What a bank’s vendor review asks an AI supplier.
Arthiq · · 8 min read
A bank won’t judge an AI supplier on its website. It runs a third-party risk review: questionnaires, document requests and contract terms. Knowing what’s coming makes the review shorter for both sides.
1. Evidence of security controls
Most reviews start by asking for a SOC 2 Type II report or an ISO/IEC 27001 certificate, and increasingly ISO/IEC 42001 for AI management. They also want a recent independent penetration test, with the status of any findings.
2. Questionnaires
Expect a standard questionnaire, such as the Shared Assessments SIG or the CSA CAIQ, plus the bank’s own AI addendum: where the model runs, what it was trained on, how it is tested and who can access it.
3. Contract terms
A data processing agreement and a list of sub-processors. Under Singapore’s MAS outsourcing guidelines, audit and access rights for the bank and for MAS. Under DORA, the terms in Article 30, including exit plans for critical services.
4. Resilience and incidents
Continuity and recovery plans with tested recovery times, and a commitment to report incidents fast enough for the bank to meet its own deadlines. Under MAS Notice 644 that can be one hour. Under GDPR Art. 33, the bank, as controller, has 72 hours to notify the supervisory authority, and a supplier acting as processor must tell the bank without undue delay.
The biggest lever
Deploy inside the bank’s environment.
If the model runs in the bank’s own cloud account or data centre and their data never reaches the supplier, the supplier is no longer processing that data. The review usually becomes lighter and faster, because the bank’s own controls cover it.
5. Model risk documentation
Banks treat an LLM as a model under their model risk policy. They’ll want a model card, test results, known limits and a change policy, mapped to frameworks such as PRA SS1/23 or the MAS Guidelines on Artificial Intelligence Risk Management. SR 26-2 largely excludes generative and agentic AI from its formal scope; we document LLM systems to its principles.
What to prepare
- A pre-answered questionnaire library.
- Contract clauses written for outsourcing rules.
- An architecture that keeps client data under client controls.
- Test results and model documentation your client’s second line can rerun.