Financial institutions currently manage third-party exposure through liability clauses, indemnification, and pass-through obligations – or through allocation regulation puts in place – pushing risk onto the intermediary sitting between the institution and the underlying third-party provider. That allocation holds up on paper. It generally doesn't hold up in practice, because the intermediary receiving the risk usually isn't running continuous monitoring on the providers connecting through it.
Allocating liability on paper isn't the same as monitoring the risk behind it in practice. The liability has simply moved to where there is little to no monitoring, not to where it's actively managed. Regulatory and contractual allocation decides who should ultimately bear the cost of a failure. It doesn't decide who deals with the customer, or the incident, in the moment something goes wrong.
-p-2000.jpg)
