Third-party risk for banks: what proof the regulator expects

For UAE banks, using an outside provider is not just a procurement decision. The Central Bank's Outsourcing Regulation for Banks (Circular No. 14/2021) expects banks to prove how each arrangement was assessed, approved and watched. All existing agreements had to comply by 31 December 2023.

What the regulation asks for

• A board-approved policy that sets out how materiality is assessed (Art. 2.5.1).
• A materiality test. Material outsourcing is an activity that, if disrupted, could significantly affect operations or the bank's ability to manage risk (Art. 1.9).
• A full register of all outsourcing arrangements, material and not. It records the provider, dates, the service, whether confidential data is involved and whether it is material (Art. 3.1 and 3.2). The Central Bank can ask for it (Art. 9.3).
• Prior non-objection from the Central Bank before outsourcing any material activity (Art. 8.1).
• Written contracts that give the Central Bank access to the provider and the bank full access to its data, including after termination (Art. 5.2, 5.7, 5.9).
• Ongoing review by internal audit and compliance, reported to the board or audit committee (Art. 7.2 and 7.3).
• Data kept in the UAE. Customer confidential data cannot leave the country without Central Bank approval and the customer's written consent (Art. 6.1 and 6.3).

Where banks get caught out

The rules are clear. The proof is usually what is missing. Typical gaps:

1. The register is a spreadsheet that is out of date the day after it is updated.
2. Materiality was assessed once, at signing, and never again.
3. The due diligence is spread across emails and shared folders.
4. Nobody can show, for a given provider, who signed off and on what evidence.
5. Payments continue to a provider whose review has lapsed.

What good looks like

One record per provider, from the first document to the last audit. A score that decides how deep the review goes. A register that is always current because it is built from the records, not typed separately. And a link to payments, so a provider that fails a check cannot be paid.

VendorGuard is built for this. It scores each third party by risk, keeps the evidence and the register in one place, produces committee reporting, and shows a payability verdict inside Oracle Fusion.