Third-Party Risk in Regulated Sectors

In regulated sectors, a compliance obligation does not transfer to a vendor simply because the vendor performs the activity. The regulated organisation typically remains accountable for the outcome, so third-party governance has to be built around that, not standard commercial risk allocation.

A vendor questionnaire built for general commercial risk will miss sector-specific obligations, data residency, audit rights, incident notification timelines. Assessment criteria need to be built from the regulatory obligation backward, not a generic template forward.

It also changes what monitoring needs to mean. A vendor compliant at onboarding can drift out of alignment as the regulatory requirement itself evolves, with no commercial breach involved. Monitoring in regulated sectors has to track the obligation itself, beyond the contract.