# BCBS Third-Party Risk Principles (Dec 2025): Principles for the sound management of third-party risk

Source: https://www.bankingnewsai.com/ai-regulation/documents/bcbs-third-party-risk-principles-2025
Last updated: Aug 26, 2026

On 10 December 2025 the Basel Committee published 12 Principles for the Sound Management of Third-Party Risk, finalising a July 2024 consultation and replacing the 2005 Joint Forum outsourcing paper for banks. Principles 1–9 address banks (board accountability, risk assessment, due diligence, binding contracts, onboarding, ongoing monitoring, business continuity, exit plans) and Principles 10–12 address supervisors, including cross-border and cross-sector coordination. The 22-page document covers nth-party supply chains and concentration risk, which is where a bank's reliance on external AI models and the cloud providers hosting them is now assessed.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [Basel Committee](https://www.bankingnewsai.com/ai-regulation/basel-committee) |
| Type | Guidance |
| Status | In force |
| Published | Dec 10, 2025 |
| Effective | Dec 10, 2025 |
| Applies to | Internationally active banks and their supervisors, via national implementation; supersedes the 2005 Joint Forum 'Outsourcing in financial services' for the banking sector |
| Official text | https://www.bis.org/bcbs/publ/d605.htm |

## Key points

- 12 principles: nine for banks and three for supervisors; adopted at the Committee's 18–19 November 2025 meeting and published 10 December 2025.
- Principle 1: the board of directors has ultimate responsibility for oversight of third-party risk; Principle 2: senior management implements the third-party risk management framework (TPRMF).
- Principles 3–5: comprehensive risk assessment, due diligence on prospective providers, and legally binding written contracts describing services, obligations, and rights.
- Principles 7–9: ongoing monitoring of performance and risk changes, business continuity for third-party disruption, and exit plans for planned and unplanned termination.
- Explicitly covers supply-chain (nth-party) risk and concentration risk at bank and systemic level, including multiple services from one provider, geographic concentration, and shared key nth parties.
- Principle 12 asks supervisors to coordinate across sectors and borders to monitor systemically important third-party providers.
- Establishes a 'common baseline' while leaving jurisdictions flexibility; the Committee says it will continue to monitor digitalisation and fintech from a prudential perspective.

## What changed for banks

For AI, this is the most operationally relevant Basel document since 2021. It does not name AI, but a foundation-model vendor, an AI-enabled SaaS product, or a cloud platform running a bank's models is a third-party service provider under it, and the due-diligence, contract, monitoring, exit, and concentration expectations now apply. It aligns the Basel baseline with the US interagency third-party guidance of June 2023 and the EU's DORA, giving supervisors in 28 jurisdictions a common reference for examining AI vendor dependence.

## Use cases it governs

- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)

## FAQ

### Do the Basel third-party risk principles cover AI vendors?

Yes in effect. They apply to any third-party service provider, including providers of AI models and the cloud services that host them, and require risk assessment, due diligence, contracts, monitoring, continuity, and exit plans, plus attention to nth-party and concentration risk.

### What did the 2025 principles replace?

The 2005 Joint Forum paper 'Outsourcing in financial services', for the banking sector. The principles were consulted on in July 2024 and finalised in December 2025.

## Related documents

- [BCBS ICT Risk Management Report (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-ict-risk-management-range-of-practices-2026) — Information and communication technology risk management: range of practices (Jun 2, 2026)
- [BCBS 239 Implementation Newsletter (Jan 2026)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-newsletter-bcbs239-implementation-2026) — Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles) (Jan 6, 2026)
- [BCBS Work Programme 2025–26](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-work-programme-2025-26) — Basel Committee work programme and strategic priorities for 2025/26 (Feb 4, 2025)
- [BCBS Digitalisation of finance report (May 2024)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-digitalisation-of-finance-2024) — Digitalisation of finance (May 16, 2024)
- [BCBS AI/ML Newsletter (March 2022)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-newsletter-ai-ml-2022) — Newsletter on artificial intelligence and machine learning (Mar 16, 2022)
- [BCBS Principles for Operational Resilience (2021)](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-principles-operational-resilience-2021) — Principles for Operational Resilience (Mar 31, 2021)
- [BCBS 239](https://www.bankingnewsai.com/ai-regulation/documents/bcbs-239) — Principles for effective risk data aggregation and risk reporting (Jan 9, 2013)
- [FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fca-frontier-ai-cyber-resilience-2026) — Frontier AI and Cyber Resilience (Sep 2, 2026)

Last reviewed Aug 26, 2026. Cite the official text (https://www.bis.org/bcbs/publ/d605.htm) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/bcbs-third-party-risk-principles-2025
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.