Introduction
Every third-party relationship imports risk into a regulated organization. For fintech, crypto, and banking companies, that principle carries direct enforcement weight — regulators across the US, UK, and EU hold financial institutions accountable for vendor failures as if those failures happened internally.
The consequences of weak vendor oversight aren't abstract. The Federal Reserve, FDIC, and OCC issued enforcement actions against Evolve Bank, Cross River Bank, and Blue Ridge Bank — all tied in part to inadequate third-party risk controls. The FCA and PRA fined Raphaels Bank £1.89 million for outsourcing failures. Regulators treat vendor failures as institutional failures — full stop.
For early-stage fintechs , the stakes compound. A weak vendor risk program doesn't just expose you to regulatory action — it can cost you a sponsor bank relationship before your product ever launches.
This guide covers what a vendor risk assessment is, what it must include, how to run one step by step, and where programs most commonly break down.
TL;DR
- A vendor risk assessment (VRA) identifies, scores, and documents the risks third-party vendors introduce into your organization.
- VRAs are mandatory for regulated financial services firms under FFIEC, FCA, DORA, EBA, and BSA/AML frameworks.
- A complete VRA covers compliance/regulatory risk, cybersecurity, financial stability, operational resilience, and fourth-party exposure.
- Execution moves from vendor inventory and inherent risk scoring through due diligence, tiering, mitigation, and ongoing monitoring.
- VRAs must be embedded in the vendor lifecycle — at onboarding, periodically thereafter, and triggered by incidents or material changes.
What Is a Vendor Risk Assessment?
A vendor risk assessment (VRA) is a structured process for identifying, analyzing, and documenting the risks a third-party relationship introduces to your organization's operations, data, regulatory standing, and finances. The output isn't just a list of concerns — it's a documented risk position and a plan to manage what you find.
Two concepts anchor every effective VRA:
- Inherent risk — the risk that exists before any controls are applied, based on the nature of the vendor's services and data access
- Residual risk — what remains after the vendor's own controls are accounted for
The mistake many compliance teams make is evaluating only certifications (SOC 2, ISO 27001) and treating them as proof of adequate controls. Certifications are evidence inputs. They still require scope review, exception review, and validation against your specific regulatory obligations.
Where VRAs Sit in the Third-Party Lifecycle
VRAs aren't a one-time event. They occur at three points:
- Initial due diligence — before contracting, to inform whether and how to engage the vendor
- Periodic reassessment — at intervals based on the vendor's risk tier
- Event-triggered reviews — following security incidents, regulatory actions, ownership changes, or material service modifications
Vendor due diligence and vendor risk assessment are related but distinct. Due diligence is the evidence-gathering phase: questionnaires, document review, certifications. The VRA is the broader process of interpreting that evidence against your risk appetite and regulatory obligations to produce a risk rating and a remediation plan.
Vendor Risk Categories to Assess
A complete VRA must address all of these domains:
- Cybersecurity and data security — access controls, encryption, patch management, incident response, breach history
- Compliance and regulatory risk — adherence to BSA/AML, GDPR/CCPA, PCI DSS, and sector-specific rules
- Financial stability — vendor solvency, ability to continue delivering services
- Operational and continuity risk — SLA track record, disaster recovery, recovery time objectives
- Reputational risk — prior enforcement actions, public incidents, media exposure
- Fourth-party concentration risk — sub-vendor dependencies, geographic clustering, infrastructure concentration
For regulated fintech and banking firms, compliance risk and cybersecurity risk are the highest-stakes categories. Both carry direct regulatory consequences and can affect sponsor bank relationships if left unmanaged.
Why Vendor Risk Assessment Is Critical for Fintech and Regulated Companies
The Regulatory Mandate
Regulators don't treat vendor failures as someone else's problem. The 2023 Interagency Guidance from the Federal Reserve, FDIC, and OCC states explicitly that a banking organization's use of third parties "does not diminish its responsibility" to comply with applicable laws and operate safely. The Federal Reserve's 2024 community bank guide repeats the same principle.
The regulatory frameworks requiring vendor oversight now span multiple jurisdictions:
| Framework | Applies To | Core Requirement |
|---|---|---|
| FFIEC IT Handbook | US banks, credit unions | Governance, due diligence, contracts, subcontractor oversight |
| OCC/Fed/FDIC Interagency Guidance (2023) | Banking organizations | Risk-based lifecycle: planning, diligence, monitoring, termination |
| FCA SYSC 8.1 | FCA-authorized firms | Avoid undue operational risk; don't impair regulator supervision |
| PRA SS2/21 | UK banks, insurers | Material outsourcing governance, registers, exit planning |
| DORA (EU) 2022/2554 | EU financial entities including crypto-asset service providers | ICT third-party risk (Articles 28, 30), critical provider oversight |
| EBA Outsourcing Guidelines | EU credit institutions, payment and e-money firms | Critical function registers, sub-outsourcing controls, audit rights |
| FinCEN/BSA | US financial institutions | Processor due diligence, monitoring, licensing checks |
None of these frameworks accept "I didn't know about the vendor's issue" as a defense. The enforcement record confirms it.
Enforcement Is Real
Three US enforcement actions illustrate the stakes:
- Evolve Bank & Trust (2024) — Federal Reserve cease-and-desist requiring improvements in risk management, BSA/AML controls, and consumer compliance connected to open-banking and fintech-partner activities
- Cross River Bank (2023) — FDIC consent order over fair-lending compliance failures tied to third-party lending activity
- Blue Ridge Bank (2023) — OCC consent order requiring a strengthened third-party risk management program with board oversight and periodic effectiveness reviews
In the UK, Raphaels Bank's £1.89 million fine came down to inadequate outsourcing governance, risk appetite statements that didn't address critical outsourcing tolerances, and business continuity plans that didn't account for third-party reliance. Not a data breach — governance failures.
The Early-Stage Fintech Signal
Those enforcement actions aren't just a bank problem. For seed-through-Series-B fintechs, the same scrutiny flows upstream. The July 2024 joint agency statement on bank-fintech deposit arrangements from the Federal Reserve, FDIC, and OCC warns that these arrangements create operational, compliance, and liquidity risks, and expects banks to conduct ongoing due diligence of their fintech partners.
That means your sponsor bank will be examined on its relationship with you. A well-documented VRA program doesn't just satisfy regulators — it signals organizational maturity to the bank conducting that review. The artifacts examiners look for include:
- Vendor inventory with complete coverage
- Critical-vendor tiering with documented rationale
- Evidence of ongoing monitoring and reassessment
- BSA/AML controls specific to vendor relationships
Companies with organized programs don't just pass those reviews. They accelerate them.
What Should a Vendor Risk Assessment Include?
What Should a Vendor Risk Assessment Include?
A thorough VRA covers four core risk domains. Each one surfaces a different category of exposure — and each one has specific documentation requirements that regulators expect to see.
Compliance and Regulatory Risk
Assess whether the vendor operates under — and actually complies with — the regulations applicable to your business. This includes:
- BSA/AML requirements and related transaction monitoring obligations
- GDPR/CCPA data protection rules, particularly for vendors handling customer data
- PCI DSS compliance for any vendor involved in payment processing
- DORA requirements for EU-facing operations (effective January 17, 2025)
Request certifications such as SOC 2 reports and ISO 27001, but don't accept them at face value. Review the scope, check for exceptions, and confirm remediation timelines. Ask directly about the vendor's regulatory history, including prior enforcement actions.
Cybersecurity and Data Security Controls
Vendors with access to sensitive customer data carry the highest security exposure. Examine:
- Access control and authentication standards
- Encryption at rest and in transit
- Vulnerability scanning and patch management cadence
- Incident response procedures and documented breach history
- Security testing — penetration testing frequency and scope
Financial Stability and Business Continuity
A vendor that becomes insolvent mid-engagement can directly disrupt your regulated operations. Review:
- Audited financial statements (for material vendors)
- Disaster recovery and business continuity plans
- Recovery time objectives (RTOs) and evidence of tested procedures
- Contractual provisions for service continuity during disruption
Fourth-Party and Concentration Risk
Financial stability matters, but sub-vendor exposure is where most VRAs have gaps. Regulators have noticed: according to UK regulators in PS16/24, third-party related incidents were the leading cause of operational disruptions reported to the FCA between 2022 and 2023.
Your VRA must identify:
- Which critical sub-vendors (fourth parties) your vendor relies on
- Whether those sub-vendors are concentrated in a single geography or cloud infrastructure provider
- Whether your organization has excessive dependence on a single vendor or a cluster using the same underlying provider
- Contract provisions giving you the right to approve or prohibit specific sub-contractors
DORA Article 30 requires contractual provisions governing sub-contracting when ICT services support critical or important functions. EU-regulated entities must treat this as a binding contractual obligation, full stop.
How to Conduct a Vendor Risk Assessment: A Step-by-Step Process
The most common failure in VRA programs is treating the assessment as a one-time onboarding checkbox. The steps below are designed as a repeatable, ongoing process.
Step 1 – Build and Maintain a Vendor Inventory
Start with a complete list of all active vendors, including shadow vendors — software or services used without formal procurement approval. Reconcile against accounts payable records to catch gaps. Categorize each vendor by:
- Type of service provided
- Level of data access (none, limited, full customer data)
- Regulatory touchpoints (payment processing, KYC/AML, core banking)
Step 2 – Define Risk Criteria and Tolerance Levels
Before scoring any vendor, document your risk appetite: what level of cybersecurity, compliance, and operational risk is acceptable by vendor tier and service type?
Risk criteria must align with applicable regulatory guidance — not just internal comfort levels. Relevant frameworks include FFIEC "critical activities" language (US), FCA outsourcing rules (UK), and DORA's "critical or important functions" standard (EU).
Step 3 – Gather Information and Complete Due Diligence
Send vendor questionnaires calibrated to risk level. A full security questionnaire for critical vendors; a lighter-touch review for low-risk relationships. Request:
- SOC 2 Type II reports (check scope and exceptions)
- ISO 27001 certificates (confirm currency and certification body)
- Audited financial statements for material relationships
- Incident response policies and breach history disclosure
- Business continuity and disaster recovery plans
Critical rule: questionnaire responses must be validated against actual evidence. A vendor checking "yes" to having a written information security policy doesn't confirm the policy is adequate or implemented.
Step 4 – Score, Tier, and Prioritize Vendors
Assign each vendor an inherent risk rating based on service type and data access, then a residual risk rating after reviewing their controls. Tier vendors to determine assessment depth and monitoring frequency:
| Tier | Examples | Typical Reassessment |
|---|---|---|
| Critical | Payment processors, core banking infrastructure, KYC/AML tooling | Annually (minimum) |
| High | Data processors with sensitive customer access, cloud infrastructure | Annually |
| Moderate | Business software with limited data access | Every 18–24 months |
| Low | Generic SaaS with no customer data access | Every 2–3 years |
Step 5 – Develop and Implement a Mitigation Plan
For vendors with identified gaps, document required remediation in the contract before signing. Options include:
- Requiring specific security improvements by a defined date
- Adding indemnification clauses for breach-related losses
- Limiting the scope of data access
- Adding audit rights or independent testing requirements
- Declining or exiting the vendor relationship in extreme cases
Step 6 – Establish Continuous Monitoring and Reassessment
Define reassessment intervals by risk tier (see table above). Beyond scheduled reviews, trigger immediate reassessment following:
- Any vendor-side security incident or confirmed data breach
- Regulatory action against the vendor
- Significant ownership change or acquisition
- Material service modification or new sub-contractor engagement
Verizon's 2025 DBIR found third-party involvement in 30% of all breaches — double the prior year's rate. Skipping continuous monitoring between formal reviews is how third-party incidents become your enforcement action.
Common Pitfalls and Best Practices
What Undermines VRA Programs
- Treating VRA as a one-time onboarding event — the most common failure, and the one regulators specifically call out
- Generic questionnaires not calibrated to the vendor's risk level or your specific regulatory obligations
- Missing fourth-party exposure — most organizations can't name their critical vendors' critical sub-vendors
- Thin documentation — assessments exist but findings aren't logged, remediation isn't tracked, and reassessments aren't scheduled
The Raphaels enforcement case is instructive. The fine stemmed primarily from inadequate SLAs, business continuity plans that didn't account for third-party reliance, and a risk appetite statement that failed to address outsourcing tolerances. Examiners treated the documentation gaps as seriously as the underlying control failures — and priced them accordingly.
What Effective Programs Do Differently
- Risk-based depth — the depth of assessment scales with the vendor's criticality, not a uniform process applied to every vendor regardless of risk
- Regulatory alignment — questionnaire content and scoring criteria map directly to FFIEC guidance, FCA expectations, or DORA requirements depending on the applicable regime
- Cross-functional involvement — legal, compliance, and operations stakeholders review the assessment, not just IT or security
- Pre-contract execution — the VRA is completed before the contract is signed, so identified gaps can be negotiated into contractual remediation requirements
- Audit trail maintenance — documented evidence of what was assessed, what was found, what was required, and when reassessment is due
Regulators expect organizations to demonstrate not only that assessments were conducted, but also that findings were acted on and programs were updated over time. During examinations, the audit trail is often the first document requested — and its absence is treated as evidence that oversight was nominal, regardless of what controls were actually in place.
How Fraxtional Can Help
Vendor risk assessment sits at the intersection of compliance, regulatory knowledge, and operational judgment. For most fintech and crypto companies — especially those at seed through Series B — that combination of expertise isn't something that exists in-house.
Fraxtional provides fractional compliance leadership — CCO, CRO, BSA Officer, CAMLO, and MLRO roles — for fintech, crypto, and banking companies that need director-level expertise without the cost of a full-time hire. Within those engagements, vendor risk oversight is a core component:
- Fractional CROs own vendor and partner risk as part of their mandate
- BSA Officers carry vendor oversight responsibilities alongside SAR management and transaction monitoring
- CCOs oversee vendor compliance reviews as part of broader program governance
What distinguishes that involvement in a VRA context is jurisdictional depth. Fraxtional's directors have worked with US banks under FFIEC and FinCEN standards, UK-regulated firms under FCA and PRA rules, and EU-facing organizations navigating DORA and EBA outsourcing guidelines.
When a vendor assessment finding surfaces — a gap in a SOC 2 scope, a missing sub-contractor clause, an untested BCP — a fractional compliance director with cross-jurisdictional experience translates it directly into a contractual requirement or remediation action. The finding gets resolved, not logged and deferred.
For sponsor bank relationships, that translation matters. Fraxtional's team has direct experience guiding clients through sponsor bank onboarding reviews, supporting bank Q&A processes, and helping fintech clients build documentation packages that meet banking partner expectations. A well-run VRA program, owned by a named compliance director, tells a sponsor bank examiner that third-party risk is being managed deliberately — with documentation to prove it.
Fraxtional works across the US, Canada, UK, and EU. Whether the need is building a VRA program from scratch, remediating gaps ahead of an examination, or placing a named compliance director who can own the process and produce defensible documentation, Fraxtional's engagement models are designed to match the scope and stage of the work.
Conclusion
Vendor risk assessment is a foundational compliance obligation — not a security tool, not a procurement formality, and not something that can be delegated to IT. For fintech, crypto, and banking companies, it's the process that defines how well your organization understands and controls the third-party risks embedded in your operations.
The framework exists. The regulatory guidance is clear. What separates a defensible VRA program from a checkbox exercise is consistent execution, regulatory alignment, and the expertise to act on what assessments actually reveal.
Organizations that build that capability before a regulatory examination, before a sponsor bank review, before a vendor incident — aren't just reducing risk. They're building the compliance infrastructure that regulators, investors, and banking partners trust. Fraxtional's risk assessment services are built specifically for that moment — helping fintech and crypto firms move from findings to defensible programs before it matters most.
Frequently Asked Questions
What is a vendor risk assessment?
A vendor risk assessment is the systematic process of identifying, evaluating, and documenting risks introduced by third-party vendor relationships. It covers multiple risk domains — compliance, cybersecurity, financial stability, and operational continuity — and confirms that adequate controls exist against your organization's regulatory obligations.
What should a vendor risk assessment include?
A complete VRA addresses compliance and regulatory risk evaluation, cybersecurity and data security controls, financial stability assessment, business continuity and operational risk review, and fourth-party or concentration risk analysis. For regulated financial services firms, compliance and cybersecurity risk typically require the deepest scrutiny.
How often should vendor risk assessments be conducted?
Reassessment frequency should be risk-based: critical and high-risk vendors at least annually, moderate-risk vendors every 18–24 months, and low-risk vendors every two to three years. Any security incident, regulatory action, ownership change, or material service modification should also trigger an immediate out-of-cycle review.
What is the difference between vendor due diligence and vendor risk assessment?
Due diligence is the evidence-gathering phase — questionnaires, document review, certifications. Vendor risk assessment is the broader process of interpreting that evidence against the organization's risk appetite and regulatory requirements to produce a risk rating and an action plan. Think of due diligence as the inputs; VRA is what you do with them.
What risk categories matter most for fintech and banking vendor assessments?
Compliance and regulatory risk (BSA/AML, GDPR, PCI DSS adherence), cybersecurity and data security risk, and fourth-party concentration risk are the highest-stakes categories for regulated financial services companies. These categories carry direct regulatory and sponsor bank implications that other risk domains typically don't.
Who should own the vendor risk assessment program in a fintech company?
VRAs require compliance expertise — typically a CCO, CRO, or BSA Officer — working alongside legal, operations, and IT stakeholders. Companies without a full-time compliance executive often use a fractional compliance leader to own the program and meet regulatory and sponsor bank standards.
