested step-in measures that allow them to sustain
services to their customers without major disruption.
At the same time, we need to rethink exit
strategies. The complexity around third-party frameworks can sometimes obscure
the basic principles that should drive operational decisions. Simplification is
essential. When planning exit strategies, firms should focus first on their
important business services and critical functions, and then on the people,
processes, tools, and systems that support them. Effective mapping isn’t just a
regulatory exercise — it is the foundation for making sure that organizations can
disentangle themselves quickly and cleanly from third parties when necessary.
Complexity is often the enemy of resilience. By simplifying the way we map and
understand these dependencies, firms can better position themselves for rapid
and effective responses when the unexpected happens.
Governance plays a critical role in this
effort. It is not enough for operational risk teams to manage these issues in
isolation. True resilience requires engagement from the very top of the
organization, with the board fully involved in oversight and strategy.
Governance frameworks must be built to ensure that third-party risks are
monitored consistently and escalated appropriately, with senior executives and
directors actively challenging assumptions and stress-testing plans. Without
board-level engagement, even the most sophisticated third-party risk frameworks
are likely to falter under pressure.
