Continuous third-party risk scoring isn't a technology that institutions attempted and abandoned. It's a capability that hasn't emerged until now, because the visibility it would require didn't exist. What passes for third-party risk management in open finance today is frequently just vanilla KYB checks at the start of a relationship, periodically refreshed, combined with reacting to problems once they've already surfaced. Neither is continuous, and neither is really scoring.
Institutions haven't hit a technical wall building continuous scoring – there's little evidence they've attempted the build at all, because a more basic problem sits earlier in the chain. The natural assumption is that institutions tried to build continuous scoring in-house and got stuck on something technical – normalizing inconsistent data, defining what improvement means, working out where liability sits. That assumes an attempted build. In practice, an institution, or the intermediary it deals with directly, usually can't see who is actually behind the next entity along that chain. You can't score risk continuously on a third-party provider you can't identify.
That gap compounds. Without visibility into who's actually there, there's no standardized data to build a score from. Without standardized data, there's no shared basis for defining what a better or worse score would even mean. And without either of those, liability has nowhere clear to land when something does go wrong – it defaults to whoever holds the customer relationship, absorbing the cost first and sorting out redress after.
Two things exist today in place of continuous scoring:
1. KYB at onboarding: a point-in-time check, refreshed on a periodic cycle, that tells an institution or intermediary who a third-party provider was at the moment of assessment.
2. Reactive scrutiny: a bank or intermediary noticing a problem downstream (complaints, fraud rates, a control failure) and starting to ask questions after the fact.
Neither gives a live picture of risk as it changes. Both depend on already knowing enough about the third-party provider in question to ask the right question in the first place – which is exactly the visibility that's missing further down the chain.
The frameworks that could force chain-wide visibility – Section 1033, Smart Data, Consumer-Driven Banking – are still in draft or early implementation. Section 1033 in the US, Smart Data legislation in the UK, and Consumer-Driven Banking in Canada are all in draft or early implementation. None of them yet mandates the kind of standardized, chain-wide visibility that continuous scoring would depend on – so institutions and intermediaries are left with the same two tools, KYB and reaction.
The fix is infrastructure that creates chain-wide visibility, not a better scoring tool bolted onto the current setup. Invela's Accreditation gives every participant in the network a consistent, verified identity to be assessed against, rather than leaving each institution or intermediary to work out who's actually there on its own. Invela's Risk Indicator is built on that visibility and so can track risk as it changes, rather than only at the moment of onboarding. And a Warranty, in development, ensures liability lands in the right place.
Why doesn't continuous third-party risk scoring exist in open finance yet?
Because the visibility it would require doesn't exist. Most institutions and intermediaries can't see who is actually behind the next entity in the chain, so there's no standardized data to score, no shared basis for defining improvement, and no clear owner for liability when something goes wrong.
What's stopping open finance platforms from monitoring third-party risk continuously?
Today's tools are largely KYB checks at onboarding, periodically refreshed, plus reactive scrutiny once a problem has already surfaced – neither of which requires or produces the chain-wide visibility continuous scoring would need.
-p-2000.jpg)
