Third-Party Risk Landscape

Regulatory Obligations

FINRA expects firms to establish and maintain a reasonably designed supervisory system, including establishing, maintaining and enforcing written supervisory procedures for outsourcing activities to ensure compliance with applicable securities laws and regulations and FINRA rules.

FINRA encourages firms that use—or are contemplating using—third-party vendors to assess whether their supervisory procedures and controls for outsourced activities or functions are sufficient to maintain compliance with applicable rules—for example, FINRA Rule 1220 (Registration Categories), FINRA Rule 3110 (Supervision) and FINRA Rule 4370 (Business Continuity Plans and Emergency Contact Information), and SEC Regulation S-P.

Additionally, FINRA has observed an increase in the reporting of cyberattacks and outages at firms’ third-party vendors. Given the financial industry’s reliance on third-party vendors to support key systems and covered functions,1 an attempted cyberattack or an outage at a third-party provider could potentially impact a large number of member firms. FINRA continues to monitor third-party provider risks in the interests of member firms. 

FINRA’s Firm Outreach

FINRA’s Risk Monitoring program engages with firms on an ongoing basis to understand how firms use and supervise third-party vendors. 

  • In January 2025, FINRA issued a request for firms to update information related to their engagements with third-party vendors, particularly those they use for mission-critical systems and functions. This information supplemented FINRA’s understanding of the potential impact and effect a third-party vendor cybersecurity event might have on our firms and the securities markets.
  • FINRA has used the information gathered to quickly and proactively alert firms of cybersecurity and other vendor-related events that may impact their firm. 

Firms can contact their Risk Monitoring Analyst to report any changes to third-party vendors that support their key systems or any cybersecurity events at these vendors.

  • New in 2025, as a key component of the FINRA Forward initiatives, FINRA has launched FINRA Cyber & Operational REsilience (CORE). CORE identifies, assesses and shares cyber and technology risk intelligence directly with potentially impacted firms, delivering actionable insights and mitigation tactics. Additionally, CORE enhances visibility of risks and threats across the broker-dealer landscape, enabling early detection of vendor-related threats, systemic technology failures and emerging cyber-attack patterns, aiding in investor protection and market integrity efforts.

Effective Practices

  • Conduct initial and ongoing due diligence on third-party vendors supporting mission-critical systems (e.g., information technology and cybersecurity, AML monitoring), including:
    • assessing the third-party vendor’s use of GenAI2 in their products or services;
    • ensuring contracts with third-party vendors comply with regulatory obligations (e.g., adding language that prohibits firm or customer sensitive information from being ingested into a third-party vendor’s open-source GenAI tool); and
    • validating data protection controls in third-party vendor contracts.
  • Maintain an inventory of all third-party vendor-provided services, hardware, systems and software components—including the version—used by the firm.
  • Maintain an inventory of firm data types accessed or stored by the firm’s vendors.
  • Assess the potential impact of a cybersecurity incident or technology outage at a third-party vendor.
  • Monitor third-party vendor services for vulnerabilities or data breaches.
  • Establish adequate third-party vendor risk management policies and supervisory controls, including risk assessments and contingency plans.
  • Review and adjust third-party vendor tool default features and settings to meet business needs and applicable regulatory obligations.
  • Involve third-party vendors in firm Incident Response Plan testing.
  • Incorporate procedures to return or destroy firm data at the termination or conclusion of a vendor contract.
  • Ensure vendor access to systems, data and corporate infrastructure is revoked when the relationship ends.
  • Assess the risk of any fourth-party vendors handling firm data.

Additional Resources

Technology Management

Effective technology management factors significantly into regulatory compliance. When technology systems member firms rely on experience outages, operate sub-optimally or lack appropriate controls, the consequences can impact a firm’s ability to meet its regulatory obligations. Below are some effective practices related to technology management FINRA has observed at member firms. 

  • Governance: Establishing a comprehensive technology governance framework with clear accountability, oversight structures and documented processes to systematically identify, assess, mitigate and monitor technology risks across the enterprise. Documenting in firm WSPs, including change, incident and problem management.
  • Risk Assessments: Regularly assessing firm’s technology risk profile based on changes in the firm’s size, business model and technology stack. Regularly updating the firm’s Information Technology Governance program based on those assessments.
  • Artificial Intelligence (AI)/Large Language Models (LLMs): Establishing a supervision, governance or model risk management framework that establishes clear policies and procedures for AI/LLM development, implementation, use and monitoring, while maintaining comprehensive documentation throughout. Ensuring comprehensive data management in AI/LLM systems address data quality, integrity, retention and data security.3
  • Identity Access Management: Implementing identity access management controls enforcing least-privilege principles, requiring multi-factor authentication, and maintaining comprehensive access reviews to prevent unauthorized system access and protect sensitive data for human and non-human accounts.
  • Data Backups: Completing regular backups of critical data and systems, and ensuring the backup copies are encrypted and stored off-network. Regularly testing the recovery of data from backups to confirm information can be restored.
  • Branch Office Procedures: Limiting the use of branch-managed servers for email or other applications (e.g., customer relationship management, reporting). If branch-managed servers or applications are permitted, ensuring devices and applications are inventoried.
  • Configuration Management: Confirming desktops, laptops, applications and servers are inventoried and configured to the standards needed for the firm to conduct business.
  • Digital Transformation and the Adoption of Cloud: Planning and designing processes used when adopting cloud-based systems or technology to confirm adequate preparation.
  • Log Management: Capturing and retaining log data from a broad set of sources according to factors like compliance requirements, business needs and type of data.
  • IT Resiliency: Implementing and testing firm controls, and, where relevant, vendor controls, to maintain acceptable service levels during disruption of critical IT systems or services. 
Previous:
Firm Operations
Up:
Third-Party Risk Landscape
Next:
Outside Business Activities and Private Securities Transactions

1 Key systems can involve areas such as trading systems; clearing, carrying, and settlement functions; cybersecurity; and technology services. However, the use of these systems may vary at individual broker-dealers, depending on their business model or reliance on the use of technology within their business operations. Key systems may also be used to support covered functions (as defined by FINRA Rule 1220 (b)(3)(A)(ii) (Customer Account Statements)).

2 See the Report’s GenAI: Continuing and Emerging Trends topic for additional guidance.

3 See the Report’s GenAI: Continuing and Emerging Trends topic for additional guidance.