Third-Party Risk Management (TPRM) Kit
Tier every vendor with one documented rule, run due diligence and AI vendor reviews, find contract gaps against the 2023 Interagency Guidance, and track SOC reports, issues, concentration and exits. Excel workbook, guide, Word policy and offboarding checklist.
Price
$69
One-time. No subscription. Use forever.
Delivered immediately after checkout — your template and guide links are emailed to you with your receipt.
Built for risk and compliance teams at financial-services organizations
◆ Quick buying summary
What you get and when you can use it
- Good fit if
- Your bank partner asked for your vendor inventory, tiering method and evidence that critical vendors were reviewed, and you don't have a documented rule
- Format
- Four files: an editable Excel workbook (12 tabs), a PDF guide of about 40 pages, and two editable Word templates (a 16-page third-party risk management policy and a 9-page vendor offboarding checklist). Instant download after checkout.
- Need the methodology first?
- Read the Vendor Due Diligence Questionnaire Guide.
- Time to value
- Start reviewing, editing, and assigning owners the same day; customize to your organization before sharing outputs externally.
- After purchase
- After payment, download every file immediately from the confirmation page. RiskTemplates also emails a secure access link, and Stripe sends the payment receipt separately. No account required.
◆ What's included
- ◆ 12-tab Excel workbook: Start Here, Dashboard, Vendor Inventory, Methodology, Due Diligence, AI Vendor Assessment, Contract Provisions, Monitoring Tracker, Concentration Risk, Offboarding, Regulatory Reference and Lookups
- ◆ Vendor Inventory for up to 500 vendors: five 1-to-4 tiering factors, a Critical floor (including six Critical categories), four tiers (Critical, High, Medium, Low), overrides only with a written rationale, and reassessment due dates every 12, 12, 24 or 36 months by tier
- ◆ Due Diligence: 48 questions in 9 domains with 6 knock-out questions, one column per vendor for up to 25 vendors, scored to Satisfactory, Needs Improvement or High Risk
- ◆ AI Vendor Assessment: 21 questions (4 knock-outs) for up to 10 vendors that use artificial intelligence, covering model risk, fair lending and adverse action reasons, data use and AI training, security and fourth-party model providers
- ◆ Contract Provisions: 26 provisions, the 17 contract topics (a) to (q) of the 2023 Interagency Guidance plus 9 US clauses (bank service provider incident notice, Regulation S-P, FTC Safeguards Rule, NYDFS, Bank Service Company Act, incident notice hours, data return, transition assistance, data use limits), with a gap priority set by each vendor's tier
- ◆ Residual rating and risk acceptance: assessment results and open Critical or High issues move the rating, and a Critical or High residual rating needs an owner, date and expiry
- ◆ System and Organization Controls (SOC) report tracking: report type, period end and bridge letter, flagged Current, Stale (more than 12 months) or Gap of more than 3 months with no bridge letter
- ◆ Monitoring Tracker for issues and remediation, Concentration Risk for single points of failure and shared cloud providers or regions, and an Offboarding tab for each exit
- ◆ Regulatory Reference tab listing each source with its status (in effect, proposed only, rescinded or withdrawn) and a primary-source link, and a calculated Dashboard whose tables reconcile to the inventory
- ◆ PDF guide of about 40 pages: the regulatory baseline, the tiering rule with worked examples from the sample vendors, SOC report review, AI vendors, contracts, residual risk, concentration, offboarding, board reporting and what a bank partner will ask a fintech for
- ◆ Editable Word templates: a 16-page third-party risk management policy pre-filled with the workbook's settings, and a 9-page vendor offboarding checklist
Use rights: customize for internal business use and use outputs with your auditors, customers, bank partners, and regulators. Do not resell or redistribute the template files.
◆ Preview
See what the template covers.
Vendor Inventory tab with the 14 sample vendors, from Larchmere National Bank and Ledgerline Core Systems to Pinecrest Mail House: category, factor average, final tier, assessment status, contract status, SOC report status, due diligence result, residual rating and risk acceptance status
Dashboard calculated from the sample data: 16 key indicator tiles such as overdue assessments, stale SOC reports, single points of failure and risk acceptances due, then vendor counts by final tier, residual rating, assessment status, contract status, SOC report status and due diligence result
Contract Provisions tab: gap counts by vendor and the gap priority grid for provisions C-01 to C-26, with the requirement for each tier and Met, N/A, Critical gap, High gap, Medium gap or Low gap for ten sample vendors
◆ Where this fits
Where this fits in your risk program
- ◆ Start here if you need a vendor inventory, a tiering rule you can explain and a record of due diligence and contract review.
- ◆ Pair it with the Incident Response & Breach Notification Kit for the incidents a vendor causes and the notices they start.
- ◆ Pair it with the AI Risk Assessment Template for AI you build or deploy yourself; this kit covers AI used by your vendors.
- ◆ Pair it with the BCP/DR Kit to plan around the critical vendors and single points of failure this kit identifies.
◆ What this isn't
Setting expectations.
- × Not legal advice, and it does not guarantee examiner or bank-partner acceptance: tailor it to your program and the request.
- × Not software or a vendor portal: an Excel workbook, a PDF guide and two Word templates.
- × Not international: US guidance and rules only.
- × Not a contract: Contract Provisions tells you what to look for; have counsel review the language.
◆ Regulatory alignment
Designed around the guidance in effect
Sources were checked against primary text as of October 12, 2026, and each is listed on the Regulatory Reference tab with its status:
- ◆ Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (2023): OCC Bulletin 2023-17, FDIC FIL-29-2023 and Federal Reserve SR 23-4, in effect
- ◆ Proposed Third-Party Risk Management Guidance, 91 FR 58536 (September 2026; OCC Bulletin 2026-46, FDIC FIL-58-2026): proposed only, comments due November 16, 2026
- ◆ Computer-Security Incident Notification rule, bank service provider notice: 12 CFR 53.4, 225.303 and 304.24
- ◆ Bank Service Company Act, 12 U.S.C. 1867(c)
- ◆ Regulation S-P service provider oversight, 17 CFR 248.30(a)(5), and the FTC Safeguards Rule, 16 CFR 314.4(f)
- ◆ NYDFS (New York Department of Financial Services) cybersecurity regulation, 23 NYCRR 500.11, and its October 2025 third-party guidance
- ◆ CFPB Bulletin 2016-02 on service providers and OCC Bulletin 2021-40, the agencies' fintech due diligence guide for community banks
- ◆ SR 26-2 / OCC Bulletin 2026-13 on model risk management, for AI and model vendors
The 2023 Guidance rescinded the OCC's 2013 guidance and 2020 frequently asked questions and the FDIC's 2008 guidance. Regulatory Reference lists them as rescinded so you can update older policy citations.
Last updated: October 12, 2026
◆ Template guide
Vendor Due Diligence Questionnaire Guide
How to structure a vendor due diligence questionnaire for US fintechs and banks: tier first, ask evidence-backed questions, use knock-out questions, read the SOC report and record the residual risk.
◆ FAQ
Frequently asked questions.
Is this for banks or fintechs?
Both, with fintechs and banking-as-a-service (BaaS) programs in mind. The sample company is a fintech whose sponsor bank sits in its own inventory as a Critical vendor, and the guide has a chapter on what a bank partner will ask a fintech for. A small bank uses the same tabs for its own vendors, and the guide points it to the September 2026 interagency statement on core service providers. Some rows apply only to certain firms, for example Regulation S-P to SEC-registered firms and the FTC Safeguards Rule to non-bank financial institutions; mark the ones that don't apply N/A.
How is a vendor tiered, and why is a sponsor bank always Critical?
Score five factors from 1 to 4: business criticality, data access and sensitivity, regulatory and consumer impact, financial exposure, and substitutability or exit difficulty. The vendor is Critical if business criticality is 4, if data access and regulatory impact are both 4, or if its category is one of six Critical floor categories: sponsor or partner bank, core or ledger, card issuer-processor, payment processor, KYC, AML or sanctions screening, and production cloud hosting. Otherwise the average decides (3.40 or higher Critical, 2.60 High, 1.80 Medium, below that Low), and any single factor at 4 makes it at least High. A sponsor bank is a floor category because if it stops, your accounts, cards and money movement stop with it. The thresholds and floor categories are settings you can change.
Does it cover the September 2026 proposal?
It describes it, but doesn't treat it as in effect. The OCC, FDIC, Federal Reserve and NCUA proposed new third-party risk management guidance in September 2026 (91 FR 58536; OCC Bulletin 2026-46; FDIC FIL-58-2026), with comments due November 16, 2026. Until a final version is issued, the 2023 Interagency Guidance (OCC Bulletin 2023-17, FDIC FIL-29-2023, Federal Reserve SR 23-4) remains the guidance in effect, and the workbook follows it. The guide summarizes what the proposal would change, and the Regulatory Reference tab marks it "Proposed only".
Can I track SOC reports and bridge letters?
Yes. For each vendor, record the System and Organization Controls (SOC) report type, the report period end and whether a bridge letter was received. The workbook flags the report Current, Current (bridge letter), Stale when the period ended more than 12 months ago, or a gap of more than 3 months with no bridge letter, and it flags Critical or High vendors with no report. The due diligence questions cover report scope, complementary user entity controls, carved-out subservice organizations and exceptions.
Is the policy editable?
Yes. The policy template is a Word document with yellow [BRACKETED PLACEHOLDERS] for your company, approvers and settings. Its tiering rule, reassessment cadence and scoring cut-offs are pre-filled with the workbook defaults, and an appendix maps each policy section to a workbook tab. The offboarding checklist is also an editable Word document. In the workbook, white cells are inputs and gray cells are formulas, and the thresholds and dropdown lists are yours to change. The guide is a PDF.
Which version of Excel do I need?
Excel 2016 or later. The workbook uses standard functions such as INDEX, MATCH, COUNTIFS, SUMPRODUCT and EDATE, with no XLOOKUP, LET, FILTER or other dynamic-array functions. Enter dates as mm/dd/yyyy.
How many vendors does it hold?
The Vendor Inventory runs to 500 vendors. The questionnaire tabs have one column per vendor: 25 on Due Diligence and Contract Provisions and 10 on the AI Vendor Assessment, so you assess the vendors that need it rather than every row. To reassess a vendor, save a PDF of its column and overwrite the answers. The Monitoring Tracker and Concentration Risk tabs hold 300 rows each, and the Offboarding tab 100 exits.
Does it cover AI vendors?
Yes. Mark whether each vendor uses artificial intelligence in its service; those vendors get the 21-question AI Vendor Assessment, and the Dashboard counts any without one. The questions cover documentation and governance, independent validation, generative and agentic components, adverse action reasons and fair lending testing for credit models, use of your data for model training, prompt injection and other attacks, change notice and the foundation-model providers behind the service. The worse of the due diligence and AI results feeds the residual rating.
What does it cover for offboarding?
The Offboarding tab tracks each exit against five items: data returned or a destruction certificate received, access revoked, transition to the successor complete, final invoice settled and any regulator or bank partner notice, with an exit status that turns Overdue after the target date. The Word checklist gives the detailed steps behind those columns in ten sections, from the exit decision and transition planning to records retention, a post-exit review and sign-off. Contract provisions C-24 and C-25 check that data return and transition assistance are in the contract before you need them.
Can I share completed outputs externally?
Yes. You can use completed outputs with auditors, customers, bank partners, regulators, and internal stakeholders. Customize the template for internal business use — just don't resell or redistribute the source template files.
How do I receive the files?
Checkout is handled through Stripe. After payment, download every file immediately from the confirmation page. RiskTemplates also emails a secure access link, and Stripe sends the payment receipt separately. No account is required.
What if it's not a fit?
Email within 30 days for a full refund, no questions asked. The guarantee is meant to remove purchase risk while you evaluate whether the template fits your use case.
● First-time buyer offer
Get 20% off your first template.
Drop your email and we'll send the code.
◆ Not ready to buy?
Start with the free Risk Register.
141 pre-populated fintech risks across 21 categories. ISO 31000 structure.
Download free Risk Register →◆ Related templates
Pairs well with.
Incident Response & Breach Notification Kit
Run an incident and every notice clock it starts: bank partner, the bank regulators' 36-hour rule, NYDFS, FTC, SEC and breach laws in 54 states and territories. Workbook, guide, four playbooks, tabletop kit and Word plan templates.
AI Risk Assessment Template & Guide
Comprehensive AI model governance and risk assessment templates for financial services teams.
New Product Risk Assessment
Structured risk review process for new products, services, and business initiatives.
◆ Ready when you are
Get the Third-Party Risk Management (TPRM) Kit.
Start building a defensible risk program today.