Third-party risk management (TPRM)
How a bank identifies, assesses and controls the risks of working with outside companies, from vendors to fintech partners, across the whole relationship.
What third-party risk management is
Third-party risk management (TPRM) is the set of processes a bank uses to oversee companies that provide services to it or its customers. Under 2023 interagency guidance, banks stay responsible for activities performed by third parties, including fintechs in Banking-as-a-Service (BaaS) programs. Oversight should match each relationship's risk.
How it works
The guidance follows the life of each relationship: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. For a sponsor bank, that includes reviewing a fintech's compliance, know your customer (KYC) processes, complaints and marketing.
- 01 · ASSESS The bank plans the relationship and runs due diligence on the third party.
- 02 · CONTRACT The contract sets duties, data rights, audit access and exit terms.
- 03 · MONITOR The bank monitors performance and risk, and plans for termination.
| Stage | Bank focus | Example |
|---|---|---|
| Planning and due diligence | Risks, controls and fit of the third party | Reviewing a fintech's compliance program |
| Contract negotiation | Responsibilities, audit rights and data | Setting complaint handling and reporting duties |
| Ongoing monitoring | Performance, risk and compliance | Testing marketing, KYC files and complaints |
| Termination | Exiting without harm to customers | Moving accounts to another provider |
The table groups the 2023 guidance's five stages into four; in September 2026 the agencies proposed guidance to replace it.
Who must comply
- Banks supervised by the Federal Reserve, FDIC or OCC
- Banks partnering with fintechs on accounts, cards, payments or lending
- Fintechs and vendors, which agree by contract to support the bank's oversight
Cross River's compliance management system includes due diligence and annual review of relationships, third-party oversight, site visits and testing and monitoring programs. See how Cross River approaches compliance.