Singapore's central bank will hold financial firms accountable for vendor-supplied AI from Oct 7, 2027, with full compliance due by Oct 7, 2028. Where a vendor's evidence falls short, the firm has to close the gap with controls of its own.
Perspective Coverage
3 publishers
- Builder
- Builder 18%
- Operator
- Operator 62%
- Investor
- Investor 20%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence75
Trustero's vendor risk module asks reviewers to approve an AI's first-pass verdict
Trustero launched a third-party risk module whose AI reads vendor attestations and questionnaires and hands reviewers a risk determination to approve. Reviewers stop reading every document and sign off on a conclusion the software reached.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+35
- Incentives75
- Confidence35
FDIC's fintech certificate stops at two of the three risks in a bank partnership
FDIC's draft RAMP certificate would swap repeated fintech diligence for one reusable assessment covering two of the three risk layers in a partnership. An American Banker opinion piece argues the third layer, how the two firms actually fit together, still has to be checked bank by bank.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+5
- Incentives50
- Confidence40
The FDIC, Federal Reserve, OCC and NCUA want examiners looking harder at transparency, contract structure and technology inside core servicing deals. The guidance carrying that expectation is non-binding, with 60 days for comment.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence62
Three agencies concede core provider concentration limits what community banks can negotiate
A proposal from four federal agencies would size vendor oversight to the harm a relationship could do, while a separate statement from three of them says a few large core providers leave community banks little negotiating power.
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+20
- Incentives58
- Confidence57
HelmGuard lets customers set the risk level above which a human checks its risk decisions
The London GRC startup has raised $7.3m in seed funding for agents that assess third-party risk and show a citation and a confidence score for every conclusion. The part that audits other companies' AI agents is still being built.
Reality
- Evidence34
- Adoption28
- Hype gap+30
- Incentives78
- Confidence58
New York asks its licensees to model a failure at the provider they cannot leave
New York's regulator now expects supervised firms to identify where several critical operations run through one outside provider. Its enforcement record already includes a fine for an assessment that ignored the company's own cyber risk.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+12
- Incentives38
- Confidence63
Designation day: your cloud vendor now answers to three regulators, and you still answer for it
The first critical third parties have been designated, putting technology, data and operations suppliers under direct UK supervision. Firm-level responsibility does not move an inch.
Reality
- Evidence58
- Adoption47
- Hype gap+6
- Incentives66
- Confidence55