Risk Assessment and Due Diligence of Third Parties
Risk assessment
Third-party risk is assessed before appointment and throughout the relationship. Score country risk, sector risk, government touchpoints, payment structure, use of intermediaries and the counterparty’s ownership. Distinguish inherent risk (before controls) from residual risk (after controls).
Due diligence
Proportionate due diligence should verify identity and beneficial ownership, screen against sanctions and politically exposed person lists, search adverse media, review financial statements and references, and check whether the third party has real operations. Enhanced due diligence is needed for high-risk agents, consultants, distributors and customs brokers. Document the rationale and approvals.
Contract and monitoring
Use anti-bribery representations, audit rights, payment controls, training obligations, certification and termination rights. Monitor changes in ownership, bank accounts, fees and performance. A contract clause does not replace verification.
Worked example
An agent in a high-risk country is owned by an offshore company, has no staff and asks for 20% commission. The commission level alone is not conclusive, but the opaque ownership and lack of capability are red flags. Enhanced due diligence must identify the beneficial owner and confirm services. If ownership cannot be verified, decline or exit.
Traps
Treating due diligence as a one-off onboarding step. Relying on the agent’s self-certification. Assuming a signed ABC clause cures red flags. Ignoring beneficial ownership because the name is not on a sanctions list.