Insight

Third-Party and Vendor Risk Investigations: When the Compliance Problem Is Outside the Perimeter

The investigation workflow changes fundamentally when the misconduct is at a vendor, supplier, or service provider rather than inside the institution. The evidentiary standard is the same; the access rights are not. This issue examines how institutions are structuring third-party risk investigations — and what the DOJ’s Corporate Enforcement Policy and DORA’s ICT third-party risk provisions have done to raise the stakes. Plus: the $1.55 billion in new enforcement actions against Bank of America and American Express that closed the past two weeks’ enforcement calendar.