August 22, 2023
Financial Stability Board
Bank for International Settlements
Centralbahnplatz 2, CH-4002 Basel, Switzerland
Japanese Bankers Association

JBA comments on the FSB Consultative Document: “Enhancing Third-Party Risk
Management and Oversight: A toolkit for financial institutions and financialauthorities”
Dear Sirs/Madams:
The Japanese Bankers Association 1 (JBA) appreciates the opportunity to provide our comments on theFinancial Stability Board’s (FSB) Consultative Document: “Enhancing Third-Party Risk Management andOversight: A toolkit for financial institutions and financial authorities”2 released on 22 June 2023.
We hope that our comments will contribute to further discussions at the FSB.

Responses to specific questions
Q2: Are the scope and general approaches of the toolkit appropriate?
We welcome that the tool kits primarily focus on critical services. If it is simply about third-party service
relationships, excessive risk management may be required for services at financial institutions with fewer risks,such as procurement and lease contracts. We welcome the approach to focus on critical services when managing
risks where resources at financial institutions are limited and risks need to be managed efficiently.
Q6: Are there any tools that financial institutions could use in their onboarding and ongoing
monitoring of service providers that have not been considered? Are there specific examples
of useful practices that should be included in the toolkit?
It is understandable that financial institutions should judge whether or not a third party has the ability andexperience regarding critical services, and they are familiar with the operations of the financial institution. On
the other hand, it is difficult to judge what can be deemed as "having the ability, being familiar." Therefore, wewould like the FSB to share best practices among member countries and facilitate financial authorities to provide
them to financial institutions in order to better understand and judge the ability and experience of third parties.

1The Japanese Bankers Association is the leading trade association for banks, bank holding companies and bankers associations inJapan. As of August 22, 2023, JBA has 114 Full Members (banks), 3 Bank Holding Company Members (bank holding companies), 76
Associate Members (banks & bank holding companies), 51 Special Members (regionally-based bankers associations) and one SubAssociate Member for a total of 245 members.
2 https://www.fsb.org/2023/06/enhancing-third-party-risk-management-and-oversight-a-toolkit-for-financial-institutions-and-financialauthorities-consultative-document/1

Q8: Are the tools appropriate and proportionate to manage supply chain risks? Are there anyother actionable, effective and proportionate tools based on best practices that financial
institutions could leverage? Are there any other challenges not identified in the toolkit?
It is preferred to have the ability to revise contractual provisions, as described in 3.5.3, "in a proportionate andrisk-based manner." On the other hand, if a contract between a financial institution and a third party is to include,for example, the right to audit information leaks from a third party, it may be difficult for third parties tounderstand why they should comply with provisions that are in line with guidelines from financial authorities,
even in cases where there is no direct supervision. In such cases, binding forces such as laws and regulations
are necessary if financial institutions need to collect information about third-party service providers’ supplychains and monitor its risk. We would like to ask the FSB to facilitate cross-sectoral coordination with regulators
to support the understanding of why financial institutions demand third parties to comply with provisions.
Q14: Are there any thoughts on financial authorities’ identification/designation of service
providers as critical from a financial stability perspective?
While it is possible for banks to manage what they are outsourcing to which service providers, it is difficult toidentify what other financial institutions are outsourcing to which service providers. Against this backdrop, if
the authorities could show the extent of concentration through, for example, mapping, it would be possible forfinancial institutions to consider responses to concentration risks (responses that could lead to advanced risk
management, such as considering alternative firms or review contingency plans), which could enable more
effective risk management in the financial sector.
***

We thank the FSB for the opportunity to comment on the Consultative Document and hope our comments willcontribute to further consideration in the FSB.
Yours faithfully,
Japanese Bankers Association2