What does BCBS Third-Party Risk Principles (Dec 2025) say about AI in banking?

What are the key points of BCBS Third-Party Risk Principles (Dec 2025)?

• 12 principles: nine for banks and three for supervisors; adopted at the Committee's 18–19 November 2025 meeting and published 10 December 2025.
• Principle 1: the board of directors has ultimate responsibility for oversight of third-party risk; Principle 2: senior management implements the third-party risk management framework (TPRMF).
• Principles 3–5: comprehensive risk assessment, due diligence on prospective providers, and legally binding written contracts describing services, obligations, and rights.
• Principles 7–9: ongoing monitoring of performance and risk changes, business continuity for third-party disruption, and exit plans for planned and unplanned termination.
• Explicitly covers supply-chain (nth-party) risk and concentration risk at bank and systemic level, including multiple services from one provider, geographic concentration, and shared key nth parties.
• Principle 12 asks supervisors to coordinate across sectors and borders to monitor systemically important third-party providers.
• Establishes a 'common baseline' while leaving jurisdictions flexibility; the Committee says it will continue to monitor digitalisation and fintech from a prudential perspective.

What did BCBS Third-Party Risk Principles (Dec 2025) change for banks?

For AI, this is the most operationally relevant Basel document since 2021. It does not name AI, but a foundation-model vendor, an AI-enabled SaaS product, or a cloud platform running a bank's models is a third-party service provider under it, and the due-diligence, contract, monitoring, exit, and concentration expectations now apply. It aligns the Basel baseline with the US interagency third-party guidance of June 2023 and the EU's DORA, giving supervisors in 28 jurisdictions a common reference for examining AI vendor dependence.