Guide
Vendor Due Diligence Checklist for Financial Firms
Your custodian portal, CRM, cloud backup and IT provider can all reach client data, and regulators hold your firm responsible for how they protect it. Here is what the rules expect and a checklist for vetting and monitoring vendors.
Key takeaways
- Outsourcing a function does not outsource the responsibility for it: regulators expect your firm to vet, contract with and monitor every vendor that can reach client data.
- Under amended Regulation S-P, advisers and broker-dealers must oversee service providers and require them to report a breach affecting customer information within 72 hours.
- The FTC Safeguards Rule, NYDFS Part 500 and federal bank guidance all expect due diligence before you sign, security terms in the contract and periodic reassessment.
- Start with an inventory of vendors and the data each one holds, then match the depth of each review to the risk.
The rules
What regulators expect from your vendor program
Advisers and broker-dealers: Regulation S-P and FINRA
Amended Regulation S-P requires broker-dealers, SEC-registered investment advisers and other covered firms to oversee their service providers, including due diligence and monitoring, so that providers protect customer information and notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach affecting a customer information system they maintain. Larger firms had to comply by December 3, 2025 and smaller firms by June 3, 2026. The SEC withdrew its separate proposed outsourcing rule for advisers in June 2025, but these Regulation S-P requirements remain in force.
For broker-dealers, FINRA Regulatory Notice 21-29 adds a reminder that outsourcing an activity to a vendor does not relieve the firm of its duty to supervise that activity under FINRA Rule 3110.
Tax, accounting and other firms: the FTC Safeguards Rule
Firms under the FTC Safeguards Rule must take reasonable steps to select service providers that can protect customer information, require those safeguards by contract and periodically assess each provider based on the risk it presents. Unlike some parts of the rule, this applies to firms of every size. See our WISP guide for accounting and tax firms.
NYDFS-licensed firms: Part 500
Part 500 requires written third-party service provider policies, based on the firm’s risk assessment, covering how vendors are identified and risk-assessed, the minimum security practices they must meet, due diligence and periodic assessment. The policies should also address vendor access controls including multi-factor authentication, encryption, notice of cybersecurity events and contract representations about the vendor’s security practices. See our NYDFS Part 500 compliance checklist.
Banks and credit unions
Banks supervised by the Federal Reserve, FDIC and OCC follow the Interagency Guidance on Third-Party Relationships, final in June 2023, which describes a life cycle of planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. Credit unions face similar vendor management questions from NCUA examiners.
Inventory
Start with a vendor inventory and risk tiers
You cannot oversee vendors you have not listed. Build an inventory that shows, for each vendor, what it does, what client or firm data it holds or can reach, how it connects to your systems and who at your firm owns the relationship. Typical vendors at a financial firm include:
- Custodian, portfolio management and CRM platforms
- Microsoft 365 and other cloud email, file sharing and archiving services
- Tax, accounting and document management software
- Backup, e-signature and secure file transfer services
- Your managed IT or managed security provider, which usually has administrator access to everything
- Payroll, billing, printing and shredding vendors that handle client records
Then sort vendors into tiers. A vendor with administrator access or large volumes of client data deserves a full review and a yearly reassessment, while a vendor that never touches client data may need little more than a contract check.
Checklist
Vendor due diligence checklist
- Independent security report: a recent SOC 2 Type II report or ISO 27001 certificate, with any exceptions and the controls the report says your firm must handle reviewed.
- Multi-factor authentication for vendor staff who access your systems or data, and for your own users on the vendor’s platform.
- Encryption of your data in transit and at rest.
- Breach notice: a contract term requiring notice of incidents affecting your data fast enough for your own deadlines, and no later than 72 hours for Regulation S-P.
- Where your data lives: data locations, backups and which subcontractors can reach your data.
- Vendor access: who at the vendor can reach your data, how that access is approved and logged, and how quickly it is removed when their staff leave.
- Business continuity: the vendor’s recovery plans and recovery times, and how often they are tested.
- Records: whether the vendor keeps books and records in a form that meets your retention rules, and how you get them back.
- Insurance and financial strength: cyber liability coverage and the vendor’s financial condition.
- Exit plan: how your data is returned and destroyed when the contract ends, with written confirmation.
- Review schedule: when the vendor will be reassessed, based on its risk tier.
- Evidence: keep the questionnaires, reports, contracts and review notes, since examiners ask for evidence, not just a policy.
Ongoing
Monitoring vendors after the contract is signed
Due diligence is not a one-time step. Review high-risk vendors at least once a year: request the latest SOC 2 report, confirm security terms still match your policies, check for incidents and for changes in subcontractors or ownership, and confirm which of your staff still need access to the vendor’s platform.
Include key vendors in your incident response exercises, and act quickly when a vendor reports a breach, because your own notice deadlines may already be running. See our incident response plan guide.
Your IT provider
Vetting your IT provider
Your managed IT provider is often your highest-risk vendor, because it usually has administrator access to every system. Ask for its own independent security report, how its engineers sign in to your systems, whether it uses multi-factor authentication and privileged access controls, how it logs and reviews its own access, and how it will tell you about an incident. Our guide to choosing a managed IT provider covers the rest of the questions to ask.
How FinFortify helps
How FinFortify helps with vendor due diligence
FinFortify Inc. is a SOC 2 compliant provider, so we work under the same kind of controls we help clients review. Through our IT compliance services we help you build your vendor inventory, gather and review security information from the technology vendors your firm relies on, set up multi-factor authentication and access controls for vendor accounts, and keep the documentation examiners and auditors ask for.
See also our Regulation S-P compliance checklist and MFA requirements guide. To talk about your vendors, request a quote.
FAQ
Vendor due diligence: frequently asked questions
What is vendor due diligence for a financial firm?
It is the process of checking that a vendor can protect your client data and keep its service running before you sign, putting security terms in the contract and reassessing the vendor over time. Regulators expect it because outsourcing a function does not outsource your responsibility for it.
Does Regulation S-P require vendor oversight?
Yes. Amended Regulation S-P requires covered firms to oversee service providers, including due diligence and monitoring, and to require them to report breaches affecting customer information no later than 72 hours after becoming aware of them.
Is a SOC 2 report enough?
It is a strong starting point, but read it: check the period it covers, any exceptions the auditor found, the services in scope and the controls it says your firm must handle. Then confirm contract terms, multi-factor authentication and breach notice separately.
How often should vendors be reviewed?
High-risk vendors, such as those with administrator access or large amounts of client data, at least once a year; lower-risk vendors on a longer cycle; and any vendor right away after a breach, a major change in its service or a change in ownership.
Get your vendor program in order
Tell us about your firm and we will help you inventory, review and document the technology vendors that hold your client data.
