Guide · International body
Principles for the sound management of third-party risk
Banks depend more and more on third parties; Basel moves from the concept of outsourcing to all relationships with providers.
- Organization
- Basel Committee on Banking Supervision (BCBS)
- Document date
- December 2025
- Type
- Guide
- Language
- English
- Scope
- International
- Length
- 22 pages
What it contains
Banks have long relied on external service providers (TPSPs) to access specialised expertise, reduce costs, gain scale and efficiency, improve operational resilience and focus on their core activity. The 2005 Joint Forum paper focused on outsourcing, a subset of those relationships; with digitalisation, dependence on providers for services that were not previously undertaken has grown and requires moving from the concept of outsourcing to that of all arrangements with third parties.
The Committee considers that managing arrangements with providers, the supply chain (nth parties), concentration risk and other resulting risks well improves banks’ ability to withstand, adapt to and recover from operational disruption. The twelve principles follow the life cycle of the arrangement: governance, risk management and strategy; risk assessment; due diligence; contracting; onboarding and ongoing monitoring; and termination. Principles 1 to 9 guide banks and principles 10 to 12 guide prudential supervisors.
The text, approved after a public consultation published in 2024, replaces the 2005 Joint Forum paper for the banking sector, builds on the principles of operational resilience and of operational risk management and seeks a balance between improving practices and setting a common baseline, with enough flexibility given the rapid evolution of this area. It is a principles-based approach, complementary to the operational risk framework.
Why it matters for risk management
It is a basis for comparison for institutions’ provider and outsourcing policies, and for supervisory work on critical dependencies. Local application depends on Dominican regulation and on proportionality according to each institution’s size and complexity.
Summary prepared by the Dominican Republic Risk Management Club from a reading of the original document, with the source verified on 7 October 2026. It does not replace reading the official text and is not advice.
Connect with our networks