Challenges for third-party risk management in the financial sector in the era of cloud services and artificial intelligence

Fourth Annual Risk Conference 2026

What it is about

Enrique Gómez Lobera, Global Head of Third-Party Risk at Grupo BBVA, presented at the Fourth Annual Risk Conference (September 16, 2026) how third-party risk is managed as part of the operational resilience of a global bank.

The 38 slides start from the question of whether an institution can disappear because a critical supplier stops serving it, review the Basel operational resilience principles and the European regulatory path to DORA, and describe the BBVA third-party management framework: life cycle, criticality, single register, contracts, exit strategies and governance across three lines. They end with the risks of cloud services and generative artificial intelligence and with six challenges: knowing, prioritizing, coordinating, governing, subcontracting and excessive dependency.

Objectives

Place third-party management within digital operational resilience and European regulation.
Describe a third-party management framework based on criticality, traceability and control across the whole life cycle.
Identify the risks of cloud concentration and of third-party use of generative AI, and the main challenges.

Key takeaways

The DORA regulation entered into force on January 13, 2023 and became enforceable on January 17, 2025; for BBVA it was an opportunity to build a comprehensive third-party management model.
The third-party life cycle has five phases: identification, formalization, monitoring, offboarding and governance.
The framework prioritizes by criticality and risk: a single register of services, third parties, processes and evidence, contracts aligned with criticality, audit rights and realistic exit strategies.
In cloud, the risk vectors are concentration in a few providers and the difficulty of migrating; in generative AI, model risk, opacity, data leakage, unauthorized use and opaque subcontracting.
Responsibility is not delegated to the third party: it stays with the institution, with the board setting the appetite and three lines of defense with distinct roles.