The Risk Stays With the Bank
The subject of this series is third-party risk management for critical bank services: what happens when a bank relies on another organisation to perform a function that customers and supervisors still expect the bank to deliver safely. This opening asks a basic but consequential question: if a bank outsources the work, what has it actually outsourced? The answer gives the reader a working test for later decisions: follow the dependency, identify where disruption lands, and ask whether the bank can remain within its tolerance for disruption.
Why banks rely on third parties—and what they still own
Banks do not turn to outside providers only because they want to cut costs. A provider may offer specialised expertise, faster scaling, more efficient operations, or capabilities that would be difficult to build internally. Digitalisation has widened those possibilities. Banks now depend on providers for services that banks might not have undertaken in the past, which makes the old category of “outsourcing” too narrow for the risks being managed.
The Basel Committee on Banking Supervision uses the broader term third-party service provider, or TPSP. A TPSP arrangement is a formal arrangement for a service, activity, function, process, or task performed directly for a bank. The definition can include a provider inside the same banking group when that entity is functioning as a service provider. It does not treat an ordinary customer transaction as a TPSP arrangement, nor does it define the relationship between a TPSP and its own supply-chain providers as a direct bank arrangement. That last boundary does not make the supply chain irrelevant. It means the bank has to manage it differently because the bank may not have a direct contract with every provider involved.
Consider a bank that uses an outside platform to support payments. The provider may operate infrastructure, maintain software, and handle parts of the process. The bank may gain capacity and technical depth. But a customer whose payment is delayed does not experience a successful transfer of responsibility; they experience the bank’s service. The bank still has to understand the arrangement, meet its applicable obligations, respond to disruption, and answer questions from authorities. The provider’s performance is part of the bank’s operating reality.
That is the central distinction. A bank can delegate performance without delegating accountability. The BCBS principles say that using a TPSP can reduce the bank’s direct control over activities, assets, and data and can introduce new risks or amplify existing ones. They also say that it should not diminish the bank’s responsibility to fulfil its obligations to customers, supervisors, and other legal authorities, or prevent effective regulatory oversight.
This is not an argument that third-party reliance is inherently unsound. Refusing every external dependency could preserve one kind of control while sacrificing expertise, resilience, or the ability to replace ageing internal systems. The relevant judgment is more demanding than “outsource” or “do not outsource.” It is whether the bank has designed and governed the dependency so that the benefits are real and the consequences of failure remain manageable.
The BCBS document is a principles-based supervisory baseline, not a single statute that supplies one universal answer for every bank. It is directed primarily at large internationally active banks and their prudential supervisors in BCBS member jurisdictions. The OCC’s June 2026 report describes the U.S. federal banking system, including the agency’s examination of certain third-party services. The legal details differ by jurisdiction, but the accountability problem is stable: a change in who performs a task does not by itself change who must keep the bank safe and sound.
Critical service is defined by impact, not by vendor label
The phrase “critical service” supplies the next distinction. Under the BCBS definition, a service is critical when its failure or disruption could significantly impair a bank’s viability, critical operations, or ability to meet key legal and regulatory obligations. A critical TPSP arrangement is one that materially supports or affects one or more critical services.
This is an impact test, not a permanent label attached to a company. The same provider may support an ordinary service in one arrangement and a critical service in another. A provider’s size, reputation, or market visibility may matter during assessment, but those qualities do not answer the more important question: what happens to this bank if this particular service stops, degrades, or becomes unavailable?
The answer depends on several linked conditions. How long can the bank tolerate the interruption? What data or information is shared? Can the service be replaced, moved to another provider, brought back in-house, or supported through a compensating control? Does the arrangement affect a process that the bank must continue for legal or regulatory reasons? The principles call for these questions to be considered before engagement and throughout the arrangement’s life.
Criticality changes the depth of management required. The BCBS approach is proportionate: controls should reflect a bank’s size, complexity, business model, risk profile, cross-border presence, and the risks and criticality of the arrangement. Proportionality is not an exemption from risk management. It means that a low-impact service need not receive the same degree of oversight as a dependency whose failure could threaten critical operations. For a critical arrangement, the principles expect more comprehensive oversight and more rigorous risk management, including robust business-continuity management.
The impact test also prevents a bank from looking only at one contract at a time. Several individually non-critical services can combine into a concentration that severely affects viability, critical operations, or legal and regulatory obligations if they are disrupted together. In other words, a bank can become fragile through accumulation even when no single vendor appears decisive.
This is why tolerance for disruption matters more than a vague promise of resilience. “Resilient” can mean many things. A useful tolerance states what level of interruption the bank can absorb for a particular service and what consequences would be unacceptable. It gives management a basis for deciding how much evidence to obtain, how often to test recovery, how much concentration to accept, and when a relationship should be changed or ended.
The critical-service question therefore changes the bank’s posture. For an ordinary dependency, proportionate monitoring may be enough. For a critical dependency, the bank needs a stronger explanation of how the service works, who else it depends on, what information the provider can supply during an incident, how recovery will be tested, and what the bank can do if the relationship fails. The provider is important, but the bank’s ability to absorb or respond to the provider’s failure is the decisive concern.
The dependency continues through the supply chain
A provider name is only the visible surface of the arrangement. The bank may also depend on a provider’s subcontractors, infrastructure, data centres, software, staff, and other suppliers. The BCBS principles call a provider in the TPSP’s supply chain an nth party. A key nth party is one that is essential to the ultimate delivery of a critical service to the bank.
That creates two different concentration questions. Bank-level concentration is the risk to one bank from dependence on one provider, a small number of providers, one region, or a shared key nth party. Systemic concentration is the risk to the banking sector when a single provider or limited group of providers supports enough institutions that a failure could have wider financial consequences. A bank is responsible for managing its own concentration. Supervisors have an additional task: understanding patterns that no individual bank can see by looking only at its own contracts.
The practical response is a dependency map, supported by a current register of arrangements and key nth parties. Such a record should preserve the details that change a decision: the service’s criticality, its substitutability, contingent providers, the information shared, where the service and data are located, and the interconnections that join the arrangement to other systems. For critical arrangements, relevant obligations and information rights should reach the key nth parties where appropriate.
The map matters because apparent diversification can be misleading. A bank might use several TPSPs and still rely on the same key nth party, geographic region, or widely used technology. Conversely, using one provider across different regions or combining an external service with internal capability may reduce one form of concentration without eliminating dependency altogether. The point is not to assume that one arrangement is always safer than another. It is to make the underlying coupling visible before deciding what the bank can tolerate.
The supervisor belongs on this map, but not as a backup operator. Supervisory oversight can examine a bank’s risk management, identify patterns across institutions, and coordinate with other authorities. It cannot make the bank’s dependency disappear. A common framework or a provider examination may improve visibility; it does not give management permission to stop testing, monitoring, or planning for failure.
The first question for any proposed or existing arrangement is therefore not “Is this vendor reputable?” It is: which critical service depends on this relationship, what else depends on the same chain, and how much disruption can the bank absorb? Answering that question requires more than a procurement record. It requires a map of responsibility and dependency. The next challenge is to follow that map through the decisions that create and govern an arrangement—from risk assessment and due diligence to contracting and onboarding—because accountability is not established once at the moment a provider is selected; it has to survive the life of the relationship.