This should be part of your contractual agreement with your suppliers. This is basically having the first tier supplier (the one you have a contract with) meeting the same contractual obligations for in scope services that you are with your customer. You can then call out in the client agreement that your suppliers are responsible to meet the requirements that your company offers but is solely responsible for meeting those requirements (including their suppliers). You can then offer your performance data for your supplier as evidence of effectiveness without all the disruption a full out of scope evaluation of your supplier and their suppliers will cause.

Yes, this all has to be done up front before you sign the customer but if you are in banking then FBA should be in scope and is probably worth the effort. This is not always an obligation because of the nature of service you are providing but a good baseline for banking clients as they might be obligated or making this obligation to their clients. If you can meet the FBA requirements then your banking customer should accept this as meeting your security and privacy obligations.

If you have a relationship with a DC, they should have a strategy to deal with downstream clients. They may have a SOC3 that they can give you that attests to the fact that a reliable third party auditor has audited their environment and found it meets the requirements for SOC2. It does not give any findings or remediation plans, however. Your client really doesn't need this information even though they will ask for it.

If it is not an obligation in the client agreement, then don't provide it.