Third-party risk intelligence is the sourced, regularly refreshed information a bank or credit union holds about each vendor and partner and is used to decide whether a relationship’s risk has changed.
What follows sets its scope, the six steps that produce it, a table from signal to action, and what the agencies expect from ongoing monitoring.
What Third-Party Risk Intelligence Covers
It draws on seven kinds of signal:
- Legal identity
- Sanctions and federal debarment lists
- Enforcement actions by regulators
- Financial condition, including insolvency filings
- Cyber incidents and data breaches
- Ownership and key-personnel changes
- Subcontractors and shared providers
Third-party risk management (TPRM) is the program around those signals. The 2023 Interagency Guidance on Third-Party Relationships describes its life cycle as:
- Planning
- Due diligence and third-party selection
- Contract negotiation
- Ongoing monitoring
- Termination
A security rating is one input, and the organization makes the risk decision. The 2023 guidance applies to banks supervised by the Federal Reserve, FDIC and OCC, and the September 2026 proposal to replace it adds NCUA for the first time.
How Third-Party Risk Intelligence Works in Six Steps
Each step produces part of the record an examiner reads.
1. Resolve the legal entity
Match the vendor’s name or web domain to the registered legal entity, and flag ambiguous matches for a person to confirm.
2. Set criticality and data access
Record what the relationship supports and which customer data the third party can reach; the institution’s risk rating sets how deep and how frequent monitoring goes.
3. Screen and gather sourced intelligence
Run sanctions, debarment, enforcement and insolvency checks, and keep the source and retrieval date beside every finding.
4. Compare against contracts and controls
Check findings against contract terms, service commitments and the institution’s own controls, and log the gaps.
5. Monitor for material change
Use third-party risk monitoring to refresh the profile and route each material change to an analyst as a review task.
6. Record the decision
Keep the analyst’s conclusion, the rationale and any documented limits of the evidence.
Software, including AI, can assemble and refresh these profiles across a vendor inventory, while approving a relationship, requiring remediation or exiting stays with the institution’s staff.
From Intelligence Signal to Action
Each signal maps to a monitoring factor in the 2023 interagency guidance, and the response is a decision the institution makes and records.
| Signal | Monitoring factor it informs | Response the institution decides |
|---|---|---|
| Sanctions or federal debarment match | Compliance with applicable laws and regulations | Confirm the match with the BSA/OFAC officer; suspend, restrict or continue, with rationale |
| Regulatory enforcement action | Legal compliance and performance against the contract | Compare the action with the services provided; decide whether remediation terms are needed |
| Insolvency filing or weakening financial condition | Changes in financial condition | Review contingency and exit plans and whether a replacement provider exists |
| Cyber incident or data breach | Incident response; confidentiality, availability and integrity of data | Request the incident report; assess customer data exposure and notification duties |
| Ownership or key-personnel change | Changes in business strategy, agreements and key personnel | Repeat due diligence on new owners; check change-of-control terms |
| Subcontractor or shared-provider dependency | Reliance on, exposure to and location of subcontractors | Map fourth-party risk; report single-provider dependency to the board |
The institution sets thresholds, owners and response times in its own policy.
What the Guidance Expects from Ongoing Monitoring
Under the 2023 interagency guidance, ongoing monitoring lets a banking organization confirm the quality and sustainability of a third party’s controls, escalate significant issues and respond to them when identified.
Monitoring should be commensurate with the level of risk and complexity of the relationship, and more comprehensive or frequent monitoring is appropriate for higher-risk activities. The factors to consider include:
- Changes in financial condition
- Key personnel and subcontractors
- Response to incidents
- External factors such as changing laws and economic conditions
The documentation list includes due diligence results, risk and performance reports, reports of service disruptions or security breaches, and periodic board reporting on dependency on a single provider for multiple activities.
The September 2026 proposal, issued by the Federal Reserve, FDIC, NCUA and OCC on 11 September 2026, keeps monitoring scaled to risk: “The frequency and depth of monitoring should reflect the risk, complexity, and nature of the relationship.” The proposal is not final as of publishing this article.
Frequently Asked Questions
How Is Third-Party Risk Intelligence Different from TPRM?
TPRM is the program, and intelligence is one of its inputs. The program sets ownership, contract terms, escalation and board reporting; intelligence supplies the dated, sourced facts that due diligence and ongoing monitoring rely on between scheduled reviews. The program then decides what each fact means for the relationship.
Can a Bank Use Public Information in Third-Party Due Diligence?
Yes, as a supplement. The 2023 guidance allows banking organizations to use industry utilities or consortiums to supplement due diligence, and the September 2026 proposal names public sources, peer feedback and outside expertise among the supplemental information that can support a due diligence decision. The bank remains responsible for the conclusion and for documenting the evidence behind it.
Does Third-Party Risk Intelligence Cover Fourth Parties?
Yes, through the primary third party. The 2023 guidance lists reliance on, exposure to and location of subcontractors as a monitoring factor, and its inventory includes related subcontractors as appropriate to the risk. The September 2026 proposal keeps the bank responsible for compliance whatever subcontractors a third party uses, with oversight running through the primary third party.
The Predict360 Enterprise Risk Management Software ensures managers have complete visibility of enterprise risk on a single dashboard.
Request Demo- Cloud-Based
- Risk Repository
- Assess Risks
- Real-time Monitoring