This paper sets out the WFE’s position on third-party risk management (TPRM), informed by a meeting with IMF staff and member input through the Enterprise Risk Working Group. Its purpose is to provide a clear, practical and proportionate perspective on how exchanges, CCPs and other financial market infrastructures identify, assess and manage third-party dependencies in an increasingly digital and interconnected operating environment.
The WFE position highlights the growing importance of third-party resilience for market integrity and continuity, while emphasising a risk-based approach to critical services, enterprise-wide risk assessment, proportionality, nth-party dependencies, concentration risk, regulatory fragmentation, information asymmetry and the operational challenges associated with oversight of major cloud, technology and service providers.
Overall, the paper supports internationally coordinated, principles-based frameworks that strengthen resilience without creating unnecessary duplication, prescriptive requirements or disproportionate burdens for MIs.