A consumer finance platform depends on many third parties whose failures are its regulatory problem. What must the architecture provide?

The premise

Outsourcing the function does not outsource the accountability. A regulator holds the institution responsible for a provider's failure, which makes the provider's reliability, security and compliance an architectural concern rather than a procurement one.

What the architecture must provide

• Per-provider isolation: workers, queues, concurrency limits, retry policy and circuit breakers derived from that provider's observed behaviour. One policy across many heterogeneous providers is guaranteed wrong for nearly all, and a slow provider consuming every worker turns their bad afternoon into your outage.
• A capability and reliability record per provider, since consumers of your platform need to know what is supported and support engineers need to know what is known-unreliable.
• Graceful degradation when a provider is unavailable, with the behaviour decided by product and risk rather than by whatever the timeout handler does.
• An unknown-outcome path, since a timeout on a provider call is not a failure but an absence of information — and a system with only success and failure will guess, which for anything financial produces duplicates or losses.
• Reconciliation against each provider's own record, which is the only control that detects a divergence the resilience patterns cannot see.
• Evidence of the provider's performance against its commitments, retained, since that is what a regulator asks for.

The concentration question

Which providers are single points of failure with no alternative, and what the exit path is. A regulator increasingly asks this specifically, and the answer must be evidenced rather than asserted.

An alternative provider that has never been used is an assumption, and the credible version is a periodically exercised secondary — which costs money and is the difference between a plan and a claim.

The data dimension

What each provider receives, under what basis, with what retention and what deletion obligation. A provider processing personal data is a processor with obligations that flow through the contract, and deletion must propagate to them — which requires knowing what they hold and having a mechanism to instruct removal.

That is frequently absent, and it is discovered when a data subject exercises erasure.