Continuous Monitoring for Financial Services

Continuous monitoring of third-party risk in financial services means tracking a supplier’s security posture between formal reviews, so that a firm can meet regulatory reporting clocks with current information about its suppliers.
‍

Key Takeaways

A Bank of England official said in March 2024 that operational resilience requires continuous monitoring and improvement, in a speech on the proposed Critical Third Parties regime.
DORA requires initial notification of a major incident within 4 hours of classification and no later than 24 hours after awareness. UK rules from 18 March 2027 require an initial incident report within 24 hours of determining that a threshold is met. New York requires notice within 72 hours of determining that a cybersecurity incident has occurred, including at a third-party provider.
Those timescales are workable only if a firm already holds current information about its suppliers. This is our reading of the rules, but the rules do not say it directly.
The Bank of England’s Financial Policy Committee has monitored systemic third-party concentration risk since 2017. Workshops in the Bank and FCA’s AI Consortium discussed concentration at the AI model and compute levels in 2026.
CQUEST is a 50-question, six-domain self-assessment that gives a snapshot of a firm’s own cyber maturity. The Bank of England’s and the FCA’s published pages set no completion frequency for general use and do not describe it as continuous monitoring.
New York’s Part 500 requires “periodic assessment” of third-party service providers based on risk (Section 500.11(a)(4)). NYDFS’s October 2025 industry letter is non-binding guidance that sets out ongoing monitoring and oversight as a stage of the provider contract lifecycle.
The evidence on how many firms monitor suppliers continuously is thin. A 2017 FDIC Office of Inspector General evaluation found that 23 of 48 critical or high-risk provider contracts said nothing about business continuity. In Risk Ledger’s 2026 survey, 40.6% of respondents described their monitoring of important suppliers’ internal controls as fully automated and continuous.
DORA applies its third-party risk rules in proportion to a firm’s size and risk profile (Article 4(2)), and the PRA supervises its smallest firms through peer group analysis.
After the CrowdStrike outage, the FCA found that firms which had mapped their important business services, and had routes for sharing information with providers, responded faster.
‍

Introduction

Regulators in the UK, the EU and the US have each moved towards ongoing oversight of third-party providers, using different instruments. The EU’s DORA and the UK’s reporting reforms set incident clocks measured in hours. New York’s financial regulator has issued guidance describing third-party governance as continuously adaptive. A Bank of England official has said that operational resilience requires continuous monitoring and improvement.

This article sets out what those sources mean for financial services. It covers what the regulations require, what CQUEST does and does not measure, where the evidence of a gap sits, how monitoring applies at different scales of institution, and what three incidents show. It assumes the reader knows what continuous monitoring is. For its definition, how it differs from point-in-time assessment and how to implement it, see our general guide to continuous monitoring in TPRM.

This article follows from our recent guide to third-party risk management for financial institutions, which covers the wider programme: the lifecycle, concentration and fourth-party risk, and how the main regimes compare.
‍

What Regulators Have Said About Continuous Monitoring

Bank of England officials have used the language of continuous monitoring in public speeches on third-party oversight. The speeches also explain why that oversight is not left entirely to individual firms.

Gareth Truran of the Bank of England spoke at a techUK summit on 6 March 2024, while the proposals for the Critical Third Parties regime were out for consultation. Achieving operational resilience, he said, “will require continuous monitoring and improvement as businesses innovate and risks evolve.” He added that firms must still meet the operational resilience requirements and remain accountable for the risks in their own outsourcing and third-party arrangements.

Sasha Mills spoke at the London Institute of Banking and Finance in a speech published on 30 April 2024. She described direct oversight of critical third parties as recognising that no single firm or financial market infrastructure can adequately monitor or manage the systemic risks some third parties pose to financial stability. She added that financial market infrastructures remain responsible for their own operational resilience.

Two points follow. Authorities now oversee critical providers directly because no single client-supplier relationship reveals the wider ecosystem dependency picture, but firms remain responsible for their own suppliers.
‍

The Reporting Challenge

Incident-reporting rules in the EU, the UK and New York run on timescales measured in hours or days, and each applies to incidents at third-party providers. Meeting them depends on knowing quickly which providers matter and what their role in supporting business critical services is.

DORA sets the shortest clock. A firm must notify its regulator within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours of the initial notification, and a final report within one month (DORA, Article 19, with Commission Delegated Regulation (EU) 2025/301). Classifying an incident requires knowing which business services it affects, and classifying a third-party incident requires knowing which providers support those services.

The UK’s rules arrive on 18 March 2027. Under FCA PS26/2 and PRA PS7/26, a firm must submit an initial incident report within 24 hours of determining that a reporting threshold has been met, and a final report within 30 working days of resolution. The same rules require firms to notify regulators when they enter into or significantly change a material third-party arrangement, and to submit an annual register of those arrangements. The notification duty applies between register submissions, so a firm needs to know when something material about an arrangement changes.

New York’s Part 500 sets a “periodic assessment” standard for third-party service providers. Section 500.11(a)(4) requires periodic assessment based on the risk each provider presents. Section 500.17 requires notice to the Department within 72 hours of determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider. In October 2025, NYDFS issued an industry letter on managing third-party service provider risk. The letter clarifies existing requirements and recommends practices, and it does not add new rules. It treats third-party risk management as a four-stage lifecycle that includes ongoing monitoring and oversight. It calls for “a proactive, risk-based, and continuously adaptive approach to third-party governance”. It also says the Department will consider the absence of appropriate third-party risk management practices in its examinations, investigations and enforcement actions.

The three regimes use different instruments: a regulation with hourly reporting timescales, UK policy statements on incident and third-party reporting, and a New York rule with supporting guidance. Each ties reporting duties to events at providers. A firm’s ability to meet those duties depends on how current its information about its suppliers is.
‍

Concentration Risk Doesn’t Stand Still

Concentration risk is the exposure that builds when several critical functions, several critical suppliers or several firms, depend on the same provider. This of course changes over time, so a single assessment at contract signing, or infrequent re-assessments, often fail to track these changes in time.

The Bank of England’s Financial Policy Committee began monitoring systemic third-party concentration risk in 2017. By 2021 it had concluded that the financial sector’s growing reliance on a small number of third parties for vital services could raise financial stability risks without direct regulatory oversight of the resilience of those services, as Gareth Truran explained in 2024. That concern predates DORA’s adoption by five years, and both the EU and the UK now designate critical providers.

DORA raises the concentration risk question in two places. Article 29 requires firms, before contracting, to consider whether an arrangement supporting a critical or important function would mean relying on a provider that is not easily substitutable, or holding multiple arrangements with the same or closely connected providers. Article 28(2) requires the management body to review regularly the risks identified for those arrangements, and Article 28(3) requires the register of information to be kept up to date.

A firm’s exposure can change. A provider takes on a subcontractor that another critical supplier already uses. A business unit adds a service. A supplier is acquired. Each development shifts where dependencies cluster.

The sector-level picture is harder to see. No firm can tell whether ten of its peers depend on the same provider. In a Risk Ledger pilot with six financial institutions, the 395 direct suppliers they listed expanded to 1,272 once their own dependencies were mapped. The analysis found 47 systemic concentration risks, including nine suppliers connected to at least half the cohort. Three of those nine were smaller suppliers that participants were unlikely to know they shared.

Concentration therefore needs watching in two ways: changes in a provider’s own posture, and changes in who else depends on it.
‍

The AI Complication

Suppliers adopting AI add a form of dependency that regulators are still working out how to monitor.

The Bank of England and FCA’s AI Consortium brings together experts from the financial industry, the technology sector and academia. Its minutes record members’ views, which its terms of reference say do not reflect the views of the Bank or the FCA. In February 2026, workshop leaders described firms’ reliance on a small number of AI providers, models and infrastructure. They noted that firms can have limited visibility over model design, performance changes and update schedules, and limited control over vendor updates that arrive at short notice. A June 2026 workshop reported a survey within its professional network suggesting that concentration arises from the characteristics of AI provision, particularly at the model and compute levels, with limited alternatives. It added that accessing models as software-as-a-service may increase third-party dependency and reduce substitutability, and it called for a shared understanding of firms’ relationships with third-party AI providers.

The Financial Policy Committee’s July 2026 Financial Stability Report says rapid advances in frontier AI have raised financial stability risks linked to cyber and operational resilience. The actions it sets out for firms include managing frontier AI cyber risks from third parties and supply chains, including open-source software. In the record of its June 2026 meeting, the Committee said firms should act now to identify and remediate vulnerabilities at greater speed and scale, manage risks from third-party providers and maintain the resilience of critical services. It also discussed assessing what resilience should be expected of smaller technology providers as well as of the largest.

Policy on which providers fall under direct oversight is still moving. In April 2026 the Treasury Committee said that HM Treasury had not committed to bringing the major AI and cloud providers into the Critical Third Parties regime before the end of 2026, and the Bank said its Financial Policy Committee would keep monitoring how the regime was used. HM Treasury designated its first four Critical Third Parties in July 2026: Amazon Web Services, Google Cloud, Microsoft and Oracle.

For a TPRM team, these sources point to the same practical need. A supplier’s AI stack can change at short notice, below the level of the contract. A yearly questionnaire records the position on one day and does not show a model change or a new AI sub-provider that appears afterwards.
‍

CQUEST: What It Actually Is, and What It Isn’t

CQUEST is a self-assessment questionnaire, and its published descriptions present it as a snapshot of a firm’s own cyber maturity.

The Bank of England lists it alongside CBEST and STAR-FS as one of its cyber assessment tools. It comprises 50 multiple-choice questions across six domains: governance and leadership, identify, protect, detect, respond and recover. The Bank says it uses CQUEST to gauge the cyber risk and resilience capabilities of the sector, and that firms can use it to assess their own maturity. It advises directing a competent party with knowledge of the business to complete it (Bank of England). The FCA describes the answers as a snapshot of a firm’s cyber resilience capability, and says firms that want to complete it should email their supervisor (FCA).

One use is required. Firms applying to Gate 2 of the Digital Securities Sandbox must complete and submit a DSS version of CQUEST alongside their Gate 2 questionnaire. The Bank’s Gate 2 webinar describes it as an adapted version of the questionnaire the Bank, PRA and FCA use.

Neither the Bank’s nor the FCA’s page sets a completion frequency for general use, and neither describes CQUEST as continuous monitoring. Both describe its questions in terms of the firm’s own governance and capabilities. Supplier oversight is not what it measures. For a firm asking how current its knowledge of supplier posture is, CQUEST does not answer the question. It records what the firm’s own cyber capability looked like on the day it was completed.
‍

Where the Gap Shows Up

Regulatory language about ongoing oversight is easier to find than evidence of how firms behave. The evidence on how many firms monitor suppliers continuously is thin, and the available measures differ in scope and date. They point the same way.

The most detailed is a 2017 evaluation by the FDIC’s Office of Inspector General, which examined 48 critical or high-risk technology service provider contracts at 19 US institutions, using work done in 2016. It was a non-statistical sample whose results cannot be projected, and 81% of the contracts predated 2015. Within those limits, it found that only ten of the 19 institutions had evidence of a pre-contract or annual due diligence review of the provider’s risk management systems and performance. Twenty-three of the 48 contracts (48%) said nothing about business continuity, and 14 (29%) had no discussion of internal controls for incident response. Contracts at 18 of the 19 institutions allowed the provider to subcontract, and four institutions documented any consideration of subcontractor use. The OIG also observed that documentation of annual due diligence and ongoing contract monitoring appeared limited.

The FDIC’s 2019 letter FIL-19-2019 said some contracts did not require a service provider to maintain a business continuity plan, and that others did not detail incident responsibilities such as notifying the institution, regulators or law enforcement. It encouraged institutions to check that these risks are covered as part of due diligence and ongoing monitoring.

More recent measures cover other geographies. In Deloitte’s DORA European Survey, conducted in early 2025, 8% of participants reported full compliance with the third-party risk management pillar. In Risk Ledger’s own 2026 survey of 500 UK cyber security and TPRM professionals across sectors, 40.6% described their ability to monitor important suppliers’ internal controls as fully automated with continuous, real-time updates, 53.6% said it was partially automated with quarterly or event-triggered updates, and 3.8% relied on manual or static annual assessments.

None of these sources measure continuous monitoring of suppliers by financial institutions directly, and they should not be read as a single trend. However, together they show that gaps between a documented TPRM process and current knowledge of supplier posture have been recorded repeatedly.
‍

Continuous Monitoring at Different Scales

The evidence above could read as a standard only the largest institutions can meet. The regulatory sources expect less uniformity in pratice.

DORA’s Article 4(2) says firms apply the rules on ICT third-party risk management in Chapter V, Section I in proportion to their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations, as the relevant rules specifically provide. The PRA applies a similar logic to its own supervision. It supervises credit unions, small overseas banks and insurers, and mutual insurers, its lowest category of potential impact, through peer group analysis and annual assessments in large peer groups, and does not visit them on a fixed schedule. The Financial Policy Committee’s July 2026 report also notes that some smaller firms may rely more heavily on third-party software providers than larger firms do.

The PRA’s page describes how it supervises smaller firms. It does not set expectations for how those firms monitor suppliers. A smaller institution can apply the same logic to its own supplier base as a matter of judgement. Tiering suppliers by criticality means a credit union’s payments processor warrants current, event-triggered visibility, and a provider of low-risk services does not need the same attention.

At any size, the triggers matter more than the calendar. A disclosed vulnerability, an incident at a provider or a material change to its controls should prompt a review.
‍

Incidents Read Through the Monitoring Lens

Three incidents in recent years show different ways a supplier relationship can fail, and what current supplier information would and would not have added.

CrowdStrike, July 2024. A faulty software update caused a global outage that affected financial services firms. The FCA’s review found that third-party related issues had been the leading cause of operational incidents reported to it in 2022 and 2023. It also found that firms that had mapped their important business services and the resources behind them could prioritise restoring key services, and that firms with existing relationships and routes for sharing information with providers responded faster. The timing and completeness of incident reporting to the FCA varied across firms. No posture score or control-change alert would have flagged a faulty update in advance. What helped firms was knowing which services depended on the provider and having a line to it.

ICBC Financial Services, November 2023. LockBit ransomware hit ICBC’s US broker-dealer. According to the Financial Times, as reported by Lawfare, the attack prevented ICBC from settling Treasury trades on behalf of other market participants, and the firm proposed sending trading data to BNY Mellon on a USB stick. The Wall Street Journal reported that LockBit used Citrix Bleed (CVE-2023-4966), a flaw in Citrix NetScaler gateways. Citrix released security updates on 10 October 2023, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 18 October, three weeks before the attack. CISA’s advisory says exploitation activity had been identified as early as August 2023. ICBC FS was the victim of the attack, and for the institutions that settled through it, it was a third party whose systems were down. A fix and an active-exploitation listing were public for weeks. External monitoring of internet-facing systems is built to surface unpatched exposure of this kind, and a catalogue listing is a trigger for an out-of-cycle review. The sources do not show whether anyone was monitoring ICBC FS this way.

MOVEit, from May 2023. Attackers exploited a zero-day in Progress Software’s MOVEit Transfer tool, and Cybersecurity Dive’s reporting at the time counted more than 600 affected organisations. Financial services firms were exposed through a shared provider. PBI Research Services, a provider used by Genworth Financial and TIAA, ran MOVEit, and its compromise exposed data on millions of Genworth customers and agents, as disclosed in Genworth’s own SEC filing, and on more than 2 million TIAA retirees and pension holders, according to a lawsuit complaint reported by PLANSPONSOR. A zero-day gives posture monitoring nothing to flag beforehand. After disclosure, the question is which providers ran the affected product, and a supplier list does not show which software each provider runs.

The three incidents involve a vendor’s faulty update, an unpatched internet-facing gateway and a zero-day in a shared provider’s software. Current supplier information would have added different things in each: dependency maps and a line to the provider, an external signal and a reason to reassess, and visibility of which providers run which products.
‍

How Risk Ledger Supports Continuous Monitoring in Financial Services

The sources cited in this article describe a common operational need: current information about a supplier’s posture, held before a regulator’s clock starts. This is where Risk Ledger’s approach applies.

One profile, kept current. DORA’s register of information and the UK’s material third-party register both require firms to maintain an accurate picture of their third-party arrangements. On Risk Ledger, a supplier maintains one profile, shared with every connected client on the platform, and updates it as its controls change. A client sees the current position without chasing the supplier for a refreshed answer each time it needs one.

Notifications on change. When a connected supplier’s control environment changes, its clients are notified. That supports the reporting duties described above, because a firm learns about a change when it happens and not at its next scheduled review. Classifying an incident remains the firm’s own responsibility.

A second, independent signal. Risk Ledger offers suppliers external scanning of email, web, DNS and port security, so they can see their own attack surface. Whether to share that data with connected clients is the supplier’s decision, but most choose to. Where a supplier shares it, a client sees what the supplier reports about its controls alongside what can be observed from outside. Each source covers something the other cannot: scanning cannot see internal controls, and self-reported evidence can miss an exposed port.

Dependencies several tiers down. Suppliers can connect to their own suppliers on the same network, so dependencies several tiers removed from a firm’s direct relationships become visible, including the shared providers that concentration risk depends on. That visibility matters most in events like MOVEit, where the question is which providers run an affected product.

The fundamentals still apply: tiering suppliers by criticality, understanding concentration and matching monitoring to scale. What changes is how much of that information has to be rebuilt each time a regulator or an incident asks for it.

See how Risk Ledger maps fourth-party and concentration risk
‍

What security experts read next

Third-Party Risk Management for Financial Institutions, the wider programme continuous monitoring is one part of
Continuous Monitoring in Third-Party Risk Management, the general guide to the mechanics
DORA and Third-Party Suppliers: A Guide
Concentration Risks in UK Supply Chains
How a Fourth-Party Breach Can Affect Your Organisation
‍

FAQ

Does DORA require continuous monitoring of third parties?
DORA does not use the phrase “continuous monitoring” as a standalone obligation. Article 28(1)(a) keeps firms responsible for their obligations at all times, Article 28(2) requires the management body to review regularly the risks identified for arrangements supporting critical or important functions, and Article 30(3)(e) requires a contractual right to monitor a provider’s performance on an ongoing basis for those functions. The incident-reporting clocks also depend on firms holding current information about their providers.

What do the UK’s new reporting rules require for third parties?
From 18 March 2027, firms must notify regulators when they enter into or significantly change a material third-party arrangement and submit an annual register of those arrangements (FCA PS26/2 and PRA PS7/26). Firms must also submit an initial incident report within 24 hours of determining that a reporting threshold has been met, and a final report within 30 working days of resolution.

Is CQUEST a continuous monitoring tool?
No. CQUEST is a 50-question, six-domain self-assessment of a firm’s own cyber maturity. The Bank of England and FCA describe it as a snapshot. Their published pages set no completion frequency for general use, and it is required with Gate 2 applications to the Digital Securities Sandbox.

Does New York’s Part 500 require continuous monitoring of third parties?
Section 500.11(a)(4) requires periodic assessment of third-party service providers based on risk, not continuous monitoring by name. NYDFS’s October 2025 industry letter is non-binding guidance that clarifies existing requirements. It sets out ongoing monitoring and oversight as a stage of the provider lifecycle and calls for a continuously adaptive approach to third-party governance.

Should a smaller institution monitor third parties the same way a large bank does?
DORA applies its third-party risk management rules in proportion to a firm’s size, risk profile and the complexity of its services (Article 4(2)). The PRA supervises its smallest firms through peer group analysis. Neither sets a monitoring standard for suppliers by firm size, so a smaller institution has to judge the intensity for itself, usually by tiering suppliers by criticality.

How does AI change third-party monitoring in financial services?
Workshops in the Bank of England and FCA’s AI Consortium reported concentration at the AI model and compute levels and limited firm visibility over vendors’ model changes and update schedules. The Financial Policy Committee’s July 2026 report says advances in frontier AI have raised cyber and operational resilience risk and that firms should manage that risk from third parties and supply chains.

Would continuous monitoring have prevented the CrowdStrike outage?
No source says so. The FCA’s review found that firms which had mapped their important business services and had routes for sharing information with providers responded faster. A posture score or control-change alert would not have flagged a faulty update in advance.

‍