Outsourcing Doesn't
Outsource the Risk.
Your institution stays accountable for every function you outsource. A register of every vendor, its risk rating, and its next review date — so that accountability has somewhere to live.
Every Outsourced
Relationship, Tracked.
The CBN Baseline Standards name vendor and third-party risk management as its own requirement. This is what backs it.
One Vendor Register
Every outsourced provider your institution relies on for AML/CFT-relevant functions — KYC vendors, screening providers, agent networks, correspondent banks, core banking, cloud infrastructure — in one place.
A Risk Rating Per Vendor
Low, medium, high, or critical — set per relationship, not inherited from a generic vendor category.
Review Cadence
A next-review date per vendor, so reassessment happens on a schedule instead of when someone remembers.
Internal Ownership
Every vendor relationship has a named internal owner — no relationship without accountability.
Findings & Notes
Record assessment findings, conditions, and concerns against each vendor, not in a separate document nobody updates.
Full Audit Trail
Every change to the register — added, updated, removed — is logged with who and when.
A Vendor Failure Is
Your Institution's Failure.
A KYC vendor with weak controls, an agent network with no monitoring, a correspondent bank you haven't reassessed in years — none of it transfers responsibility away from you. The Baseline Standards say as much explicitly: accountability for effectiveness stays with the institution, regardless of who performs the work.