In the 2023 interagency guidance, a critical activity is one that could cause a bank to face significant risk if the third party fails to meet expectations. Each bank decides for itself. Software that supports a critical activity gets deeper diligence, tighter contracts and closer monitoring.
This is general information, not legal advice.
The definition in plain words
The guidance lists characteristics of critical activities. They include activities that could cause significant risk if the third party fails, that have significant customer impacts, or that have a significant effect on the bank's financial condition or operations.
It also says criticality is the bank's call. An activity that is critical to one bank may not be to another, so two banks can treat the same vendor differently.
Why it matters to a software vendor
The guidance says risk management should be commensurate with the bank's risk profile and with the criticality of the activity. A marketing analytics widget and a payment authorization service are not reviewed the same way.
If your product sits in a critical activity, expect questions about operational resilience, incident reporting, subcontractors, testing results and exit plans.
Signals your product may be treated as critical
- It moves, holds or decides on customer money or credentials.
- Customers would notice within hours if it stopped.
- It is hard to replace quickly.
- It processes sensitive customer data at scale.
- It depends on subcontractors the bank cannot see.
These are working signals, not a regulatory test. The bank's own assessment decides.
Same product, different treatment
Two banks can use your product for different things. One routes payments through it and treats the activity as critical. Another uses it for internal reporting and does not. Your answers to both should be consistent, but expect different depth, different contract terms and a different review cadence.
What to do if you are likely critical
- Ask the bank how it classified the activity, and listen for the reasoning.
- Prepare resilience evidence: recovery objectives, backup and restore tests, incident response plan.
- Document your subcontractors and where data and subcontractors are located.
- Offer a notification commitment that is specific about timing and channel.
- Draft an exit and data return plan before you are asked.
Where Safeguard fits
Safeguard's asset discovery and SBOM and dependency scanning give you a current inventory of what runs in your product, which makes subcontractor and component questions easier to answer. A free scan is at gold.safeguard.sh/scan.
Quick check
Who decides whether an activity is critical?
The bank decides, based on its own risk profile. The guidance says an activity critical for one bank may not be for another.
Is critical the same as high risk?
Not exactly. Criticality is about the consequence of failure, while risk level also depends on how likely problems are and what controls exist.
Sources
Last reviewed: 19 October 2026.
