What does OCC third-party risk guidance require?

The 2023 OCC/FDIC/Fed interagency guidance requires banks to: (1) establish board-level oversight of third-party risk, (2) conduct risk-based due diligence before entering third-party relationships, (3) include specific provisions in contracts (audit rights, business continuity, data security, incident notification, termination), (4) monitor third-party performance and compliance on an ongoing basis, and (5) develop termination plans for critical vendors.

What is DORA and does it apply to US banks?

DORA (Digital Operational Resilience Act) is EU regulation effective January 17, 2025 requiring financial institutions to maintain an ICT vendor register, conduct risk-based due diligence, include specific contractual provisions, and report ICT incidents. US financial institutions with EU branches, subsidiaries, or regulated EU entities are in scope. DORA compliance requires a structured vendor register that most US banks do not currently have.

What is concentration risk in vendor management?

Concentration risk is over-dependence on a single vendor or vendor group that could create systemic disruption if that vendor fails, is impaired, or exits the market. Financial regulators specifically require boards to understand and approve material concentration risks. Common examples: 70%+ of critical IT infrastructure with a single cloud provider; sole-source core banking platform; single payment processor with no backup.

How often should financial services vendors be reassessed?

OCC and FDIC guidance expects ongoing monitoring proportionate to risk. Tier 1 (critical) vendors: continuous automated monitoring plus annual formal reassessment. Tier 2: annual reassessment. Tier 3: every 2–3 years. Any vendor should be reassessed after a significant incident, ownership change, or material scope expansion.

What contract provisions does OCC require for third-party vendors?

OCC-required contract provisions include: scope of arrangement and performance standards; security and confidentiality of information; audit rights; business continuity and disaster recovery; incident notification obligations; ownership and control of data; subcontracting and fourth-party oversight; regulatory access rights; and termination provisions with data return.

Vendor Management Platform for Financial Services: 2026 Guide

☰ Contents

Why Procurement Matters in Financial Services
Unique Financial Services Procurement Challenges
Must-Have Platform Features
Compliance & Regulatory Requirements
ROI & Business Case
Top Platforms for This Industry
Implementation Roadmap

Why Vendor Management Matters in Financial Services

Financial services organisations — banks, credit unions, broker-dealers, investment advisers, and insurance companies — face a convergence of regulatory pressure and operational risk that makes vendor management a tier-1 business function. The OCC's 2023 Third-Party Risk Management guidance, the FDIC's updated vendor risk framework, and the EU's DORA regulation (effective January 2025 for EU-connected US institutions) have all raised the bar for what constitutes an adequate third-party risk programme. Meanwhile, the operational dependency on technology vendors — cloud providers, core banking platforms, payment processors — means a vendor failure can create systemic business disruption in hours.

Unique Financial Services Procurement Challenges

OCC / FDIC / Fed Third-Party Risk Compliance

The 2023 interagency guidance from OCC, FDIC, and Federal Reserve establishes specific expectations for bank third-party risk programmes: board oversight, risk-based due diligence, written contracts with prescribed provisions, ongoing monitoring, and termination planning. Examiners now review third-party risk programme adequacy as a standard examination component. A VMP must generate the documentation that satisfies examiner expectations.

DORA Compliance for EU-Connected Institutions

The EU's Digital Operational Resilience Act (DORA), effective January 17, 2025, requires financial institutions with EU operations to maintain a comprehensive register of all ICT third-party service providers, conduct risk-based due diligence, include specific contractual provisions, and report significant ICT incidents. US financial institutions with EU branches, subsidiaries, or client relationships are in scope.

Concentration Risk Management

Financial regulators specifically require identification and management of concentration risk — over-dependence on a single vendor or vendor group that could create systemic disruption if that vendor fails or is impaired. OCC guidance requires boards to understand and approve material concentration risks. Your VMP must enable concentration risk analysis across your vendor base.

Critical Vendor Continuous Monitoring

Regulators expect ongoing monitoring of critical vendors — not just periodic assessment. This includes: continuous financial health monitoring, real-time adverse media monitoring, sanction re-screening, cyber risk score tracking, and incident notification tracking. Manual monitoring programmes cannot meet this expectation at scale.

Must-Have VMP Features for Financial Services

Feature	Why It Matters in Financial Services	Priority
OCC/FDIC Risk Framework	Regulatory examiners review programme adequacy; non-compliance = MRA or MOU	Critical
DORA ICT Register	EU-connected institutions must maintain a structured ICT vendor register	Critical (EU exposure)
Concentration Risk Analysis	Board must understand and approve material concentration risks	Critical
Continuous Monitoring	Ongoing monitoring expected for critical vendors; spot-check not sufficient	Critical
Contract Clause Tracking	OCC prescribes specific contract provisions; tracking their inclusion is required	Critical
Exam Evidence Export	Examination-ready documentation package must be producible on short notice	Critical
Audit Rights Workflow	Right to audit vendors is a regulatory requirement; VMP should manage audit schedule	High

🚀 Free Executive Demo

See Procurement VMS Built for Financial Services

Join US procurement leaders who replaced manual processes with intelligent automation. Live in 4–8 weeks.

Request Your Executive Demo → Calculate Your ROI

🔒 SOC 2 Type II ⚡ Live in 4–8 Weeks 🇺🇸 US-Based Support

Compliance & Regulatory Requirements

› OCC Third-Party Risk Guidance (2023) — board oversight; risk-based due diligence; written contracts with prescribed provisions; ongoing monitoring; termination planning
› FDIC Vendor Risk Guidance — consistent with OCC; emphasises concentration risk identification and management
› Federal Reserve SR 13-19 — guidance for state member banks on third-party relationships
› DORA (EU — effective Jan 2025) — ICT vendor register; risk-based due diligence; contractual requirements; incident reporting for EU-connected institutions
› FINRA Rules — broker-dealers must have supervisory procedures covering third-party vendor relationships
› CCPA / CPRA — data processing agreements for vendors handling California consumer financial data
› GLBA Safeguards Rule (2023 updates) — expanded vendor oversight requirements for financial institutions subject to GLBA

⚖️ Compliance as a Competitive Advantage

In Financial Services, vendor compliance documentation is not just risk management — it is increasingly a customer, investor, and regulator expectation. Organisations with automated compliance tracking demonstrate procurement maturity that manual programmes cannot match.

ROI & Business Case for Financial Services

$35M+

Average OCC enforcement action related to third-party risk failures

€10M

Maximum DORA penalty for non-compliance

68%

Banks reporting third-party as top operational risk concern

4 days

SEC disclosure deadline for material cyber incidents

Top VMP Platforms for Financial Services

Platform	Industry Fit	Key Strength	Deployment
Procurement VMS	US community and regional banks, credit unions	Rapid deployment; OCC-aligned risk framework	4–8 weeks
Aravo	Large financial institutions	Deepest regulatory compliance workflow	4–9 months
ProcessUnity	Banks, insurance, asset management	TPRM specialist; examination-ready reporting	3–6 months
OneTrust Third-Party	Privacy-heavy financial institutions	Privacy + vendor risk in one platform	3–6 months
SAP Ariba	SAP-ecosystem large banks	Native SAP integration; sourcing depth	6–18 months

Implementation Roadmap

Week 1–2: Regulatory baseline — map your specific regulatory obligations (OCC, FDIC, DORA, FINRA) and identify gaps against current programme
Week 3–4: Critical vendor identification — identify all Tier 1 (critical) vendors; assess concentration risk; document for board review
Week 5–6: Configure risk framework — build questionnaires aligned to OCC/FDIC expectations; configure concentration risk analysis
Week 7–8: Contract clause audit — review existing critical vendor contracts for required provisions; flag gaps for legal remediation
Week 9–10: Continuous monitoring activation — configure automated financial health, adverse media, and sanctions re-screening
Week 11–12: Board reporting — build executive and board dashboards; test examination evidence export; go-live

Related Resources

→ VMP for Healthcare → VMP for Manufacturing → Vendor Risk Management Guide → TPRM Software Guide → Vendor Compliance Management → What Is a Vendor Management Platform?