A growing share of what makes a modern bank work now sits outside the bank itself. Cloud platforms host critical workloads, specialist providers process payments and protect digital channels, software vendors support core operations, and external AI models are beginning to influence everything from fraud detection to customer service. This ecosystem has allowed banks to innovate faster without building every capability internally, but it has also created a regulatory problem that is becoming harder to ignore. A contract can transfer the delivery of a service, but it cannot transfer the bank’s responsibility for what happens when that service fails. As technology dependencies become deeper and more concentrated, regulators are increasingly treating third-party risk not as a procurement issue, but as a fundamental question of banking resilience and accountability.
Outsourcing Has Become Something Much Bigger
Traditional outsourcing was relatively easy to identify. A bank contracted another company to perform a defined function, established service-level agreements and periodically reviewed whether the supplier was meeting its obligations. Today’s technology environment is considerably more complicated because a bank can depend on hundreds of external platforms, applications, data services and infrastructure providers without necessarily describing every relationship as outsourcing.
A customer-facing banking application, for example, may run on public cloud infrastructure, rely on an external identity platform, connect to specialist fraud technology and use APIs provided by several other companies. Increasingly, AI adds another layer through external models, data and computing infrastructure. Each individual component may appear manageable, but collectively they create an interconnected technology supply chain on which the bank’s ability to operate increasingly depends.
This is why regulators are broadening their focus from conventional outsourcing to third-party risk. The Basel Committee on Banking Supervision’s principles for managing third-party risk recognise that financial institutions now rely on external providers across a much wider range of services and that these dependencies can create operational and systemic vulnerabilities.
For banks, the important question is therefore changing. It is no longer simply which functions have been outsourced, but which external dependencies could prevent the institution from delivering a critical service if they became unavailable.
Regulators Are Following the Technology Supply Chain
Operational resilience regulation is making that shift increasingly visible. In the UAE, the Central Bank’s Operational Risk Management Regulation requires licensed financial institutions to maintain a board-approved strategy for identifying, assessing, monitoring and managing third-party risk as part of their wider operational risk framework.
The regulatory expectation goes considerably further than selecting reputable suppliers and negotiating strong contracts. Banks are expected to understand the risks associated with third-party arrangements, conduct appropriate due diligence and maintain sufficient internal expertise to oversee outsourced activities. Providers supporting critical operations also need to be considered within the institution’s resilience planning.
That changes the nature of technology governance because a bank must increasingly be able to answer what happens after a supplier fails, rather than simply demonstrating that the supplier was properly selected. Management needs to know whether a critical service can continue, how quickly another provider could replace it, where essential data is held, what other systems depend on the affected service and whether the vendor itself relies on infrastructure that creates another point of failure.
These questions once belonged mainly to technology and procurement teams. They are increasingly becoming questions for risk functions, regulators and boards.
The Bank Remains Accountable
The regulatory principle behind this shift is straightforward: using an external provider does not diminish the responsibility of the regulated institution. That principle has existed for years, but its implications are becoming more significant as third-party technology moves closer to critical banking operations and decision-making.
AI illustrates the problem particularly well. A bank might use an externally developed model to identify suspicious transactions, detect fraud, assist customer-service teams or support risk decisions. The institution may not have built the model or control the infrastructure on which it operates, yet customers experience the resulting decision as one made by their bank. If the model produces discriminatory outcomes, exposes confidential information or repeatedly makes incorrect decisions, responsibility cannot simply be redirected towards the technology vendor.
This is becoming particularly important as banks move beyond AI assistants towards systems capable of taking actions. The more autonomy banks give external technology, the more important it becomes to establish ownership, human oversight, monitoring and intervention mechanisms. Banks Are Starting to Demand Explainable AI Procurement Clauses for precisely this reason: technology procurement increasingly needs to incorporate questions that previously belonged primarily to model risk and compliance teams.
The direction is clear. Banks may buy increasingly sophisticated intelligence from external providers, but regulators will still expect the institution to understand how that intelligence is being used, what risks it creates and who remains accountable when something goes wrong.
The Vendor Behind the Vendor Matters Too
One of the hardest problems in modern third-party risk management is that the bank’s direct supplier may itself depend on several other technology companies. A software platform could operate on a hyperscale cloud provider, use another company for authentication, rely on external databases and incorporate AI models supplied by yet another provider. Those companies can have dependencies of their own.
The result is a chain of fourth- and fifth-party relationships that can extend far beyond the bank’s direct contractual visibility. An institution may therefore conduct extensive due diligence on its immediate supplier while remaining exposed to infrastructure several layers further down the technology chain.
This creates a different kind of concentration risk. Ten banks may appear to use ten different software providers, but if those providers ultimately depend on the same cloud infrastructure or foundational technology, the banking system may be considerably less diversified than it appears.
That concern becomes especially important as cloud and AI adoption accelerate. The Biggest Technology Risk Facing Banks Isn’t Legacy Systems. It’s Vendor Concentration. A failure affecting widely shared infrastructure could potentially disrupt multiple institutions simultaneously, turning what appears to be an individual vendor problem into a broader operational resilience issue.
For banks, mapping critical technology relationships may therefore need to extend beyond knowing who their suppliers are. Institutions increasingly need to understand the architecture of dependency underneath the services on which they rely.
Exit Strategy Is Becoming Part of Technology Strategy
Banks naturally spend considerable time evaluating whether a technology provider can deliver what they need. Increasingly, regulators also want them to consider what happens if they need to leave.
That is more difficult than it sounds. A platform can become deeply embedded across data, workflows, customer journeys and internal systems, making replacement technically difficult and commercially expensive. Proprietary architecture can complicate migration, while years of integration work may mean that switching providers becomes almost equivalent to rebuilding the capability.
A credible exit plan therefore cannot simply be a paragraph in a vendor-management document. Banks need to understand whether data can be moved, whether alternative providers genuinely exist, how long migration would take and whether the institution retains enough internal knowledge to operate during the transition. For critical services, the ability to leave a provider may ultimately become almost as important as the capability that attracted the bank to the provider in the first place.
This introduces a different calculation into technology procurement. The cheapest or most advanced platform may not represent the lowest long-term risk if adopting it creates a dependency that is extremely difficult to reverse. Banks may increasingly have to evaluate technology according to both its capability and its substitutability.
Operational Resilience Is Changing Procurement
Europe’s Digital Operational Resilience Act has already pushed ICT third-party risk much further into the regulatory spotlight, while banking supervisors are paying closer attention to dependencies on major technology and cloud providers. Similar thinking is appearing across other jurisdictions as financial authorities recognise that operational resilience cannot be assessed solely by looking at systems physically operated by banks.
This means technology procurement can no longer sit comfortably at the edge of enterprise risk management. Decisions involving critical cloud platforms, AI providers, payment infrastructure or cybersecurity services can have consequences for business continuity, regulatory compliance, data governance and ultimately the institution’s ability to serve customers.
The procurement conversation therefore needs more voices around the table. Technology teams can assess capability and architecture, but risk functions need to understand concentration and operational exposure, compliance teams need visibility into regulatory implications, business continuity teams need credible recovery scenarios, and senior management needs to understand where critical dependencies are accumulating.
This is part of a broader change in how banks think about resilience. The Future of Banking Regulation Won’t Be More Rules. It Will Be More Data. Regulators increasingly want institutions to demonstrate that controls work in practice and that management understands where risks actually sit, rather than simply producing policies showing that those risks have been considered.
Outsourcing Cannot Mean Losing the Capability to Understand
Perhaps the most difficult balance for banks will be deciding how much expertise they can safely allow to leave the organisation. External specialists can often deliver technology faster, more efficiently and at greater scale than an internal team, which is precisely why outsourcing remains attractive. Yet the more critical the technology becomes, the more dangerous it is for the bank to lose the ability to understand or challenge it.
A bank that relies heavily on an external platform but no longer has sufficient internal knowledge to assess how it works may technically retain accountability while losing much of the capability required to exercise that accountability. Oversight then risks becoming contractual rather than operational, with the institution relying on assurances from the same provider it is supposed to supervise.
The strongest technology operating models may therefore not be those that build everything internally or those that outsource most aggressively. They are likely to be the ones that distinguish carefully between capabilities that can be purchased and knowledge that must remain inside the bank. Institutions need enough internal expertise to understand critical architecture, challenge providers, assess emerging risks and take control when circumstances change.
As cloud, AI and specialist banking platforms continue to expand, this distinction will become increasingly important. The technology ecosystem surrounding banks will continue to grow because the commercial and operational benefits are too significant to ignore. What will not disappear is the regulatory boundary around the institution itself.
When a digital banking service becomes unavailable, customers still hold their bank responsible. When an external AI system makes a problematic decision, regulators will still ask the bank how it was governed. When a critical provider suffers an outage, the board will still be expected to explain why the institution was not adequately prepared.
The technology can sit somewhere else. The accountability cannot.
What it means for the industry
- Third-party technology risk is becoming a core banking risk, requiring involvement from boards, risk, compliance and business continuity teams rather than remaining primarily a procurement responsibility.
- Technology selection will increasingly include resilience and substitutability, with banks considering not only what a provider can deliver but how realistically it could be replaced.
- AI will make third-party governance more complex as externally supplied technology moves from supporting banking processes towards influencing decisions and executing actions.
- Banks will need greater visibility into fourth- and fifth-party dependencies, particularly where apparently different providers rely on the same underlying cloud, data or technology infrastructure.
- Internal expertise will become more valuable, not less, as outsourcing expands, because banks must retain enough capability to understand, challenge and, when necessary, replace critical external services.
- Regulatory accountability will remain with the bank, regardless of how much of the technology behind a banking service is supplied by third parties.
