--- sourceDocument: Australia Governance, Risk, and Compliance sourceDocumentLink: https://www.servicenow.com/docs/r/australia/governance-risk-compliance Release : - australia ft:locale : - en-US ft:publication_title : - Australia Governance, Risk, and Compliance ft:clusterId : - grc bundleId : - grc workflow : - Technology --- # Regulations that affect third-party risk # Regulations that affect third-party risk {#ariaid-title1} Release version: Australia Updated September 10, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Regulations that affect third-party risk When establishing a third-party risk management program, it is crucial for ServiceNow customers to understand and comply with various regulations that impact third-party relationships. These regulations vary based on industry, location, jurisdiction, and operational nature. Consulting legal and compliance experts is essential to identify the applicable regulatory requirements for your specific environment. Show full answer Show less ## Key Regulations Affecting Third-Party Risk Management * **Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF):** Requires verification of third-party identities, assessment of funding sources, and compliance with AML and CTF laws to prevent illicit financial activities. * **Anti-Corruption and Bribery Laws:** Includes laws like the U.S. Foreign Corrupt Practices Act (FCPA) and UK Bribery Act, mandating due diligence to identify and mitigate bribery or corruption risks within third-party operations. * **Data Protection and Privacy Regulations:** Regulations such as GDPR and CCPA demand safeguarding of personal data. Third-party assessments should include evaluation of their data privacy practices to ensure compliance. * **Sanctions and Embargoes:** Companies must verify that third parties are not subject to sanctions or embargoes and do not engage in prohibited trade or activities. * **Financial Regulations:** Industry-specific regulations like the Sarbanes-Oxley Act (SOX) and Dodd-Frank Act require assessment of third parties' financial stability, reporting accuracy, and internal controls. * **Labor and Employment Laws:** Ensure third-party compliance with laws governing wages, working conditions, health and safety, and equal employment to reduce risks of labor violations and reputational damage. * **Environmental Regulations:** Evaluate third parties' adherence to environmental laws, including waste management, pollution control, and sustainability standards, especially if their activities impact the environment. ## Practical Implications for ServiceNow Customers Understanding these regulations supports effective third-party risk management through tailored due diligence and compliance assessments within ServiceNow workflows. This helps mitigate legal, financial, operational, and reputational risks associated with third-party relationships, ensuring adherence to regulatory requirements and promoting trust in your supply chain and service providers. When implementing your third-party risk management program, you must carefully consider the regulations. Applicable regulations vary depending on your industry, geographic location, jurisdiction, and nature of your operations. ## Regulations that typically affect third-party risk management programs {#vrm-regulations__section_qhc_5tt_sxb} You should consult legal and compliance experts to determine the specific regulatory landscape relevant to your third-party relationships. Here's a list of regulations that are typically considered when assessing third-party risk: Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) regulations : These regulations aim to prevent money laundering, terrorist financing, and other illicit financial activities. They require companies to verify the identity of their third parties, assess their sources of funds, and ensure compliance with applicable AML and CTF laws. Anti-Corruption and Bribery laws : Regulations such as the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act impose strict requirements on companies to prevent bribery and corruption. Due diligence helps identify any potential risks related to bribery or corruption in the third party's operations and relationships. Data Protection and Privacy regulations : With the increasing focus on data protection and privacy, regulations like the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) require companies to safeguard personal data. Due diligence includes assessing a third party's data protection and privacy practices to ensure compliance with these regulations. Sanctions and Embargoes : Governments impose sanctions and embargoes on certain countries, individuals, or entities to restrict trade and prevent support for illegal activities. Companies need to ensure that their third parties aren't subject to any sanctions or embargoes and aren't engaged in activities that violate these restrictions. Financial Regulations : Depending on the industry, companies might need to consider financial regulations such as the Sarbanes-Oxley Act (SOX) for publicly traded companies or sector-specific regulations like the Dodd-Frank Act for financial institutions. These regulations often require companies to assess the financial stability, reporting accuracy, and internal controls of their third parties. Labor and Employment Laws : Companies need to ensure that their third parties comply with labor and employment laws, including regulations related to minimum wage, working hours, health and safety, and equal employment opportunities. This helps mitigate risks associated with labor violations and potential reputational harm. Environmental Regulations : Companies might need to evaluate a third party's compliance with environmental regulations, particularly if the third party engages in activities that have an environmental impact. This includes assessing their environmental practices, waste management, pollution control measures, and adherence to sustainability standards.