Fourth parties hiding behind your primary vendors
Primary outsourcing agreements often allow subcontracting with little visibility. Payment processors, identity providers, and cloud platforms routinely rely on fourth parties for hosting, messaging, or specialised processing.
In Hong Kong fintech reviews, concentration risk is not only “one vendor” — it is one chain. Ask for subcontracting schedules, geographic locations of processing, and change-notification clauses. Then sample whether those clauses were ever exercised.
If your board papers stop at the contracted name, your concentration view is incomplete.