Explain the due diligence a financial institution needs to run before and while engaging outside service providers.
The idea
Due diligence is the bank's structured assessment of whether a provider can deliver the service safely. It is not a one-off exercise. It is done before selection and repeated while the relationship runs, with depth proportional to the criticality of the activity. Typical areas are business background, reputation and strategy, and financial condition and ability to perform over the contract term. They also include operational capacity and internal controls, information security and data protection, and business continuity and disaster recovery. Further areas are legal and regulatory compliance, insurance, the use of subcontractors and how the provider oversees them, and potential conflicts of interest. Independent audit reports on the provider's controls are a useful input. The bank must check their scope and period and cannot rely on them blindly. The exam trap is treating diligence as finished once the contract is signed.
A practice question
What is the main purpose of due diligence on a prospective service provider?
- To move legal responsibility for performance to the provider before the contract is signed.Why not: Confuses diligence with risk transfer; accountability stays with the bank however much diligence is done.
- To obtain a price benchmark so that the bank can negotiate the lowest fee, so that the contract can be priced at or below what comparable providers would charge for the same service.Why not: Reduces diligence to a procurement exercise; price comparison is not its risk purpose.
- To assess whether the provider can deliver the service safely, soundly and in compliance with laws, in proportion to the activity's criticality. - correct
- To document the bank's exit strategy if the relationship ends.Why not: Mixes diligence up with contingency and exit planning, which is a separate element of the program.
Due diligence evaluates capability, financial strength, controls and compliance before and during the relationship. Price, risk transfer and exit planning are different parts of the process.
A harder one
During due diligence a bank learns that the provider will use a subcontractor to host the bank's customer data. What is the most appropriate response?
- Ignore the subcontractor because the contract is only with the provider, which is solely responsible for its own suppliers, since the provider carries sole contractual liability for any failures by the suppliers it chooses to use.Why not: Overlooks that the bank remains accountable for risks introduced through the provider's subcontractors.
- Require that the subcontractor itself be licensed as a bank in the bank's home jurisdiction.Why not: Invents a requirement; the focus is on the provider's oversight and the bank's visibility, not on a banking licence.
- Reject every provider that uses subcontractors, since reliance on others is always unacceptable.Why not: Overreacts; subcontracting is common and is managed, not banned, through diligence and contract terms.
- Assess how the provider selects, oversees and holds the subcontractor to the same standards, and make sure the contract gives visibility and approval rights over it. - correct
Subcontractors extend the chain of dependency. The bank cannot inspect every layer directly, so it evaluates the provider's controls over them and secures contractual rights.
The hardest tier
A bank wants to place a critical customer-onboarding function with a three-year-old start-up cloud provider that has little financial history. Which approach to due diligence is most appropriate?
- Apply a lighter review because the contract value is small compared with the bank's total outsourcing spend, on the basis that exposure to a small firm is easily absorbed and can be handled later if problems appear.Why not: Uses contract value to set depth; a critical function warrants more diligence regardless of fee size.
- Apply enhanced diligence on financial viability, funding, business model, resilience and controls, possibly with on-site review, and pair it with a tested contingency and exit plan. - correct
- Rely mainly on references from the provider's other customers, since the start-up lacks financial history to analyse.Why not: Replaces the bank's own assessment with references; missing history calls for more analysis of viability, not less.
- Defer the financial review until after contract signature, since a new firm's accounts will change anyway.Why not: Moves diligence after commitment; it must precede selection and continue through the relationship.
Criticality and uncertainty both raise the bar. The bank needs evidence of the provider's staying power and controls and a way to recover if it fails.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →