Overview
This series explains how banks can rely on third-party service providers for critical services without transferring accountability. It moves from impact-based criticality and hidden concentration through assessment, contracting, monitoring, recovery, exit, and supervisory coordination, while preserving the boundary that resilience depends on evidence, credible alternatives, and the bank’s tolerance for disruption.
Learning outcomes
- Outsourcing changes who performs a task, not the bank’s accountability for service obligations and disruption.
- Criticality is an impact judgment tied to disruption tolerance, not a label based on provider size or reputation.
- Dependency maps expose nth parties and concentration that provider counts alone can hide.
- Assessment, contracts, monitoring, tested recovery, exit planning, and supervision provide evidence without removing bank-specific judgment.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
Does outsourcing a critical bank service transfer the risk to the provider?
No. Outsourcing transfers performance of the task, but the bank remains accountable for the service, its obligations, and its response to disruption.
How does a bank decide whether a third-party service is critical?
A bank should judge whether failure or disruption could significantly impair its viability, critical operations, or ability to meet key legal and regulatory obligations. It should then consider tolerance, data, substitutability, and concentration.
Why is counting providers not enough to measure resilience?
Counting providers is insufficient because several contracts may share a key nth party, region, identity service, software, or infrastructure. A dependency map tests whether fallback paths are genuinely independent and usable within the bank’s tolerance.
What makes a bank’s recovery or exit plan credible?
A recovery or exit plan is credible only when the bank has tested its ability to transfer or continue the service with the required data, staff, access, capacity, timing, and independent dependencies. If no substitute exists, the plan must specify degraded continuity or retained internal capability.
What does supervision add when many banks use the same provider?
Supervision can reveal provider and sector-wide patterns that one bank cannot see alone, including systemic concentration and shared incident signals. It can examine significant providers where authority permits and coordinate across institutions, sectors, or borders, but it does not replace the bank’s own governance.