Concentration hides in “preferred” processors
Preferred vendor lists speed procurement. They also quietly concentrate risk. When every new feature defaults to the same processor or KYC provider, exit clauses and regional failover stop being theoretical — they become the only plan.
A critical-vendor review asks a blunt question: if this third party failed for seventy-two hours, which licence-sensitive journeys stop? Soft Techlab maps that answer to contracts and runbooks. Often the runbooks assume a second vendor that was never onboarded, or a transition window that exceeds contractual notice.
Concentration is a board topic only when someone measures it. Start with the three vendors that touch settlement, identity, and customer data — then check whether preference became dependence without a vote.