Vendor due diligence checklists, one per regulatory regime

Australia

• APRA CPS 230: Prudential Standard CPS 230 Operational Risk ManagementMaterial service providers are identified, checked before contracting, bound by set terms and monitored.
• APRA CPS 234: Prudential Standard CPS 234 Information SecurityThe security of any third party handling the institution's information is assessed, in proportion to the risk.
• Privacy Act and the APPs: Privacy Act 1988 and the Australian Privacy PrinciplesPersonal information goes only to suppliers that handle it under the APPs, with cross-border disclosures accounted for.
• AML/CTF Act (AUSTRAC): Anti-Money Laundering and Counter-Terrorism Financing Act 2006Reporting entities keep customer identification, monitoring and AUSTRAC reporting in step with the Act and Rules.
• Consumer Data Right: Consumer Data Right (Competition and Consumer Act, Part IVD)Data holders share consumer data under the CDR Rules and Standards, and recipients hold accreditation.
• APRA reporting (APRA Connect): APRA reporting standards and APRA ConnectReturns are prepared to APRA's reporting standards and lodged through APRA Connect.
• NCCP Act (ASIC): National Consumer Credit Protection Act 2009Credit licensees meet responsible lending, disclosure and hardship obligations.

United Kingdom

• PRA SS2/21: Outsourcing and third party risk managementMateriality assessment, due diligence, key contract terms, exit plans and a third-party register.
• PRA SS1/21 and FCA SYSC 15A: Operational resilience: impact tolerances for important business servicesThe third parties behind each important business service are mapped and kept within tolerance.
• FCA SYSC 8: FCA Handbook, SYSC 8 OutsourcingOutsourcing a critical function must not weaken internal control or the FCA's oversight.
• UK GDPR and DPA 2018: UK General Data Protection Regulation and Data Protection Act 2018Personal data goes only to processors under Article 28 terms, with international transfers safeguarded.
• MLR 2017 and NCA reporting: Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017Customer due diligence, monitoring and suspicious activity reporting meet the Regulations and JMLSG guidance.
• UK Open Banking (PSRs 2017): Payment Services Regulations 2017 and the Open Banking StandardAccount providers expose Open Banking APIs, and third parties access them with consent and strong authentication.
• PRA, Bank of England and FCA reporting: PRA Rulebook regulatory reporting and FCA RegDataReturns are prepared to the PRA Rulebook and FCA Handbook and lodged through BEEDS and RegData.
• FCA CONC and the Consumer Duty: FCA Consumer Credit sourcebook and Principle 12Creditworthiness, arrears handling and customer outcomes meet CONC and the Consumer Duty.
• Cyber Essentials: Cyber Essentials and Cyber Essentials Plus (NCSC)A baseline many UK institutions ask suppliers to hold, with Plus adding an independent technical audit.

Canada

• OSFI B-10: Guideline B-10 Third-Party Risk ManagementThird parties are managed across their lifecycle, with contracts covering audit, security, continuity and exit.
• OSFI B-13: Guideline B-13 Technology and Cyber Risk ManagementTechnology and cyber risk is managed end to end, including risk from technology providers.
• OSFI E-21: Guideline E-21 Operational Risk Management and ResilienceCritical operations, and the third parties behind them, stay within tolerance for disruption.
• PIPEDA and Quebec Law 25: Personal Information Protection and Electronic Documents Act, and Quebec's Law 25Personal information goes only to providers with comparable protection, with transfers outside Canada and Quebec assessed.
• PCMLTFA (FINTRAC): Proceeds of Crime (Money Laundering) and Terrorist Financing ActReporting entities verify identity, keep records and report to FINTRAC under the Act and Regulations.
• OSFI and Bank of Canada reporting: OSFI Regulatory Reporting System and Bank of Canada returnsReturns are prepared to the reporting instructions and lodged through the Regulatory Reporting System.
• Retail Payment Activities Act: Retail Payment Activities Act and Payments Canada rulesPayment service providers register with the Bank of Canada and manage operational risk and end-user funds.
• Consumer-Driven Banking Act: Consumer-Driven Banking ActParticipants are accredited and share data under the framework's technical and security standards.

United States

• Interagency TPRM Guidance: Interagency Guidance on Third-Party Relationships: Risk Management (OCC, Federal Reserve, FDIC)Risk-based oversight of third parties from planning and due diligence to contract, monitoring and exit.
• GLBA Safeguards: Gramm-Leach-Bliley Act: Interagency Guidelines Establishing Information Security Standards and the FTC Safeguards RuleService providers that handle customer information are overseen and bound to safeguard it.
• FFIEC IT Examination Handbook: FFIEC IT Examination Handbook: Outsourcing Technology Services and Business Continuity ManagementOutsourced technology stays within the examiners' reach, with continuity planning tested.
• Computer-Security Incident Notification Rule: Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service ProvidersBank service providers notify the bank as soon as possible of an incident that disrupts service for four hours or more.
• NYDFS Part 500: 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services CompaniesA written policy for third-party providers: due diligence, minimum controls and periodic assessment.
• BSA/AML (FinCEN): Bank Secrecy Act and FinCEN regulationsCustomer identification, monitoring and FinCEN reporting meet the BSA and the CDD Rule.
• FFIEC Call Reports and Federal Reserve reporting: FFIEC Consolidated Reports of Condition and Income and Federal Reserve regulatory reportsReports are prepared to the FFIEC and Federal Reserve instructions and filed on time.
• CFPB Section 1033: Personal Financial Data Rights rule (Dodd-Frank Act section 1033)Data providers make consumer data available through developer interfaces, and third parties use it with consent.
• TILA, ECOA, HMDA and Regulation F: Truth in Lending (Reg Z), Equal Credit Opportunity (Reg B), Home Mortgage Disclosure (Reg C) and Fair Debt Collection (Reg F)Disclosures, adverse action notices, fair lending data and collections conduct meet the federal consumer rules.
• SOC 2: SOC 2 examination (AICPA Trust Services Criteria)Banks routinely ask for a SOC 2 Type II report as evidence of a vendor's controls.

About these checklists

This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.

Vederca certifies no vendor against these regimes: the checklists say what evidence to ask for, never that a vendor has it. The same rows drive the regulatory questions in Vederca's procurement intake and the compliance section of every requirements register it generates, and the register builder turns any of them into starter rows.