Procurement in Banking and Financial Services: Vendor Risk and Third-Party Governance

In financial services, every supplier is a regulated risk — and procurement is the front line

Abstract Financial-services institutions occupy a uniquely regulated position in the global economy. The progressive outsourcing of core technology, data processing, cloud infrastructure, and professional services has made robust third-party governance not merely a best practice, but an explicit regulatory obligation. This article examines the intersection of procurement strategy and third-party risk management (TPRM) in banking and financial services, with particular attention to the Digital Operational Resilience Act (DORA), the Office of the Comptroller of the Currency (OCC) guidance on third-party relationships, the UK Financial Conduct Authority's SYSC 8 outsourcing rules, and the emerging concern of vendor concentration risk.

1. Introduction

The financial services sector has undergone a profound structural transformation over the past two decades. Institutions that once developed and maintained most of their operational capabilities in-house now routinely rely on third-party vendors for cloud computing, payments processing, know-your-customer (KYC) verification, cybersecurity, core banking systems, and a wide range of ancillary services. The COVID-19 pandemic accelerated this trajectory, forcing rapid adoption of digital channels and remote-working infrastructure, often through third-party providers [1].

This reliance creates strategic advantages: access to specialised expertise, scalability, and cost efficiency. Yet it also introduces layers of operational, legal, reputational, and systemic risk that regulators across jurisdictions have grown increasingly concerned about. High-profile incidents — from the 2012 Knight Capital technology failure to the 2023 MOVEit supply-chain breach affecting dozens of financial institutions — have underscored the potential for third-party events to cascade into systemic disruptions [2].

Against this backdrop, procurement in banking and financial services has been reimagined. The traditional purchasing function — tasked with obtaining goods and services at the lowest cost — is being supplanted by a broader vendor governance mandate that encompasses regulatory compliance, risk assessment, information security oversight, and operational resilience planning. This article explores the key dimensions of this evolution, examining the regulatory architecture that shapes third-party governance and the operational frameworks institutions must deploy to comply.

2. The Regulatory Landscape

2.1 The Digital Operational Resilience Act (DORA)

Adopted by the European Union in January 2023 and applicable from January 2025, DORA (Regulation (EU) 2022/2554) represents the most comprehensive regulatory intervention in financial-services ICT risk management to date. Its ambition is to harmonise rules across EU member states on how financial entities — including banks, insurers, investment firms, and crypto-asset service providers — manage the digital operational resilience of their ICT systems, with particular focus on third-party ICT risk [3].

Under DORA, financial entities must maintain a register of all ICT third-party service providers and categorise them by criticality. Critical third-party providers (CTPPs) are subject to a novel oversight framework administered by European Supervisory Authorities (ESAs), including the European Banking Authority (EBA), who can conduct direct inspections and audits of these providers. This represents a fundamental shift: regulators are no longer content to hold only the financial institution accountable; they now exercise direct oversight powers over the vendors themselves [4].

For procurement functions, DORA imposes mandatory contractual requirements. Written contracts with ICT third-party providers must include provisions on service levels, audit rights, data location and portability, incident reporting obligations, termination rights, and exit strategies. Critically, DORA requires that financial entities ensure concentration risks from their ICT provider portfolios are identified and managed, and that they test their ability to exit critical arrangements without disrupting operations [5].

2.2 OCC Guidance on Third-Party Relationships

In the United States, the Office of the Comptroller of the Currency has long established expectations for banks' management of third-party relationships. The 2023 interagency guidance issued jointly by the OCC, the Federal Reserve, and the FDIC consolidates prior guidance into a unified framework applicable to all third-party relationships, not merely 'critical' ones [6]. The guidance identifies three phases of the relationship lifecycle — planning, ongoing monitoring, and termination — and specifies that institutions must conduct risk-based due diligence proportionate to the level of risk posed by each relationship.

The OCC framework places explicit responsibility on boards of directors and senior management. Procurement activity is elevated from an operational function to a governance matter: boards are expected to approve policies for managing third-party relationships, review periodic reports on significant arrangements, and ensure adequate resources are devoted to oversight. This governance framing aligns procurement decisions with the institution's risk appetite and strategic objectives, rather than treating vendor selection as a purely commercial exercise [7].

2.3 FCA SYSC 8 and the UK Outsourcing Regime

In the United Kingdom, the Financial Conduct Authority's Senior Management Arrangements, Systems and Controls sourcebook — specifically Chapter 8 (SYSC 8) — governs outsourcing by authorised firms. SYSC 8 requires that firms do not outsource activities in a way that materially impairs the quality of internal controls or the ability of the FCA or PRA to supervise the firm. The rules impose duties to maintain oversight of outsourced functions, ensure the provider meets equivalent standards, and preserve continuity of service [8].

Following the publication of the EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02), and their onshoring into UK regulatory practice post-Brexit, UK financial institutions must now conduct extensive pre-outsourcing assessments, maintain an outsourcing register, include specific contractual provisions, and notify regulators of material outsourcing arrangements. The Prudential Regulation Authority (PRA) Supervisory Statement SS2/21 on outsourcing and third-party risk management further elaborates expectations for PRA-regulated firms, including requirements for sub-outsourcing controls and business continuity arrangements [9].

3. Third-Party Risk Management Frameworks

3.1 The Vendor Risk Lifecycle

Effective TPRM in financial services is structured around a vendor lifecycle model encompassing five stages: (i) vendor identification and categorisation; (ii) due diligence and pre-contract assessment; (iii) contract negotiation and execution; (iv) ongoing monitoring and performance management; and (v) offboarding and exit management. Each stage carries distinct risk exposures that procurement teams must manage in collaboration with legal, compliance, information security, and business lines [10].

At the identification and categorisation stage, institutions segment vendors by the inherent risk they pose, typically across dimensions including data sensitivity, criticality to operations, regulatory exposure, financial health, and jurisdictional risk. Tiered risk models — such as those recommended by the Shared Assessments Program or the Financial Services Information Sharing and Analysis Center (FS-ISAC) — allow due diligence resources to be allocated proportionately, with the most intensive scrutiny applied to tier-one, mission-critical providers [11].

3.2 Due Diligence and Information Security Assessment

Pre-contract due diligence in financial services extends well beyond financial analysis and reference checks. Information security assessments have become a central component, driven by the recognition that data breaches originating from third-party systems represent one of the most significant threat vectors facing the industry. Institutions routinely require vendors to complete standardised questionnaires — such as those developed by the Standardised Information Gathering (SIG) initiative — covering controls across domains including access management, encryption, incident response, and business continuity [12].

Third-party audits and certifications, including SOC 2 Type II reports, ISO/IEC 27001 certification, and cloud-specific attestations (such as CSA STAR), provide structured assurance that vendor controls meet defined standards. However, regulators and practitioners increasingly recognise that point-in-time assessments are insufficient: continuous monitoring tools — which track vendor security posture, news events, and financial health in real time — are becoming an industry standard, and are either mandated or strongly encouraged under frameworks such as DORA [13].

3.3 Contractual Protections and SLAs

The contract itself serves as the primary instrument of vendor risk governance. Financial services procurement contracts have evolved substantially in response to regulatory requirements, incorporating provisions on: data processing and sub-processing (aligned with GDPR and equivalent regimes); audit and inspection rights; incident notification timelines (typically 24-72 hours for material incidents); business continuity and disaster recovery standards; termination rights triggered by insolvency, change of control, or regulatory objection; and data return and deletion obligations at contract end [14].

Service Level Agreements (SLAs) in regulated sectors must balance commercial practicality with regulatory defensibility. Regulators expect that SLAs reflect genuinely material performance thresholds — not aspirational targets — and that breach remedies are proportionate to the impact of underperformance on the institution and its customers. The UK FCA has explicitly criticised the practice of embedding SLAs that are so loose as to provide no meaningful protection [15].

4. Vendor Concentration Risk

One of the most structurally significant risks in financial-services procurement is vendor concentration: the degree to which institutions — individually and collectively — depend on a small number of providers for critical functions. Cloud infrastructure offers the starkest illustration. A 2023 analysis by the Bank of England found that the majority of UK-regulated institutions relied on one of three hyperscale cloud providers — Amazon Web Services, Microsoft Azure, or Google Cloud Platform — for material elements of their operations [16].

This concentration is not merely an individual firm problem; it is a systemic one. An outage or security incident affecting a dominant provider could simultaneously impair the operations of multiple systemically important institutions, triggering contagion effects across payment systems, capital markets, and deposit-taking. Regulators have responded with heightened scrutiny: DORA explicitly requires financial entities to map and assess ICT concentration risk, both at the entity level and, through ESA coordination, at the sectoral level. The EBA has published regular reports on cloud concentration in the EU banking sector, flagging the risk as a priority supervisory concern [17].

From a procurement strategy perspective, managing concentration risk requires deliberate multi-vendor architectures, portability standards, and interoperability requirements embedded in contracts from the outset. Exit strategies — including the ability to migrate workloads or data to an alternative provider within a defined timeframe — must be tested, not merely documented. Procurement teams must work closely with technology and enterprise architecture functions to ensure that commercial decisions do not inadvertently create lock-in that undermines operational resilience [18].

5. The Evolving Role of Procurement

The convergence of regulatory demands, cyber risk, and operational resilience requirements is fundamentally reshaping the procurement function in financial services. The CPO and their team can no longer operate as transactional intermediaries focused primarily on cost savings and contract compliance. They must instead serve as risk-aware orchestrators, capable of coordinating across legal, compliance, technology, and business stakeholders to deliver vendor relationships that are commercially sound, operationally resilient, and demonstrably compliant with regulatory expectations [19].

This requires investment in capabilities that are relatively new to procurement: TPRM technology platforms (such as Coupa, Ariba integrated with risk modules, or specialist tools like ProcessUnity and OneTrust), data-driven risk scoring, and procurement staff with sufficient knowledge of information security and regulatory frameworks to conduct meaningful vendor conversations. The Chartered Institute of Procurement and Supply (CIPS) has recognised this shift, developing guidance on supply-chain risk in financial services that incorporates both commercial and regulatory dimensions [20].

Governance structures must also adapt. Many institutions have established dedicated Third-Party Risk Committees or integrated TPRM into their enterprise risk management frameworks under the Three Lines of Defence model — with procurement occupying the first line, compliance and risk management the second, and internal audit the third. Regular reporting to boards and senior risk committees on the institution's third-party risk profile — including concentration, performance, and emerging risks from within the vendor ecosystem — is increasingly regarded as a baseline governance expectation by regulators [21].

6. Conclusion

Procurement in banking and financial services has entered a new era, defined not by the pursuit of cost savings alone, but by the imperative to manage third-party risk within a dense and evolving regulatory landscape. DORA, OCC interagency guidance, FCA SYSC 8, and equivalent frameworks across other jurisdictions have collectively elevated third-party governance from a back-office concern to a board-level responsibility.

The challenges are substantial. Financial institutions must simultaneously manage the commercial performance of hundreds or thousands of vendor relationships, maintain up-to-date risk assessments in a rapidly shifting threat environment, embed complex regulatory requirements into contracts and due diligence processes, and address structural vulnerabilities such as vendor concentration risk. None of these objectives can be achieved by procurement teams working in isolation.

What is required is a model of integrated third-party governance — one in which procurement, risk, compliance, legal, and technology functions operate as a coherent unit, supported by appropriate technology and oversight structures. Institutions that invest in this model will be better positioned not only to satisfy regulatory expectations, but to realise the strategic potential of their vendor relationships, making third-party governance a source of competitive resilience rather than merely a compliance burden.