Concentration risk and culture at a single-processor lender
Kestrel Lending is a 300-person online lender. It originates 40% of its loans through a single payment processor, PayBridge, which subcontracts settlement to a small regional provider in another jurisdiction. PayBridge's contract has a 99.9% uptime service level, a 30-day termination right for convenience but no exit assistance, no right to audit subcontractors, and no requirement to notify Kestrel of subcontractor changes. PayBridge has missed two quarterly financial covenants and its credit rating has been downgraded. Kestrel's own incident culture rewards teams for low downtime; near misses are logged only if a customer complains, and the operations bonus is tied to uptime but not to resilience testing. The board has asked for a third-party resilience review after a 6-hour settlement outage last month that PayBridge attributed to the subcontractor. Kestrel has no documented exit plan and does not know how many other clients use the same subcontractor.
1. What are the priority actions for the next 90 days regarding PayBridge? Justify the sequence.
Read the worked answer
Sequence: understand, stabilise, then decide.
- Understand exposure. Quantify the 40% origination flow and customer harm; map the subcontractor and fourth-party dependencies; obtain current financial information and contingency plans from PayBridge; check whether other clients share the same subcontractor.
- Stabilise. Invoke the third-party risk and incident governance; require notification of subcontractor changes and incidents; negotiate information and audit rights, even interim; assess whether the recent outage is a precursor.
- Contingency. Build an exit plan with a realistic onboarding timeline for an alternate processor. Test a manual or alternate settlement route for a small segment. Identify data and customer migration requirements.
- Board decision. Present options: renegotiate with conditions, dual-source, or exit. Include cost, customer impact and regulatory notification.
Do not terminate immediately: continuity risk is higher if the lender cannot migrate. Do not rely on the 99.9% service level; it is a service credit, not a recovery plan. The 30-day termination right is useless without exit assistance and a migration plan.
2. How should Kestrel change its culture and incentives to support third-party resilience? Give specific changes and explain the mechanism.
Read the worked answer
Change what is measured and rewarded. The current operations bonus rewards uptime and therefore discourages reporting of near misses and resilience gaps. Replace or supplement it with balanced measures: near-miss reporting quality, timely closure of resilience actions, third-party assurance coverage, and successful testing against tolerance. Do not reward zero incidents-that incentivises silence.
Specific mechanisms: a blame-free near-miss process with triage and feedback; service owners accountable for third-party dependencies; board reporting of third-party concentration and culture indicators; scenario exercises that include operations, procurement and business staff; and speak-up channels with protected follow-up. Train staff to distinguish reporting from fault.
Culture is reinforced by what leaders do: if the COO celebrates a 6-hour outage as 'handled' without asking what nearly failed, the system learns the wrong lesson. Add a quarterly culture discussion to the risk committee using evidence-reporting rates, action closure, repeat findings-not staff survey scores alone.
3. Evaluate whether the 99.9% service level provides adequate resilience assurance.
Read the worked answer
No. A 99.9% uptime service level is an availability promise, not a resilience assurance. It permits roughly 43 minutes of downtime per month and says nothing about recovery from a severe but plausible event, data integrity, subcontractor failure or exit. Service credits compensate financially but do not restore customer access or regulatory compliance.
The contract lacks the levers that matter: audit rights over subcontractors, notification of subcontractor changes, recovery time and recovery point commitments, exit assistance, data return and deletion, and step-in rights. The subcontractor is a fourth party that Kestrel has not assessed.
A better contract would include tiered criticality, defined recovery objectives aligned to Kestrel's impact tolerance, testing and evidence rights, subcontractor flow-down, concentration reporting, and a funded exit plan. Even then, contract terms are not a substitute for Kestrel's own contingency capability. The board should treat the service level as one input, not as assurance.