# Vendor due diligence: Third Party Risk Obligations

> The Third Party Risk Obligations carries 2 published figures read from 2 sources' own pages, from 10,000,000 to 20,000,000 EUR, read 17 October 2026.

Venbix · https://venbix.com/datasets/third-party-risk-obligations/ · computed 2026-10-18

**Range of the published figures:** 10,000,000 to 20,000,000 EUR (range 10,000,000 to 20,000,000 EUR; 2 sources with a figure; 2 of 16 sources read publish one).

2 of the 16 named sources read in full publish a figure; 14 publish none, read 17 October 2026.

## By obligation

| Breakdown | Median | Range | Sources |
|---|---|---|---|
| obligation critical ICT provider representation window | 6 week | 6 to 6 week | 1 |
| obligation personal data retention limit | 15 year | 15 to 15 year | 1 |
| obligation maximum administrative fine, lower tier | 10,000,000 EUR | 10,000,000 to 10,000,000 EUR | 1 |
| obligation maximum administrative fine, higher tier | 20,000,000 EUR | 20,000,000 to 20,000,000 EUR | 1 |

## Every figure, with its source

One row per source: the figure the source's own page publishes, the page, and the day it was read.

| Source | Figure | Breakdown | Read |
|---|---|---|---|
| [GDPR (Regulation (EU) 2016/679) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679) | 20,000,000 EUR | maximum administrative fine, higher tier | 2026-10-17 |
| [GDPR (Regulation (EU) 2016/679) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679) | 10,000,000 EUR | maximum administrative fine, lower tier | 2026-10-17 |
| [DORA (Regulation (EU) 2022/2554) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554) | 15 year | personal data retention limit | 2026-10-17 |
| [DORA (Regulation (EU) 2022/2554) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554) | 6 week | critical ICT provider representation window | 2026-10-17 |

## The sentence each figure was read from (4)

- [GDPR (Regulation (EU) 2016/679) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679), read 2026-10-17: "Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher."
- [GDPR (Regulation (EU) 2016/679) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679), read 2026-10-17: "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:"
- [DORA (Regulation (EU) 2022/2554) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554), read 2026-10-17: "Except where otherwise provided in other sectoral acts, the personal data referred to in paragraph 1 shall be retained until the discharge of the applicable supervisory duties and in any case for a maximum period of 15 years, except in the event of pending court proceedings requiring further retention of such data."
- [DORA (Regulation (EU) 2022/2554) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554), read 2026-10-17: "Within 6 weeks from the date of the notification, the ICT third-party service provider may submit to the Lead Overseer a reasoned statement with any relevant information for the purposes of the assessment."

## Read in full, publishes no figure

- [OCC Bulletin 2023-17: Interagency Guidance on Third-Party Relationships](https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html), read 2026-10-17: read in full and no accepted figure on the page
- [Federal Register: Interagency Guidance on Third-Party Relationships (88 FR 37920)](https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management), read 2026-09-12: read in full and no accepted figure on the page
- [Federal Reserve FRRS: Interagency Guidance on Third-Party Relationships](https://www.federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm), read 2026-09-12: read in full and no accepted figure on the page
- [FFIEC IT Handbook: Outsourcing Technology Services](https://ithandbook.ffiec.gov/it-booklets/outsourcing-technology-services/), read 2026-09-12: read in full and no accepted figure on the page
- [FCA Handbook SYSC 8.1 (outsourcing)](https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html), read 2026-10-17: read in full and no accepted figure on the page
- [FCA: outsourcing and operational resilience](https://www.fca.org.uk/firms/outsourcing-and-operational-resilience), read 2026-10-17: read in full and no accepted figure on the page
- [Bank of England PRA SS2/21: Outsourcing and third party risk management](https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss), read 2026-10-17: read in full and no accepted figure on the page
- [EBA Guidelines on outsourcing arrangements](https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-outsourcing-arrangements), read 2026-09-19: read in full and no accepted figure on the page
- [HHS: HIPAA business associates](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html), read 2026-09-12: read in full and no accepted figure on the page
- [NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management Practices](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final), read 2026-09-12: read in full and no accepted figure on the page
- [OSFI Guideline B-10: Third-Party Risk Management (Canada)](https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline), read 2026-10-03: read in full and no accepted figure on the page
- [PCI Security Standards Council: PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/), read 2026-09-11: read in full and no accepted figure on the page
- [FDIC press release PR-23-47: final interagency guidance](https://www.fdic.gov/news/press-releases/2023/pr23047a.pdf), read 2026-09-12: read in full and no accepted figure on the page
- [OFAC: A Framework for OFAC Compliance Commitments](https://ofac.treasury.gov/media/16331/download?inline), read 2026-09-19: read in full and no accepted figure on the page

## Methodology

Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 2 of the 16 named sources that could be read published a usable figure; 14 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in EUR (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 2 figures, never sentences; 11 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per life-cycle stage (planning, due diligence, contract, monitoring, termination) with the obligation quoted verbatim from the supervisor's own page and its effective date; the derivation is the CROSS-REGIME comparison nobody publishes - which of the fourteen regimes read here require a written agreement, a register of third parties, an exit plan, a right to audit, sub-contractor consent and breach notification, and the shortest notice each allows - plus changed-since on every re-read

## Sources

- [OCC Bulletin 2023-17: Interagency Guidance on Third-Party Relationships](https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html) (the publisher's own terms; quoted for reporting and comment)
- [Federal Register: Interagency Guidance on Third-Party Relationships (88 FR 37920)](https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management) (the publisher's own terms; quoted for reporting and comment)
- [Federal Reserve FRRS: Interagency Guidance on Third-Party Relationships](https://www.federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm) (the publisher's own terms; quoted for reporting and comment)
- [FFIEC IT Handbook: Outsourcing Technology Services](https://ithandbook.ffiec.gov/it-booklets/outsourcing-technology-services/) (the publisher's own terms; quoted for reporting and comment)
- [FCA Handbook SYSC 8.1 (outsourcing)](https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html) (the publisher's own terms; quoted for reporting and comment)
- [FCA: outsourcing and operational resilience](https://www.fca.org.uk/firms/outsourcing-and-operational-resilience) (the publisher's own terms; quoted for reporting and comment)
- [Bank of England PRA SS2/21: Outsourcing and third party risk management](https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss) (the publisher's own terms; quoted for reporting and comment)
- [EBA Guidelines on outsourcing arrangements](https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-outsourcing-arrangements) (the publisher's own terms; quoted for reporting and comment)
- [DORA (Regulation (EU) 2022/2554) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554) (the publisher's own terms; quoted for reporting and comment)
- [GDPR (Regulation (EU) 2016/679) on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679) (the publisher's own terms; quoted for reporting and comment)
- [HHS: HIPAA business associates](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html) (the publisher's own terms; quoted for reporting and comment)
- [NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management Practices](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final) (the publisher's own terms; quoted for reporting and comment)
- [OSFI Guideline B-10: Third-Party Risk Management (Canada)](https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/third-party-risk-management-guideline) (the publisher's own terms; quoted for reporting and comment)
- [PCI Security Standards Council: PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/) (the publisher's own terms; quoted for reporting and comment)
- [FDIC press release PR-23-47: final interagency guidance](https://www.fdic.gov/news/press-releases/2023/pr23047a.pdf) (the publisher's own terms; quoted for reporting and comment)
- [OFAC: A Framework for OFAC Compliance Commitments](https://ofac.treasury.gov/media/16331/download?inline) (the publisher's own terms; quoted for reporting and comment)

## Cite or embed

- The Third Party Risk Obligations carries 2 published figures read from 2 sources' own pages, from 10,000,000 to 20,000,000 EUR, read 17 October 2026.
- 2 of the 16 named sources read in full publish a figure; 14 publish none, read 17 October 2026.
- Third Party Risk Obligations, obligation critical ICT provider representation window: median 6 week across 1 source, read 17 October 2026.
- Third Party Risk Obligations, obligation personal data retention limit: median 15 year across 1 source, read 17 October 2026.
- Third Party Risk Obligations, obligation maximum administrative fine, lower tier: median 10,000,000 EUR across 1 source, read 17 October 2026.
- Third Party Risk Obligations, obligation maximum administrative fine, higher tier: median 20,000,000 EUR across 1 source, read 17 October 2026.

Cite as: "Venbix Third Party Risk Obligations", updated 2026-10-18, https://venbix.com/datasets/third-party-risk-obligations/.

CSV: https://venbix.com/datasets/third-party-risk-obligations.csv
JSON: https://venbix.com/datasets/third-party-risk-obligations.json
Embed (plain HTML, static link back): see https://venbix.com/datasets/third-party-risk-obligations/#median