Third-Party Model Risk: Advanced Due Diligence and Contractual Oversight for Embedded AI/ML Solutions in SaaS Core Banking and Risk-as-a-Service Platforms -- A Model Governance and Regulatory Risk Framework for Financial Institutions.

The transformation of financial institutions toward modular, platform-based operating models has altered how quantitative and algorithmic decision systems are developed, deployed, and governed. Software-as-a-Service (SaaS) core banking platforms and Risk-as-a-Service (RaaS) providers increasingly embed externally developed Artificial Intelligence (AI), Machine Learning (ML), and quantitative models into functions such as credit underwriting, fraud detection, capital estimation, and regulatory reporting. While this shift offers meaningful efficiency and analytical benefits, it also introduces a structurally distinct form of model risk driven by external control, limited transparency, continuous vendor-managed change, and increasing concentration on a small number of technology providers.Existing regulatory frameworks including the Federal Reserve’s SR 11-7, the UK Prudential Regulation Authority’s SS1/23, the EU’s Digital Operational Resilience Act (DORA), and the Monetary Authority of Singapore’s Technology Risk Management (TRM) Guidelines establish that institutions retain responsibility for the governance and risk management of third-party models [1–4]. However, these frameworks are intentionally principle-based and provide limited operational guidance on how to govern, validate, and evidence effective challenge over opaque, externally operated models in practice.