Basel Committee publishes principles for the sound management of third-party risk
The Basel Committee has published principles for the sound management of third-party risk in the banking sector. The principles establish a common baseline for banks and supervisors for the sound management of third-party risk. The Committee will continue to monitor developments related to the digitalisation of…
The Basel Committee published final principles for the sound management of third-party risk in the banking sector on 2025-12-10. The publication matters because it creates a common prudential baseline for banks and supervisors and explicitly supersedes the Basel/Joint Forum 2005 outsourcing paper for banking-sector purposes.
Key dates
- 2025-12-10
- Basel Committee published the principles for the sound management of third-party risk
- 2024-10-09 Deadline
- Comment deadline for the consultative version of the principles
Suggested considerations
- Compliance teams may wish to compare existing outsourcing and third-party risk frameworks against the new 12-principle baseline to identify gaps in governance, lifecycle controls, and supervisor-facing documentation.
- Firms may wish to review board and senior management oversight arrangements for third-party risk to ensure responsibilities, risk appetite, escalation, and reporting are clearly assigned.
- Banks should consider whether their third-party inventories, risk assessments, due diligence files, contracts, monitoring processes, and exit planning are aligned to a full lifecycle model rather than a narrow outsourcing model.
- Supervisory relations teams may wish to map the principles against home and host jurisdiction requirements to identify where local rules are already aligned or where additional supervisory engagement may be needed.
- Operational resilience teams may wish to test whether critical third-party dependencies, including cloud and technology providers, are sufficiently captured in business continuity and termination planning.
What changed
The Basel Committee replaced the older 2005 Joint Forum outsourcing guidance with a new 12-principle framework focused on third-party service provider arrangements in banking. The framework is broader than traditional outsourcing and is designed to cover the larger, more diverse third-party ecosystem created by digitalisation and financial technology.
Compliance impact
The practical impact is broad for banking-sector third-party risk management because the publication updates the prudential benchmark supervisors may use when assessing governance, controls, and resilience. The Committee does not describe legal sanctions, but firms that lag the baseline may face supervisory challenge, remediation expectations, or pressure to strengthen third-party oversight and lifecycle controls.
References
- [1] bis.org/bcbs/publ/d577.htm
- [2] regulationtomorrow.com/2025/12/basel-committee-principles... third-party
- [3] orx.org/blog/bcbs-third-party-risk-principles-what-you-ne... third-party
- [4] reply.com/contents/BCBS_Principles_for_TPRM.pdf third-party
- [5] torys.com/en/our-latest-thinking/publications/2024/10/bas... third-party
- [6] venminder.com/blog/key-takeaways-basel-committees-12-prin... third-party
- [7] aws.amazon.com/blogs/industries/aws-responds-to-basel-com... third-party
- [8] fsb.org/uploads/P220623.pdf third-party
AI-generated analysis. May contain errors or omissions — verify with the original BIS source before acting. Full disclaimer.