Your fourth party is the one that takes you down.
Most third-party programmes are questionnaire archives. Supervisors have stopped asking whether the questionnaire was returned and started asking whether the institution could keep operating without the provider. That is a resilience question, so it belongs in the same operating layer as everything else.
The workbench
Providers in register
6
Registered at onboarding with service, data classes and jurisdictions.
Critical without a tested exit
2
Substitutability asserted rather than evidenced.
Shared fourth-party clusters
1
Two or more providers resolving to the same dependency.
Reading
Core payments processor
Not substitutable inside a plausible disruption window
- Business service
- Domestic and cross-border payments
- Tested time to replace
- 52 weeks
- Exit plan tested
- No
- Attestation age
- 14 months
What drives the reading
- Criticality critical against Domestic and cross-border payments.
- Tested time to replace is 52 weeks — beyond a plausible disruption window.
- Exit plan documented but not tested; substitutability is asserted rather than evidenced.
- Assurance attestation is 14 months old and outside the supervisory window.
- 3 open finding(s) against this relationship.
- 2 dependency at fourth party or beyond.
Dependency chain
- Tier 4 · Hyperscale region (single) — Processing concentrated in one region with no tested failover.
- Tier 4 · Sanctions screening engine — Screening supplied by a sub-processor under the same contract.
Concentration, read across the register
A register that lists providers one at a time cannot see this. The exposure is where separate relationships resolve to the same dependency.
- Hyperscale regionCore payments processor · Enterprise identity provider
Figures shown are computed against a demonstration register. Client portfolios are assessed inside the engagement environment against that institution’s own providers and evidence.
The lifecycle
Intake
Provider registered with service, data classes, jurisdictions and downstream dependencies captured at onboarding — not at renewal.
Criticality
Assessed against important business services, not spend. A low-cost provider inside a payment path is critical.
Substitutability
Time-to-replace, tested exit plan, and whether a credible alternative exists at institutional scale.
Concentration
Fourth-party mapping surfaces the cloud region, the model provider and the settlement rail three vendors deep.
Continuous monitoring
Provider posture, incident history and attestation currency tracked between reviews, not once a year.
Evidence
Contract clauses, audit reports, penetration test summaries and AI attestations bound to the control they satisfy.
Obligations it evidences
Register of information, contractual requirements, critical-provider designation and exit strategies.
Third-party risk lifecycle, criticality assessment and concentration reporting.
Model and AI provider governance where the model is supplied rather than built.
Supply-chain security measures for essential and important entities.
Third-party relationship lifecycle expectations for US banking organisations.
Obligations along the AI value chain where a provider becomes a deployer.