What regulators expect
US banking regulators expect an institution to manage the risk of work a third party does for it as carefully as its own. Their 2023 interagency guidance describes a life cycle of planning, due diligence, contract negotiation, ongoing monitoring and termination, scaled to how critical each relationship is.
What due diligence covers
Due diligence typically reviews a vendor's financial condition, information security and SOC reports, business continuity plans and subcontractors. Sponsor banks also review their fintech partners' marketing, consumer compliance and financial crime controls.
Where the work is
Each relationship brings a package of documents to read against the institution's standards, and again at every periodic review. At institutions with hundreds of vendors and partners, the reading rather than the decisions is what slows the program.
Where automation helps
An AI system can read each document against the institution's standards and applicable guidance, list the gaps with sources and draft the assessment and follow-up requests. The risk team keeps approval and the rating, and periodic reviews start from the last assessment.