Know Your Vendor: The Risky Business of Third-Party Relationships
Dan discusses a recent feature looking at how firms deal with vendor risk.

I spent last week discussing the potential demise of the entire vendor ecosystem, so I feel it's only fair to stay in that mindset by highlighting another weakness of the space.
This week we ran a story from our sister publication, Risk.net, which details how operational risk experts go about dealing with third-party risk. The story, entitled "Grappling with Vendor Risk Rules", which was written by my colleague Steve Marlin, was a fascinating look into an issue that every firm in financial services deals with to some degree.
No Easy Task
Vendor risk management is truly a monumental task. Take this excerpt from the story as an example:
For instance, one US bank has 250 full-time equivalent employees devoted to third-party risk management. The team oversees around 2,000 traditional vendors and a further 32,000 non-traditional vendors. The latter category includes about 10,000 auto dealerships through which the bank offers indirect lending services and 8,000 commercial and residential appraisers that support its mortgage business.
The article brings up an interesting point when discussing regulations around third-party risk management. Many have questioned whether regulatory bodies, such as the US Federal Reserve Board and the Office of the Comptroller of the Currency (OCC), have gone too far.
How Far?
Fourth-party risk in particular seems a bit overboard. If my firm hires a vendor who then hires another vendor to help provide the service/product I purchased, there is only so much I can do to protect myself. Sure, I can make sure the vendor I'm communicating with has the necessary governance in place, but that only goes so far.
At the end of the day, how overbearing can a firm be before the vendor pushes back. Granted, a firm is certainly entitled to ask any questions it has about subcontractors a vendor might be using, but where do you draw the line.
In the story, Bob Kellner, a senior vice president responsible for operational risk management and corporate control programs at US Bank, says his firm has an inventory of subcontractors their vendors use. The list isn't necessarily all-encompassing, focusing only on ones the bank deems "strategic."
That's all well and good, but lest we forget Target was breached through its HVAC vendor. Will firms really think to consider these types of subcontractors "strategic"?
The story is a good look at the overall space and definitely worth a read. So do yourself a favor and check it out here.
This week on the Waters Wavelength podcast ─ Episode 10: Markit-IHS Merger, FIA Boca
If you haven't already, subscribe to the podcast on iTunes here. Also, check out our SoundCloud account here.
Food for Thought
- If you're interested in my feature on open source, it should go live next week. To get a preview of what's to come, check out this audit I did of open-source projects firms are currently working on.
- Speaking of analysis pieces, I looked at treasury management and why the space is prime for electronification. Read more about it here.
- We are now under a month away from North American Trading Architecture Summit 2016, which is held in New York. For more info on the event, click here.
- One last note: This Sunday is WRESTLEMANIA! (Yes, I still watch wrestling.) The main event is a Hell in a Cell between the Undertaker (yes, he still wrestles) and Shane McMahon (yes, Vince's son). For those of you unaware of the history of these types of matches, I leave you with a seminal moment in my childhood: Long Island's own Mankind getting thrown off the top of Hell in a Cell by the Undertaker.
Only users who have a paid subscription or are part of a corporate subscription are able to print or copy content.
To access these options, along with all other subscription benefits, please contact info@waterstechnology.com or view our subscription options here: http://subscriptions.waterstechnology.com/subscribe
You are currently unable to print this content. Please contact info@waterstechnology.com to find out more.
You are currently unable to copy this content. Please contact info@waterstechnology.com to find out more.
Copyright Infopro Digital Limited. All rights reserved.
As outlined in our terms and conditions, https://www.infopro-digital.com/terms-and-conditions/subscriptions/ (point 2.4), printing is limited to a single copy.
If you would like to purchase additional rights please email info@waterstechnology.com
Copyright Infopro Digital Limited. All rights reserved.
You may share this content using our article tools. As outlined in our terms and conditions, https://www.infopro-digital.com/terms-and-conditions/subscriptions/ (clause 2.4), an Authorised User may only make one copy of the materials for their own personal use. You must also comply with the restrictions in clause 2.5.
If you would like to purchase additional rights please email info@waterstechnology.com
More on Regulation
Experts say HKEX’s plan for T+1 in 2025 is ‘sensible’
The exchange will continue providing core post-trade processing through CCASS but will engage with market participants on the service’s future as HKEX rolls out new OCP features.
No, no, no, and no: Overnight trading fails in SIP votes
The CTA and UTP operating committees voted yesterday on proposals from US exchanges to expand their trading hours and could not reach unanimous consensus.
Big xyt exploring bid to provide EU equities CT
So far, only one group, a consortium of the major European exchanges, has formally kept its hat in the ring to provide Europe’s consolidated tape for equities.
Jump Trading CIO: 24/7 trading ‘inevitable’
Execs from Jump, JP Morgan, Goldman Sachs, and the DTCC say round-the-clock trading—whether five or seven days a week—is the future, but tech and data hurdles still exist.
Pisces season: Platform providers feed UK plan for private stock market
Several companies in the US and the UK are considering participating in a UK program to build a private stock market composed of separate trading platforms.
How to navigate regional nuances that complicate T+1 in Europe
European and UK firms face unique challenges in moving to T+1 settlement, writes Broadridge’s Carl Bennett, and they will need to follow a series of steps to ensure successful adoption by 2027.
Nasdaq leads push to reform options regulatory fee
A proposed rule change would pare costs for traders, raise them for banks, and defund smaller venues.
The CAT declawed as Citadel’s case reaches end game
The SEC reduced the CAT’s capacity to collect information on investors, in a move that will have knock-on effects for its ongoing funding model case with Citadel.