Financial institutions must rethink third-party resilience around critical services, continuous monitoring and deeper supply-chain dependencies. Risk leaders warned that annual assessments and contractual protections cannot provide sufficient visibility as cyber threats, fourth parties, regulatory expectations and AI transform increasingly interconnected vendor ecosystems.
Financial institutions must stop
treating third-party resilience as something that begins when a contract is
signed and ends when it expires.
Effective resilience increasingly
requires institutions to understand dependencies before onboarding, monitor
changing exposures continuously and maintain visibility beyond direct vendors
into the wider supply chain.
Speaking during a panel at CeFPro’s
2026 Risk Americas event, senior risk practitioners argued that growing
dependence on external providers is forcing institutions to reconsider both
what constitutes a critical third party and how those relationships should be
governed.
A Director of Sales Engineering at a
risk technology provider described end-to-end resilience as extending
“left-to-right, top-down.”
The horizontal dimension covers
everything from pre-contract procurement through offboarding, while the
vertical dimension recognizes that risks can emerge between scheduled
assessments.
A vulnerability discovered six months
after an annual review, for example, could immediately alter the risk profile
of multiple critical providers. Waiting until the next assessment could
therefore leave institutions operating with dangerously outdated information.
The Head of Third-Party Risk
Management for North America at a commercial bank said resilience ultimately
means maintaining critical services when disruption occurs.
But organizations cannot directly
control their suppliers around the clock, while fourth-party dependencies
create another layer of uncertainty.
“We know our third parties, but they
also use their subcontractors,” she said, arguing that continuous monitoring
must increasingly fill gaps between point-in-time assessments.
A Vice President of Corporate
Operational Risk and Resilience at a major insurer said operational resilience
has fundamentally changed the TPRM perspective. Instead of examining individual
vendors in isolation, institutions must understand the entire ecosystem
supporting customer services.
“It’s now not about just the
third-party that we rely on. It’s about the full ecosystem,” she said. The key
question becomes what disruption anywhere within that ecosystem could do to the
institution’s ability to serve customers.
That shift also challenges
established definitions of criticality. The insurer’s risk executive argued
that resilience mapping should determine which providers are genuinely
critical.
If a vendor supports an important
business service and its failure prevents delivery, “then by definition, that
is your critical provider.”
