Accountability Is the Design Constraint

The subject here is the bank’s continuing accountability for a critical service performed through a third-party service provider. The central question is not whether outsourcing is good or bad; it is whether the bank can capture the provider’s benefits while keeping the dependency visible, recoverable, and within its tolerance for disruption. The answer is conditional: delegation is sound only when the bank governs the consequences of relying on another organisation, its supply chain, and—where relevant—a shared sector infrastructure.

The bank is buying capability, not buying away accountability

A bank turns to a third-party service provider because external capability can be valuable. A provider may supply specialised expertise, scale, efficiency, innovative technology, or operational capacity that the bank would struggle to build and maintain internally. Digitalisation has expanded the range of services that banks depend on. That expansion is useful, but it changes the object of management. The bank is not merely purchasing a task. It is introducing a dependency into an operating system whose customers and obligations remain attached to the bank.

That distinction answers the title’s first half. Outsourcing can change who performs work. It does not change who must understand the service, meet applicable obligations, respond to disruption, and decide whether the arrangement remains acceptable. The Basel Committee’s principles state that reliance on a third-party service provider can reduce a bank’s direct control over activities, assets, and data and can introduce or amplify risks. They also state that it should not diminish the bank’s responsibility to customers, supervisors, and other legal authorities or impede effective oversight.

Accountability becomes concrete when the bank begins with the service’s consequences rather than the provider’s reputation. A service is critical when failure or disruption could significantly impair the bank’s viability, critical operations, or ability to meet key legal and regulatory obligations. This is a functional judgment about a particular service and bank. It is not a permanent label assigned to a company. A provider can be critical for one arrangement and less consequential for another, while several services that look ordinary in isolation can create a severe combined exposure.

Criticality then determines how much evidence and control the bank needs. Proportionality is important because a bank should not apply the same burden to every external service regardless of impact. But proportionate does not mean optional. A critical arrangement warrants more comprehensive oversight, stronger continuity management, more rigorous assurance, and closer attention to what happens when the provider or a key part of its supply chain fails. The bank’s tolerance for disruption supplies the reference point: how much interruption is acceptable, for which service, and with what consequences?

The answer cannot be found in the direct contract alone. A third-party service provider may depend on subcontractors, software, infrastructure, facilities, staff, or other suppliers. The Basel Committee calls a provider in that supply chain an nth party and identifies a key nth party as one essential to the ultimate delivery of a critical service. The bank may not have a direct contract with that party, but the service can still depend on it. The practical implication is that responsibility, information, and failure may cross more boundaries than procurement records show.

This is why concentration and substitutability belong in the same judgment as criticality. A bank can use several providers and still depend on the same key nth party, geographic region, identity service, software, or infrastructure. That is bank-level concentration: the bank’s own critical operations may be exposed to a common dependency. Systemic concentration is wider: a single provider or limited set of providers may support enough of the banking sector that failure could have sector-wide implications. The two levels are different, but a bank-level map is part of the evidence needed to understand the wider pattern.

A useful way to state the combined model is this: the bank owns the service obligation; the TPSP performs part of the service; the supply chain may determine whether performance is possible; and supervisors may add visibility without taking ownership. Each clause matters.