2026 Third-Party Vendor Request via FINRA Gateway
On Jan. 29, 2026, FINRA published the 2026 Third-Party Vendor Request in FINRA Gateway, asking firms to provide information about their third-party vendors and banks by March 4, 2026.
Overview of the 2026 Third-Party Vendor Request – FINRA is requesting that all firms (including all RSA Exchange Members) submit information related to their critical third-party vendors and banks, which includes all third-party providers that are essential to firms’ operations, processes or functions. The 2026 request builds upon the 2025 Third-Party Vendor Request framework while incorporating new content and functionality enhancements, detailed in the sections below. These enhancements are designed to improve the user experience and make the submission process more efficient. The 2026 request will include pre-populated responses from firm’s 2025 submission. Firms should review the pre-populated information to ensure it is current and update, where appropriate.
Why FINRA is Requesting This Information – Member firms are increasing their reliance on third-party vendors to perform a wide range of core business and regulatory oversight functions; with this broad usage also comes increased risks related to cyber-attacks or outages. Given the critical role of third-party risk management in maintaining robust compliance and market integrity, the information FINRA gains from this request enables us to quickly identify which firms may be impacted by vendor or bank related cybersecurity or operational issues, and provide timely, targeted alerts and mitigation guidance.
Benefit to Firms – As a result of member firm participation in the 2025 Third-Party Vendor Request, FINRA delivered guidance of Cyber Event Impact Assessments (CEIA) to more than 2,350 firms, representing 70 percent of our member firms. The CEIAs and cyber alerts inform firms of vulnerabilities and cyber events impacting third-party vendors they use. Through sharing this intelligence quickly with member firms, FINRA strives to help strengthen member firm resiliency to cyber, fraud and other technology risks.
How to Access the Request – Each firm’s SAA administers access to the 2026 Third-Party Vendor Request in FINRA Gateway via a specific “Information Request Forms–Submit” entitlement; and all individuals with that entitlement will have access to the request. Firms are asked to complete the request by the March 4, 2026.
If you have questions about modifying entitlements, please contact the FINRA Support Center at (800) 321-6273 or [email protected].
Additional Support – Firms may view this reference guide for additional guidance on accessing information requests.
Webinars – For a more detailed overview of the 2026 Third-Party Vendor Request, FINRA is hosting a webinar on Feb. 2, 2026, Register Today, ask questions in advance when you register and join us live to hear directly from FINRA staff.
Questions – Please direct questions regarding the 2026 Third-Party Vendor Request to your Risk Monitoring Analyst (RMA). If you need help identifying your RMA, or if you or your firm’s SAA has entitlement or technical questions, please contact the FINRA Support Center at (800) 321-6273 or [email protected].
Frequently Asked Questions (FAQ) About FINRA’s 2026 Third-Party Vendor Request
- Why can I not see the request?
If you cannot see the request, check with your firm’s SAA to see if you have been granted “Submit” entitlement in the “Information Request Forms” section to view and edit the request.
- What is different from the previous version of this request?
To enhance the user experience and improve efficiency for firms completing this request, FINRA has implemented several system enhancements based on member firm feedback.
- Pre-Populating With 2025 Responses – For firms that completed the 2025 Third-Party Vendor Request, responses from last year will be pre-populated in the 2026 request. Please review these responses to ensure they are accurate. To quickly populate your firm’s previous answers to the current request, click the "Apply" button. After selecting “Apply” a response can be modified/deselected by unchecking the selection in the list.
- Ongoing Updates – Firms' responses to the Third-Party Vendor Request can now be amended throughout the year as needed, ensuring ongoing accurate reporting as firms change critical vendors or banks, and streamlining the process for future submissions.
- Firm Control for Notification Recipients – FINRA developed enhanced functionality in FINRA Gateway to allow member firms to designate specific individuals to receive notification related to certain questionnaires. A message was sent to firms to let them know that this change was required by Jan. 26. Please note that this enhancement does not impact the required entitlement to access the request.
- Pre-Populating With 2025 Responses – For firms that completed the 2025 Third-Party Vendor Request, responses from last year will be pre-populated in the 2026 request. Please review these responses to ensure they are accurate. To quickly populate your firm’s previous answers to the current request, click the "Apply" button. After selecting “Apply” a response can be modified/deselected by unchecking the selection in the list.
- What if the vendor or bank I use is not in a prepopulated list?
If the vendor or bank your firm uses is not in the list, mark the checkbox next to “Other” and then select “Add New.” To enter additional vendors or banks, select “Add New” again.
- Can multiple people work on the request at the same time?
Yes, but it is not recommended. If multiple people are working on the request at the same time, they can overwrite each other’s work. A recommended approach for multiple people working on the request is to print the request and share with others to gather responses and then record final answers in the system to submit.
- Can I save my work and return to it later? If so, where do I locate my unsubmitted work?
You can save your firm’s responses by clicking on the “Save” button and then closing the request. To locate saved responses, search for the request in the “Active” tab and click on the hyperlink. See Quick Reference Guide for more information.
- How do I know the request was successfully submitted?
Confirmation will be provided upon submission within FINRA Gateway, and the request will then be displayed in the “Completed” section under Requests & Filings.
- Can the submission be amended?
Yes, as noted in FAQ #2b, amendments throughout the year are encouraged as you become aware of changes in order to ensure accurate reporting of critical vendors or banks, and to help streamline the process for future submissions. In order to amend your firm’s responses, go the "Completed" tab in "Request & Filings," find the “2026 Vendor Request” and then select "Create Amendment." See Quick Reference Guide for more information.
- If I create an amendment in error, can it be deleted?
No, the amendment must be submitted and cannot be deleted. However, the amendment can be submitted with no changes.
- Can I print out this request and previous submissions?
Yes, the print feature is available for draft versions and completed versions of these requests. The “Print PDF” option is on the bottom left corner of the request.
- Who should I reach out to if I have questions about this request?
For questions regarding the request, contact your Risk Monitoring Analyst listed in FINRA Gateway. For technical support, contact the FINRA Support Center at (800) 321-6273 or email [email protected].