Banking Agencies Propose More Prescriptive Third-Party Risk Management Framework

Proposed guidance would require specific elements in bank policies and programs and could give added significance to FDIC’s proposed industry standard-setting organization

Executive Summary

The federal banking agencies have proposed new third-party risk management guidance that is more prescriptive than its emphasis on a “risk-based” approach might suggest. In addition to calling for risk-based oversight, the proposal identifies specific elements that banks should address in board-approved policies and throughout the life cycle of third-party relationships, including due diligence, contracting, ongoing monitoring, documentation, remediation, and termination.

The proposal is particularly significant when considered alongside the agencies’ separate statement acknowledging the difficulties community banks face in dealing with core service providers. It also sheds new light on the FDIC’s recently reported consideration of an industry standard-setting organization for third-party service providers. Standardized industry standards, assessments, and certifications could potentially reduce the substantial duplication associated with banks independently conducting due diligence on the same providers, while still preserving each bank’s responsibility to assess the risks of its particular relationships.

The result could be a two-sided framework: more explicit expectations for banks on one side, coupled with greater standardization and transparency among third-party providers on the other. Whether that ultimately reduces the burden of third-party risk management, or simply formalizes and redistributes it, will depend significantly on the final guidance and the development of the FDIC’s proposed industry standard-setting initiative.

The federal banking agencies have proposed a new framework for managing relationships with third-party service providers that is more prescriptive than its ‘risk-based’ label suggests.

The Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Federal Reserve Board, and National Credit Union Administration have proposed replacing the existing interagency guidance on third-party relationships. At the same time, the FDIC, OCC, and Federal Reserve issued a statement addressing community banks’ relationships with core service providers (providers of core banking and data-processing platforms) while the Federal Reserve separately proposed a guide for traditional community banking organizations.

The three developments are important individually, but they are also significant when viewed against the FDIC’s recently reported effort to establish a Banking Industry Standards Development Organization, or BISDO, for third-party service providers. As we discussed in our August 17 blog, the concept would involve industry-developed standards and certifications for third-party providers. BISDO would function as a self-regulatory body developing common due-diligence standards and issuing certifications for third-party providers.

The proposed guidance now provides an important additional piece of the puzzle. It describes in considerable detail what banks are expected to do to manage third-party relationships. The potential value of standardized industry practices, documentation, assessments, and certifications becomes much more apparent when viewed against those expectations.

The proposed guidance goes well beyond general principles

The proposed guidance retains the fundamental premise that a bank cannot outsource its responsibility for complying with applicable law and managing the risks associated with an activity. A bank remains responsible for identifying, assessing, monitoring, and controlling the risks arising from its relationships with third parties.

But the proposal then translates that principle into a fairly detailed risk-management framework.

Among other things, the guidance contemplates that a bank’s third-party risk-management program should be supported by a board-approved policy. The policy should establish the bank’s overall approach to third-party relationships and address such matters as the roles and responsibilities of the board and management, the processes for identifying and assessing third-party risks, the procedures governing due diligence and ongoing monitoring, and the circumstances under which heightened controls are appropriate.

The proposed guidance also identifies specific elements that should be addressed in a bank’s third-party risk-management policy. Those include:

• the bank’s overall strategy, objectives, and governance structure for third-party relationships, including the roles of the board, senior management, and other personnel;
• procedures for identifying, assessing, and conducting due diligence on the risks associated with third-party relationships;
• requirements for contracts, ongoing monitoring of performance and risk, and documentation and reporting of risk-management activities;
• processes for escalation, remediation, and termination of relationships when necessary.

The proposal also contemplates that a bank’s third-party risk-management practices should cover the life cycle of a relationship, from planning and due diligence through contracting, ongoing monitoring and, ultimately, termination.

That is substantially more concrete than simply telling banks to “manage third-party risk.”

Due diligence remains a key responsibility

The proposed framework places particular emphasis on due diligence before a bank enters into a third-party relationship.

The bank is expected to conduct due diligence commensurate with the risks presented by the relationship. Among the matters that may need to be considered are the third party’s financial condition, experience and reputation, legal and regulatory compliance, information-security practices, operational resilience, business continuity capabilities, use of subcontractors, insurance coverage, and ability to provide the services the bank requires.

The extent of the diligence is supposed to be tailored to the relationship. But the proposal makes clear that a bank should not simply accept a third party’s representations at face value when the relationship presents material risks.

This raises an important practical issue for banks that use large, established service providers. A bank may have relatively little negotiating leverage to obtain the information it would ideally like to receive. That problem is addressed directly in the agencies’ separate statement concerning core service providers.

The core-provider statement recognizes an important practical problem

The FDIC, OCC, and Federal Reserve acknowledge that community banks can face significant difficulties when dealing with core service providers.

A bank may be told that certain contractual provisions are nonnegotiable. It may have difficulty obtaining information necessary to conduct due diligence. It may have limited ability to obtain meaningful audit rights or other assurances. And changing providers can be extremely costly and disruptive.

Those realities matter because the proposed third-party risk-management framework places responsibility on the bank for activities over which it may have limited practical control.

The agencies’ statement indicates that supervisors will take those circumstances into account. That is a welcome recognition that a bank’s third-party risk-management program cannot be evaluated in a vacuum.

It also creates an interesting tension in the overall framework. The agencies are telling banks to exercise substantial oversight of third parties while acknowledging that, in some cases, the bank may have limited leverage over the provider.

That tension may be one reason why standardized industry practices could become increasingly important.

Where BISDO could fit

This is where the FDIC’s proposed industry standard-setting organization becomes particularly interesting.

Our August 17 blog described the reported BISDO concept and the possibility that it could develop standards and certifications for third-party service providers. The proposed guidance provides a much clearer indication of the problem that such an organization could help address.

Consider the due-diligence burden alone. If every bank independently has to evaluate the financial condition, cybersecurity controls, operational resilience, compliance systems, business continuity arrangements, subcontracting practices and other characteristics of every significant third-party provider, the result can be enormous duplication.

The problem is particularly acute for fintechs and other providers that serve numerous banks. The provider may receive essentially the same due-diligence requests from dozens of institutions, each using somewhat different questionnaires, standards and documentation requirements.

A credible industry standard-setting organization could potentially reduce that duplication by developing common standards against which providers could be evaluated. A certification based on those standards could then become one component of a bank’s own due-diligence process.

That would not eliminate the bank’s responsibility. Indeed, the proposed guidance makes clear that banks retain responsibility for their third-party relationships. But standardized information and independent assurance could make it considerably easier for a bank to satisfy that responsibility.

This may be the most important connection between the two FDIC initiatives.

Certification would not eliminate bank responsibility

There is an important qualification. The FDIC’s reported BISDO concept does not appear to contemplate a regulatory safe harbor. Compliance with an industry standard would not automatically establish that a bank has satisfied its supervisory obligations.

That limitation is consistent with the proposed guidance. The bank still has to determine whether a particular third party is appropriate for the particular service and risk involved.

A certification also could not answer every question. A bank’s risk depends not only on the provider but on what the bank is asking the provider to do, the nature of the bank’s customers, the criticality of the service, the data involved, the applicable legal requirements, and the bank’s own risk profile.

Thus, even if BISDO comes into existence, a bank presumably could not simply check a box indicating that a provider is certified and dispense with further analysis. But certification could nevertheless become a valuable piece of evidence in the bank’s overall due-diligence and monitoring process.

The potential significance for fintechs

The proposed framework could be particularly important for fintech companies that provide services to multiple banks.

The current environment can require a fintech to respond separately to extensive and overlapping due-diligence requests from each bank partner. The proposed guidance could reinforce banks’ incentives to demand detailed information and contractual protections.

An effective industry standard-setting organization could provide a counterweight by creating common expectations that apply across bank-provider relationships.

For fintechs, that could reduce the cost of demonstrating compliance. For banks, it could provide greater consistency and potentially greater confidence in the information being provided.

But much will depend on how the standards are developed, who participates in their development, how certifications are awarded, how often they are updated, and whether the banking agencies give meaningful supervisory weight to them. Those questions remain unresolved.

A significant development, but not deregulation

The proposed guidance therefore should not be viewed simply as a relaxation of the agencies’ previous approach to third-party risk management.

There is certainly a greater emphasis on proportionality and risk-based decision-making. But the proposal also lays out a substantial set of expectations concerning governance, policies, due diligence, contracts, monitoring, documentation, reporting, remediation, and termination. For many banks, particularly smaller institutions, the practical effect could be to require a more formalized third-party risk-management program.

At the same time, the agencies appear to recognize that banks cannot effectively manage these risks if third-party providers are unwilling to provide the information or contractual protections that banks need.

That is what makes the three developments announced this week, and the FDIC’s BISDO initiative announced last month, particularly interesting when considered together.

The agencies appear to be pursuing two complementary objectives: establish clearer expectations for what banks must do to manage third-party risk, while exploring whether greater standardization on the provider side can make those expectations more achievable.

Whether that approach ultimately reduces regulatory burden or simply shifts it will depend heavily on how the final guidance is written and, perhaps even more importantly, whether BISDO develops into a credible mechanism for producing standards and certifications that regulators, banks, and service providers can actually use.

Comments on the proposed interagency guidance and the Federal Reserve’s proposed community-bank guide will provide the industry with an opportunity to address that question directly.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.