concentration-risk-review

Drafts a portfolio-level concentration view across the firm's third-party arrangements. Reads single-vendor concentration, sub-contractor (fourth-party) concentration, geographic and jurisdictional concentration, technology-stack concentration (hyperscaler region, foundation-model vendor, shared utility), and sponsor-bank or BaaS concentration against named supervisory thresholds and substitutability tests. Output is a concentration matrix, the concerning concentrations flagged for committee, and a substitutability-grounded recommendation set. The skill stops at the recommendation; the head of TPRM, head of operational resilience, and CRO office decide.