We once quoted a KYC integration straight out of the provider's docs. Writing the code was the easy part. Then their onboarding showed up: sandbox credentials, a compliance review, a go-live checklist nobody had mentioned. We had committed to a date that depended on a queue we didn't own.
So now every third-party dependency gets its own line in the estimate, flagged as a date outside our control. You probably want to know who owns that date on your projects.