The third party you cannot audit
Materiality, regulatory lead times on the regulator’s own calendar, and screening against the lists an authority publishes
Third-party risk management in most organisations is a questionnaire sent once a year to suppliers who answer it themselves. Meanwhile the obligations that bite are elsewhere: a materiality judgement, a regulator’s no-objection that has to be requested a fixed number of business days before the arrangement starts, and a screening duty against lists that change weekly.
What this paper establishes
- Four Gulf outsourcing instruments carried as structured obligations, with the regulator’s notice period counted back across its own working calendar.
- Materiality as a recorded judgement with its reason — the determination an inspection reads.
- Screening against the three official sanctions lists, each fetched from its own authority’s host, each used under terms named in the paper, and a malformed release refused rather than screened against.
There is a question a regulated organisation gets asked that no questionnaire platform can answer. Not “do you assess your suppliers”, but: for this particular arrangement, was it material, who decided that, and did you ask us before it started?
That question has a date in it, and the date is set by a calendar the organisation does not control. It is the part of third-party risk that is regulatory rather than merely good practice, and it is the part the tooling ignores.
Four instruments, not one policy
A group operating across the Gulf is held to different outsourcing rules per entity and per licence, and the differences are not cosmetic. Conscious carries four instruments as structured obligations.
| Instrument | Who it binds | Notice before the arrangement starts |
|---|---|---|
| SAMA Rules on Outsourcing, circular 41027017 of 15 December 2019 | Banks | At least fifteen Saudi business days; a foreign bank’s branch, at least thirty days |
| SAMA Rules on Outsourcing for Finance Companies, circular 65338/99 of 13 January 2019 | Finance companies | At least thirty working days before it starts, is renewed, or materially changes |
| CBUAE Outsourcing Regulation and Standards for Banks, C 14/2021 | Banks in the UAE | Non-objection obtained before the change; no day count is set |
| CBUAE Operational Risk Management Regulation, C 1/2026, Article 13, in force 14 September 2026 | Arrangements supporting a critical operation | Non-objection before the change; no day count is set |
That sounds like a small thing until a material arrangement is signed to start on the first of the month and a person works out, two weeks beforehand, that the no-objection request needed to be in before a public holiday. The lead time is computed from the effective date backwards across Saudi or UAE business days, and an arrangement inside the planning margin is shown as at risk before it becomes a finding.
Materiality is a judgement, recorded as one
Every one of these instruments turns on whether an arrangement is material, and that single determination decides whether a regulator has to be asked at all. The platform carries the criteria as questions against the arrangement — nine of them for the banks’ rules — and any criterion met suggests the arrangement is material.
It suggests. A person records the determination and the reason, and the reason is what an inspection reads. A product that computed materiality automatically and filed it would be making a regulatory judgement on behalf of an accountable officer, which is the same boundary that governs every other judgement in this platform.
Screening against the lists an authority publishes
Sanctions screening is where third-party tooling quietly cuts corners, usually by licensing an aggregated dataset whose provenance the buyer never examines. Conscious screens against three lists, each fetched from one fixed address on the authority’s own host and from nowhere else.
| List | Published by | Terms |
|---|---|---|
| Specially Designated Nationals | OFAC, United States Treasury | A work of the United States government, in the public domain |
| Consolidated financial sanctions list | European Union | Reusable with acknowledgement of the source |
| UK Sanctions List | Foreign, Commonwealth and Development Office | Open Government Licence v3.0, with the attribution it requires |
Two engineering decisions behind that are worth stating, because they are the difference between a screening feature and a screening control.
- A release that is not what it claims to be is refusedIf the file is not the list it says it is, the previous release stays in use rather than the register silently screening against nothing.
- A release that has lost its population is refusedA file holding far fewer entries than the list has held in years is a failed download or a changed format, not a mass delisting.
- A release whose own count disagrees with itself is refusedWhere the publisher declares a count, it has to match what was parsed.
Matching an analyst can live with
The cost of a screening control is not the licence. It is the analyst hours spent clearing matches that no reviewer would have accepted, and the judgement that erodes when a queue is mostly noise. The matcher is tuned against that: minimum lengths before a phonetic skeleton is trusted, short words compared only exactly, joined names compared on letters alone — and the tuning verified against the real lists to confirm that genuine designations still match with full confidence.
A re-screen also withdraws a stale undecided match rather than leaving it in the queue, so the list in front of an analyst is the list that still needs a decision. That is the state most screening tools never reach, and it is worth asking any vendor to demonstrate on a workspace that has been running for a few months rather than on a fresh one.
The supplier as one record, not a questionnaire thread
A supplier in this platform is joined to the things that make it risky: the arrangement and its materiality determination, the regulatory notice and its date, the screening result and who dispositioned it, the contractual security obligations the arrangement carries, the controls the organisation relies on the supplier to operate, the evidence received, the incidents involving them, the AI systems they provide, and the processing activities and transfers they create.
That last join is the one a privacy officer cares about and a procurement system cannot make. A supplier processing personal data in another country is a transfer, and the transfer carries its own verdict under the regime that binds the entity. A group that manages suppliers in one system and privacy in another discovers the mismatch during an incident.
Concentration: the risk that is invisible per supplier
The question regulators have moved towards is not whether any single supplier is sound. It is how much of the group depends on the same one, and how many critical operations would stop together. That question cannot be answered from a supplier record at all; it is a property of the portfolio, and it needs the arrangements, the operations they support and the entities they sit under to be in one place.
What to ask any third-party risk platform
- Show me the lead time for a material arrangement under my regulator, counted back on my regulator’s working calendar from the day it starts.
- Where does your product record the materiality determination and the reason for it?
- Which sanctions lists do you screen against, from which addresses, and under what licence?
- What does your system do when a list release fails to download or arrives malformed?
- If a supplier processes personal data abroad, does the transfer appear in my transfer register with a verdict?
- Can you tell me which critical operations would stop if one named supplier failed?
The first and the third separate a regulated-industry product from a questionnaire tool. Most vendors in this category will answer the third with the name of a data provider, and the licence question will go to another team.
Sources
- 1SAMA. Rules on Outsourcing, circular 41027017 of 15 December 2019, and Rules on Outsourcing for Finance Companies, circular 65338/99 of 13 January 2019, read on the SAMA Rulebook. Their text is not reproduced; the platform carries our own paraphrase with the circular referenced beside each criterion.
- 2CBUAE. Outsourcing Regulation and Standards for Banks, C 14/2021; Operational Risk Management Regulation, C 1/2026, Article 13, for arrangements supporting a critical operation, in force 14 September 2026.
- 3Sanctions lists. OFAC’s Specially Designated Nationals list, a work of the United States government in the public domain; the European Union’s consolidated financial sanctions list, reusable with acknowledgement of source; the UK Sanctions List, published by the Foreign, Commonwealth and Development Office under the Open Government Licence v3.0.
- 4Verification caveat. The paragraph numbering of the Gulf circulars was not independently verified when the pack was written. Each criterion is checked by a person against the instrument before it is relied on, and the pack states this where it is used.
About Conscious
Conscious is an independent assurance platform for organisations that answer to more than one authority. It carries 34 privacy regimes with their own transfer rules, breach clocks and subject rights, and 56 control frameworks, 16 of them at the authority’s own wording. Evidence, judgements and approvals sit in one hash-chained record, agents propose and named people decide, and the same instance can run in a customer’s own data centre.
Every figure Conscious publishes is measured from the running product and held to it by a test that fails the build when a document and the catalogue disagree. The verification suites run on the customer’s own instance rather than on ours, the audit record is verifiable by the customer’s own auditor, and the load figures come with the hardware printed beside them. Ask any vendor for the same and compare what comes back.
Put the same questions to us and to the platform you are already paying for. The assessment at consciousgrc.com/assess needs no call and no account, and it prints a record you keep whether or not you ever speak to us.