Third-party service provider
External vendor providing technology or outsourced services.
How the laws define this
Both frameworks agree that a third-party service provider is an external entity engaged to supply technology, infrastructure, systems, or functions that create outsourcing and technology or third-party risks. To address these risks, both instruments mandate due diligence, contractual protections, and contingency or exit arrangements. The primary divergence lies in their scope of covered institutions and specific operational controls. The Securities Commission Malaysia Guidelines on Technology Risk Management (GTRM) applies to entities serving a CME, explicitly extending obligations to subcontractors while mandating vendor governance controls like audit rights and subcontractor mapping. Conversely, the Bank Negara Malaysia Policy Document on Risk Management in Technology (RMiT) governs providers engaged by financial institutions, explicitly citing cloud service providers and requiring ongoing monitoring alongside service level agreements.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
Definitions (2)
An external entity engaged to provide technology, infrastructure, or other services to a CME, including subcontractors; subject to due diligence, contractual security/data protection clauses, audit rights, subcontractor mapping and contingency/exit arrangements under the GTRM. The term frames vendor governance and outsourcing obligations.
An external entity engaged by a financial institution to provide services, functions or systems (including cloud service providers) which may create outsourcing and third‑party risks; the PD requires due diligence, contractual protections, monitoring, SLAs and exit strategies for such providers.
Related Terms
supplier
Vendors and external service providers to public bodies....
Service Provider
Entities providing digital, networked or platform services....
Service Provider (data intermediary)
Third‑party processors handling personal data for clients....
AI service providers
Entities offering AI-enabled functionality to end users....
Platform operator
Entity operating a data- or AI-sharing platform....