Third-Party Risk Management
TPRM
The lifecycle of identifying, assessing, and monitoring the risks vendors and partners introduce to your institution.
Third-Party Risk Management (TPRM), also called vendor risk management, is the discipline of managing the risk that outside vendors, service providers, and partners create. Regulators expect institutions to remain responsible for activities they outsource — you cannot outsource accountability.
A TPRM program runs across a lifecycle: risk-tiering vendors by criticality and data access, performing due diligence before onboarding, setting contractual controls, and conducting ongoing monitoring (financial health, security posture, adverse media) at a cadence matched to each vendor’s tier.
Examiners look for a vendor inventory, documented due diligence proportional to risk, and evidence of ongoing oversight — especially for vendors touching BSA/AML, KYC, custody, or core technology.
This glossary entry is educational and does not constitute legal advice. Always consult qualified legal counsel for jurisdiction-specific guidance.