Vendor risk tiering at banks and credit unions works by scoring each third-party relationship on inherent risk before controls, testing whether it supports a critical activity, and assigning a tier that sets due diligence depth, required contract terms, monitoring frequency and board reporting.
This article sets out which relationships a tiering model covers, a four-step scoring method, a tier-to-oversight decision table, re-tiering triggers, what examiners test, and how Predict360 applies the method.
Which Third Parties a Tiering Model Covers
The Federal Reserve, FDIC and OCC finalized the Interagency Guidance on Third-Party Relationships on June 6, 2023. It reaches any business arrangement with another entity, by contract or otherwise, including one with no contract or remuneration. The inventory being tiered therefore runs wider than the accounts-payable vendor list.
Because “not all relationships present the same level of risk,” the guidance offers a criticality or risk level per relationship as an illustrative practice and leaves the tiering method to each institution. Credit unions work from NCUA Letter to Credit Unions 07-CU-13 (December 2007), which ties planning, due diligence and controls to the credit union’s risk profile and the type of vendor relationship. Concentration limits and thresholds belong to the risk appetite framework, outside the tiering model.
Scoring Inherent Risk and Criticality
A reproducible vendor risk rating comes from four recorded steps:
- Score inherent risk
Rate six factors on the scale set in the institution’s third-party risk policy, ignoring the third party’s controls.
- Apply the critical-activities test
Under the 2023 guidance, an activity is critical when third-party failure could cause significant risk, significant customer impacts, or a significant impact on the bank’s financial condition or operations.
- Convert the score to a tier
The score band for each tier is set and approved in the institution’s policy; the 2023 guidance prescribes none.
- Record the rationale and approver
This is so the next reviewer can reproduce the tier.
A September 11, 2026 interagency proposal, joined by NCUA, would replace critical activities with an assessment of the magnitude and likelihood of harm. Comments on the proposal close November 16, 2026, and the agencies have not said when a final version will be issued.
Tier-to-Oversight Decision Table
The decision table below maps each vendor risk tiering outcome to the vendor due diligence, contract and monitoring package it triggers.
| Tier | Assigned when | Due diligence | Contract terms | Monitoring |
|---|---|---|---|---|
| 1 Critical | Supports a critical activity | Financial statements, SOC 1 or SOC 2 report, continuity test results, subcontractor list, site or virtual visit | Audit rights, performance standards, subcontractor consent, termination and transition support, data return | Continuous alerts plus the most frequent full review of any tier |
| 2 High | Highest score band, no critical activity | Tier 3 package plus control evidence for each factor rated at the top of the scale | Audit rights, incident notification, subcontractor notice | Periodic review, more frequent than Tier 3 |
| 3 Moderate | Middle score band | Questionnaire, financial and sanctions screening | Standard terms with confidentiality and incident notification | Periodic review and at renewal |
| 4 Low | Lowest score band | Sanctions and registration check | Standard form | At renewal or on a trigger event |
The 2023 guidance prescribes no review frequency, only that ongoing monitoring be more comprehensive or frequent for higher-risk and critical activities, so each institution sets review frequencies in its own policy.
Events That Trigger Re-Tiering
A tier holds until the facts behind it change, and the 2023 guidance’s monitoring factors double as re-tiering triggers:
- Changes in the third party’s business strategy or agreements with other entities
- Changes in financial condition or insurance coverage
- Changes in key personnel involved in the activity
- Changes in reliance on, or use of, subcontractors
Internal events belong on the same list: a new service, expanded access to customer data, a security incident, regulatory action against the third party, and contract renewal. Re-tiering runs in both directions, and a move down needs the same documented rationale as a move up.
What Examiners Test in a Tiering Model
Under the 2023 guidance, examiners assess management’s ability to oversee third-party relationships, perform or review transaction testing, and review remediation plans, particularly for deficiencies in critical activities. The guidance’s documentation examples include an inventory that flags higher-risk and critical activities, risk assessments, due diligence results, executed contracts, and board reporting on dependency on a single provider for multiple activities.
For a tiering model, that means file sampling. A sampled Tier 1 file should hold Tier 1 diligence, a contract with the Tier 1 terms and a recorded rationale. A relationship re-tiered after an incident needs the event, the new score and the approver on file. The September 2026 proposal would have examiners give due consideration to an institution’s reasonable judgment in its risk assessments; the 2023 guidance stays in effect until a final version is adopted.
Vendor Risk Tiering in Predict360
Predict360 categorizes the type and level of risk for each vendor or third party and routes information collection, review and approval through configurable workflows.
Our Third-Party Risk Intelligence Agent sets relationship criticality and data access so the assessment reflects how the institution uses the vendor, monitors material changes, routes review tasks, and tracks exit obligations, data return and access removal, with final decisions left to people.
Frequently Asked Questions
How many tiers should a vendor risk tiering model use?
The 2023 Interagency Guidance sets no number of tiers and expects oversight to be commensurate with risk. A model needs as many tiers as it has distinct oversight packages.
Is a critical vendor always a high-risk vendor?
Under the 2023 guidance, a relationship that supports a critical activity receives the most comprehensive oversight, whatever its other scores. The September 2026 interagency proposal would drop the critical-activities label.
Why is inherent risk critical to third-party assessments?
Inherent risk measures a relationship’s exposure before any controls, which tells the bank how much diligence it needs to verify those controls. Tiering on residual risk would let a third party’s unverified claims lower its own level of review. Residual risk, measured after diligence, informs whether the relationship fits the institution’s risk appetite and how closely it is monitored.
The Predict360 Enterprise Risk Management Software ensures managers have complete visibility of enterprise risk on a single dashboard.
Request Demo- Cloud-Based
- Risk Repository
- Assess Risks
- Real-time Monitoring