Supplier Stability in Operational Resilience: How Financial Services Are Evolving Third-Party Risk Management in Response to Regulatory Change

As third-party risk management continues to evolve across the financial services sector, organisations are expanding their lens beyond traditional cybersecurity. The focus is shifting toward broader, operational resilience—how to maintain continuity in the face of supplier failure, service disruption, or shifts in concentration risk.

This year’s findings build on the insights shared by the industry in our 2024 survey, providing a clearer picture of how organisations are advancing their resilience practices in a complex and evolving risk landscape. What we’re seeing is a continuation of a trend first observed last year: many firms have made meaningful strides in third-party oversight, particularly in response to evolving regulatory frameworks like DORA, SS2/21, and FFIEC. Yet challenges remain particularly in the areas of stressed exit planning, ownership clarity, and evidence-based assurance.

While confidence remains relatively high, the data suggests that some of that confidence is still rooted in assumption rather than verification. For example, a significant number of respondents who expressed confidence in their exit readiness also indicated they had not yet reviewed exit plans from their critical providers. This highlights an opportunity: to further strengthen confidence by reinforcing it with tangible, tested processes and shared understanding across teams.

We also noted a positive shift. Compared to last year, fewer respondents reported outright uncertainty. Many have moved into a more reflective, neutral stance, an indicator that teams are engaging more deeply with the complexities of operational resilience and beginning to identify the gaps that matter most.