Some companies do not allow banks to negotiate changes to their standard contract, do not share their business resumption and disaster recovery plans, do not allow site visits, or do not respond to a bank's due diligence questionnaire. In the event the third party is unable to provide services as agreed, the contract permits the banking organization to terminate the service without being assessed a termination penalty and provides access to data in order to transfer services to another provider for continuity of operations. A material or significant contract with a third party typically prohibits assignment, transfer, or subcontracting by the third party of its obligations to another entity without the banking organization's consent. Banks may engage with a number of information-sharing organizations to better understand cyber threats to their own institutions as well as to the third parties with whom they have relationships. The use of third parties can offer banking organizations significant advantages, such as quicker and more efficient access to new technologies, human capital, delivery channels, products, services, and markets. Proposed interagency guidance and request for comment. Traditionally, banks use the terms vendor or outsource to describe business arrangements and often use these terms instead of third-party relationships. The proposed guidance sets forth considerations with respect to the management of risks arising from third-party relationships. Tuniu (founded by Donald Yu) becomes Chinas leading packaged tours operator. The proposed supervisory guidance[1] An effective board oversees risk management implementation and holds management accountable. Refer to OCC Bulletin 2019-62, Consumer Compliance: Interagency Statement on the Use of Alternative Data in Credit Underwriting, for more information about compliance risk management considerations regarding the use of alternative data. Some individual bank-specific responsibilities include defining the requirements for planning and termination (e.g., plans to manage the third-party service provider relationship and development of contingency plans in response to termination of service), as well as. In some instances, banks serve only as facilitators for the fintech companies' products or services with one of the products or services coming from the banks. 7. 12. Evaluate processes for escalating, remediating, and holding management accountable for concerns identified during audits or other independent tests. In what ways, if any, could the proposed description of third-party relationships be clearer? Evaluate the overall effectiveness of the third-party relationship and the consistency of the relationship with the banking organization's strategic goals; Assess changes to the third party's business strategy, legal risk, and its agreements with other entities that may pose conflicting interests, introduce risks, or impact the third party's ability to meet contractual obligations; Evaluate the third party's financial condition and changes in the third party's financial obligations to others; Review the adequacy of the third party's insurance coverage; Review relevant audits and other reports from the third party, and consider whether the results indicate an ability to meet contractual obligations and effectively manage risks; Monitor for compliance with applicable legal and regulatory requirements; Assess the effect of any changes in key third party personnel involved in the relationship with the banking organization; Monitor the third party's reliance on, exposure to, performance of, and use of subcontractors, as stipulated in contractual requirements, the location of subcontractors, and the ongoing monitoring and control testing of subcontractors; Determine the adequacy of any training provided to employees of the banking organization and the third party; Review processes for adjusting policies, procedures, and controls in response to changing threats and new vulnerabilities and material breaches or other serious incidents; Monitor the third party's ability to maintain the confidentiality and integrity of the banking organization's systems and information, including the banking organization's customers' data if received by the third party; Review the third party's business resumption contingency planning and testing and evaluate the third party's ability to respond to and recover from service disruptions or degradations and meet business resilience expectations; and. Screen-scraping can pose operational and reputation risks. 8. Consider any conformity assessment or certification by independent third parties related to relevant domestic or international standards (for example, those of the National Institute of Standards and Technology (NIST), Accredited Standards Committee X9, Inc. (X9), and the International Standards Organization (ISO)).[17]. Evaluate the third party's depth of resources and any previous experience in meeting the banking organization's expectations. critical activities and how a bank can determine the risks associated with third-party relationships. When technology is a major component of the third-party relationship, review both the banking organization's and the third party's information systems to identify gaps in service-level expectations, technology, business process and management, or interoperability issues. Consider including indemnification clauses that specify the extent to which the banking organization will be held liable for claims that cite failure of the third party to perform, including failure of the third party to obtain any necessary intellectual property licenses. Use the PDF linked in the document sidebar for the official electronic format. Evaluate whether the third party has insurance coverage for areas that may not be covered under a general commercial policy, such as its intellectual property rights and cybersecurity. 23, a SOC 1, type 2, report may be particularly useful, as standards of the American Institute of Certified Public Accountants require the auditor to determine and report on the effectiveness of the client's internal controls over financial reporting and associated controls to monitor relevant subcontractors. Some banks assign a criticality or risk level to each third-party relationship, whereas others identify critical activities and those third parties associated with the critical activities. In such an instance, a bank has a business arrangement with the appraisal management company that the bank uses.2, Professional service providers: Service providers such as law firms, Start Printed Page 38197consultants, or audit firms often provide professional services to banks. legal research should verify their results against an official edition of How should bank management address third-party risk management when using a third-party model or a third party to assist with model risk management? Consistent with OCC Bulletin 2013-29, a bank that has a business arrangement with a cloud service provider has a third-party relationship with the cloud service provider. What should a bank consider when entering a marketplace lending arrangement with nonbank entities? [5] What other aspects of third-party relationships, if any, should the guidance consider? For example, as explained in FAQ No. The position of the flag indicates whether the organization is partisan. 9. Banking organizations with limited resources for security often depend on support from third parties or on security tools provided by third parties to assess information security risks. regulatory information on FederalRegister.gov with the objective of In such an arrangement, the bank's customer authorizes the sharing of information and the bank typically is not receiving a direct service or financial benefit from the third party. Banking organizations periodically re-assess existing relationships to determine whether the nature of an activity subsequently becomes critical. Dated at Washington, DC, on July 12, 2021. Personnel in control functions such as audit, risk management, and compliance programs should be involved in the management of third-party relationships. Comments must be received no later than September 17, 2021. Could cause a banking organization to face significant risk if the third party fails to meet expectations; require significant investment in resources to implement the third-party relationship and manage the risk; or. Banks typically allow for the sharing of customer information, as authorized by the customer, with data aggregators to support customers' choice of financial services. Stipulate the third party's responsibility for backing up and otherwise protecting programs, data backup, periodic maintenance for cybersecurity issues that emerge over time, and maintaining current and sound business resumption and business continuity plans. Types of insurance coverage may include fidelity bond; cybersecurity; liability; property hazard and casualty; and intellectual property. Federal savings associations are subject to similar requirements set forth in 12 U.S.C. In other words, the SOC 1 type 2 report will address the question as to whether the third party has effective oversight of its subcontractors. A banking organization's use of third parties does not diminish the respective responsibilities of its board of directors to provide oversight of senior management to perform the activity in a safe and sound manner and in compliance with applicable laws and regulations, including those related to consumer protection.[11]. Open for Comment, Economic Sanctions & Foreign Assets Control, Exclusive Economic Zone Fisheries Off Alaska, National Oceanic and Atmospheric Administration, Taking Additional Steps To Address the National Emergency With Respect to the Situation in Nicaragua, Lowering Prescription Drug Costs for Americans, Office of the Comptroller of the Currency, C. Tailored Approach to Third-Party Risk Management, E. Due Diligence and Collaborative Arrangements, f. Qualifications and Backgrounds of Company Principals, k. Incident Reporting and Management Programs, p. Conflicting Contractual Arrangements With Other Parties, c. Responsibilities for Providing, Receiving, and Retaining Information, d. The Right To Audit and Require Remediation, e. Responsibility for Compliance With Applicable Laws and Regulations, i. documents in the last year, by the Rural Housing Service Performance measures should not incentivize undesirable performance or behavior, such as encouraging processing volume or speed without regard for timeliness, accuracy, compliance requirements, or adverse effects on banking organization customers. Bank management should determine the risks associated with each third-party relationship or category of relationship. integrating the use of product and delivery channels into the bank's strategic planning process and ensuring consistency with the bank's internal controls, corporate governance, business plan, and risk appetite. A Notice by the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Comptroller of the Currency on 07/19/2021. Capabilities, resources, and the time frame required to transition the activity while still managing legal, regulatory, customer, and other impacts that might arise; Potential third-party service providers to which the services could be transitioned; Risks associated with data retention and destruction, information system connections and access control issues, or other control concerns that require additional risk management and monitoring during and after the end of the third-party relationship; Handling of joint intellectual property developed during the course of the business arrangement; and. ongoing benchmarking of service provider performance against the contract or service-level agreement. A banking organization may involve experts across disciplines, such as compliance, risk, or technology officers, legal counsel, and external support where helpful to supplement the qualifications and technical expertise of in-house staff.Start Printed Page 38189. Banks may be using or contemplating using a broad range of alternative data in credit underwriting, fraud detection, marketing, pricing, servicing, and account management.15 For the purpose of this FAQ, alternative data mean information not typically found in the consumer's credit files at the nationwide consumer reporting agencies or customarily provided by consumers as part of applications for credit.16, When contemplating a third-party relationship that may involve the use of alternative data by or on behalf of the bank, bank management should:[17], By order of the Board of Governors of the Federal Reserve System. and the OCC's 2013 guidance and its 2020 FAQs. Many third parties provide banks with reports of independent certifications or validations of the third-party model. When an appraisal is requested, the bank enters into an agreement with an individual appraiser. (Originally FAQ No. Supervisory guidance outlines the agencies' supervisory practices or priorities and articulates the agencies' general views regarding appropriate practices for a given subject area. could have major impact on bank operations if the bank has to find an alternative third party or if the outsourced activities have to be brought in-house. 10. 9. on A bank's relationships with vendors or entities to which banks outsource bank functions or activities do not represent the only types of business arrangements. Use of such external services does not abrogate the responsibility of the board of directors to decide on matters related to third-party relationships involving critical activities or the responsibility of management to handle third-party relationships in a safe and sound manner and consistent with applicable laws and regulations. What factors should a banking organization consider in determining the types of subcontracting it is comfortable accepting in a third-party relationship? 3 in OCC Bulletin 2017-21), 7. Gobi invests in Chinese online travel agency Tunius Series A round. The degree of due diligence should be commensurate with the level of risk and complexity of each third-party relationship. Nixon's advisers at the White House ask Mark Felt how to ask J. Edgar Hoover to step aside as the FBI director. 6. The OCC issued the 2020 FAQs to clarify the OCC's 2013 third-party risk management guidance. performing sound analysis to support the decision that the specific third party is the most appropriate third party available to the bank. Refer to OCC News Release 2015-1, Collaboration Can Facilitate Community Bank Competitiveness, OCC Says, January 13, 2015. The proposed guidance describes the third-party risk management life cycle and identifies principles applicable to each stage of the life cycle, including: (1) Developing a plan that outlines the banking organization's strategy, identifies the inherent risks of the activity with the third party, and details how the banking organization will Start Printed Page 38185identify, assess, select, and oversee the third party; (2) performing proper due diligence in selecting a third party; (3) negotiating written contracts that articulate the rights and responsibilities of all parties; (4) having the board of directors and management oversee the banking organization's risk management processes, maintaining documentation and reporting for oversight accountability, and engaging in independent reviews; (5) conducting ongoing monitoring of the third party's activities and performance; and (6) developing contingency plans for terminating the relationship in an effective manner. Winning Time: The Rise of the Lakers Dynasty is an American sports drama television series created by Max Borenstein and Jim Hecht for HBO, based on the book Showtime: Magic, Kareem, Riley, and the Los Angeles Lakers Dynasty of the 1980s by Jeff Pearlman.The first season, comprising 10 episodes, chronicles the 1980s Showtime era of the Los Angeles Confirm that the third party regularly tests its operational resilience in an appropriate format and frequency. Third parties can fail to manage their subcontractors with the same rigor that the bank would have applied if it had engaged the subcontractor directly. The following are examples of different types of interactions that banks might have with data aggregators. Many third-party models can be customized by a bank to meet its needs. The benefit of this arrangement is that the third party can provide the same information to many banks using a standardized questionnaire. A banking organization's third-party risk management program should be commensurate with its size, complexity, and risk profile as well as with the level of risk and number of the banking organization's third-party relationships. More extensive due diligence is particularly important when a third-party relationship is higher risk or where it involves critical activities. To what extent does the guidance provide sufficient utility, relevance, comprehensiveness, and clarity for banking organizations with different risk profiles and organizational structures? It should not be a one-time assessment conducted at the beginning of the relationship. In what ways could the proposed description of critical activities be clarified or improved? when cloud computing providers are in a third-party relationship with a bank. the official SGML-based PDF version on govinfo.gov, those relying on it for Such examinations may evaluate safety and soundness risks, the financial and operational viability of the third party, the third party's ability to fulfill its contractual obligations and comply with applicable laws and regulations, including those related to consumer protection (including with respect to fair lending and unfair or deceptive acts or practices), and BSA/AML and OFAC laws and regulations. The level of due diligence and oversight should be commensurate with the risk associated with the activity or data using cloud computing. require significant investment in resources to implement third-party relationships and manage risks. documents in the last year. 11 in this bulletin for more information about a third party's subcontractors. Mere involvement in a critical activity does not necessarily make a third party a critical third party. An aggregator may be a generic provider of data to consumer fintech application providers and other third parties, or the aggregator may be part of a company providing branded and direct services to consumers. Based on that analysis, data that present greater compliance risk warrant more robust compliance management. 0 For example, a large service provider delivering office supplies might be low risk; a small service provider in a foreign country that provides information technology services to a bank's call center might be considered high risk. A banking organization can be exposed to substantial financial loss if it fails to manage appropriately the risks associated with third-party relationships. Can banks obtain access to interagency technology service providers' (TSP) reports of examination? (Originally FAQ No. documents in the last year, 860 Third parties and banking organizations enter into a wide variety of business arrangements, including ones in which the banking organizations make parts of their information systems available to a third party that will directly engage with the end customer. Password requirements: 6 to 30 characters long; ASCII characters only (characters found on a standard US keyboard); must contain at least 4 different symbols; Data aggregators are entities that access, aggregate, share, or store consumer financial account and transaction data that they acquire through connections to financial services companies. Banking organizations are engaging in different types of relationships[6] In a statement, Curl celebratedOff The Press'searly success: "This is only the beginning. The level of due diligence and ongoing monitoring should be consistent with the level of risk and complexity posed by each third-party relationship. could cause the bank to face significant risk if a third party fails to meet expectations. by the Internal Revenue Service Understand the third party's metrics for its information systems and confirm that they meet the banking organization's expectations. The OCC expects banks to have more comprehensive and rigorous management of third-party relationships that involve critical activities. 15. The Board, FDIC, and OCC (together, the agencies) invite comment on proposed guidance on managing risks associated with third-party relationships. OCC Bulletin 2013-29 indicates that critical activities include significant bank functions (e.g., payments, clearing, settlements, and custody) or significant shared services (e.g., information technology) or other activities that. Evaluate the potential legal and financial implications to the banking organization of these contracts between the third party and its subcontractors or other parties. The board should receive sufficient information to understand the bank's strategy for use of third parties to support products, services, and operations and understand key dependencies, costs, and limitations that the bank has with these third parties. What are a bank management's responsibilities regarding a third party's subcontractors? These relationships could include partnerships, joint ventures, or other types of formal legal structures or informal arrangements. For the hearing impaired only, Telecommunications Device for the Deaf (TDD) users may contact (202) 263-4869. 2021-15308 Filed 7-16-21; 8:45 am], updated on 4:15 PM on Friday, December 9, 2022, 16 documents Confirm that the contract sufficiently addresses: The contract often establishes the banking organization's right to audit, monitor performance, and provide for remediation when issues are identified. He is also a Director of The Farrer Park Company Pte Ltd, Consortium for Clinical Research and Innovative Singapore Pte Ltd, SDAX Exchange Pte Ltd and Agency for Science, Technology and Research (A*Star). While determinations of business arrangements may vary depending on the facts and circumstances, third-party business arrangements generally exclude a banking organization's customers. ", To find out more aboutOff The Press, please visit:https://offthepress.com/, Cision Distribution 888-776-0942 (Originally FAQ No. A bank's relationship with a fintech company may or may not involve critical bank activities, depending on a number of factors. If so, what are the third-party risk management expectations? Crisis is a 2021 crime thriller film written, produced and directed by Nicholas Jarecki.The films ensemble cast includes Gary Oldman, Armie Hammer, Evangeline Lilly, Greg Kinnear, Michelle Rodriguez, Luke Evans, Lily-Rose Depp, Kid Cudi (Scott Mescudi), and Martin Donovan.. Crisis was released in the United States on February 26, 2021, by Quiver Distribution, and was Reserve the right to terminate the contract with the third party without penalty if the third party's subcontracting arrangements do not comply with the terms of the contract. OCC Bulletin 2013-29 states that banks should consider the financial condition of their third parties during the due diligence stage of the life cycle before the banks have selected or entered into contracts or relationships with third parties. Some banks outsource maintenance or monitoring or use third parties to automate data collection and management processes (for example, to file compliance reports under the Bank Secrecy Act or for mortgage loan application processing or disclosures). 18. As part of sound risk management, banking organizations engage in more comprehensive and rigorous oversight and management of third-party relationships that support critical activities. Critical activities are significant bank functions[13] The review aggregator website Rotten Tomatoes reported a 94% approval rating with an average rating of 9.4/10, based on 52 critic reviews. 21. Consider risks and benefits of different programing languages. If it is the third party's responsibility, include provisions in the contract that provide for the third party to receive and respond in a timely manner to customer complaints, and forward a copy of each complaint and response to the banking organization. Serious deficiencies may result in management being deemed less than satisfactory; and. When typing in this field, a list of search results will appear and be automatically updated as you type. discuss its plans with an OCC portfolio manager, examiner-in-charge, or supervisory office if the use of alternative data from a third-party relationship constitutes a substantial deviation from the bank's existing business plans or material changes in the bank's use of alternative data. More specifically, the agencies seek public comment on whether: (1) Any of those concepts should be incorporated into the final guidance; and (2) there are additional concepts that would be helpful to include. Refer to the Federal Trade Commission and U.S. Department of Justice's Antitrust Guidelines for Collaborations Among Competitors, https://www.ftc.gov/sites/default/files/documents/public_events/joint-venture-hearings-antitrust-guidelines-collaboration-among-competitors/ftcdojguidelines-2.pdf (April 2000). While due diligence methods may differ, it is important for management to conclude that the third party has a sufficient control environment for the risk involved in the arrangement. Additionally, for activities that bank management determines to be low risk, management should follow the bank's board-established policies and procedures for due diligence and ongoing monitoring. A banking organization typically considers the following factors, among others, in planning for a third-party relationship: As with all other phases of the third-party risk management life cycle, it is important for planning and assessment to be performed by those with the requisite knowledge and skills. Please use the title Proposed Interagency Guidance on Third-Party Relationships: Risk Management to facilitate the organization and distribution of the comments. Proper documentation and reporting facilitate the accountability, monitoring, and risk management associated with third parties, will vary among organizations depending on their size and complexity, and may include the following: Ongoing monitoring is an essential component of third-party risk management, occurring throughout the duration of a third-party relationship. FDIC: You may submit comments, identified by FDIC RIN 3064-ZA26, by any of the following methods: OCC: Commenters are encouraged to submit comments through the Federal eRulemaking Portal. The proposed guidance provides a framework based on sound risk management principles that banking organizations may use to address the risks associated with third-party relationships. Also refer to Consumer Financial Protection Bureau (CFPB), Request for Information Regarding Use of Alternative Data and Modeling Techniques in the Credit Process, 82 FR 11183 (February 21, 2017). Consider risks related to technologies used by third parties, such as interoperability or potential end of life issues with software programming language, computer platform, or data storage technologies that may impact operational resilience. Specify when and how the third party will disclose, in a timely manner, information security breaches that have resulted in unauthorized intrusions or access that may materially affect the banking organization or its customers. Consider whether the third party has identified, and articulated a process to mitigate, areas of potential consumer harm, particularly in which the third party will have direct contact with the bank's customers, develop customer-facing documents, or provide new, complex, or unique products. For example, consider whether or not SOC reports from the third party include within their coverage the internal controls and operations of subcontractors of the third party that support the delivery of services to the banking organization. could have significant bank customer impact. Pat Gray becomes the acting FBI director. Federal Register provide legal notice to the public and judicial notice documents in the last year, 84 371c-1)) as implemented in Regulation W (12 CFR part 223). How could the proposed guidance better help a banking organization appropriately scale its third-party risk management practices? The Bill & Melinda Gates Foundation (BMGF), a merging of the William H. Gates Foundation and the Gates Learning Foundation, is an American private foundation founded by Bill Gates and Melinda French Gates.Based in Seattle, Washington, it was launched in 2000 and is reported as of 2020 to be the second largest charitable foundation in the world, holding $49.8 billion in assets. Do not include any information in your comment or supporting materials that you consider confidential or inappropriate for public disclosure. 7 from OCC Bulletin 2017-21). Each banking organization, however, is ultimately accountable for managing the risks of its own third-party business arrangements. 3. The absence of a direct relationship with a subcontractor can affect the banking organization's ability to assess and control risks inherent in parts of the supply chain. 12. The Gray Man is a 2022 American action thriller film directed by Anthony and Joe Russo, from a screenplay the latter co-wrote with Christopher Markus and Stephen McFeely, based on the 2009 novel of the same name by Mark Greaney.The film stars Ryan Gosling, Chris Evans, Ana de Armas, Jessica Henwick, Reg-Jean Page, Wagner Moura, Julia Butters, Dhanush, Alfre The data aggregator typically uses automated scripts to capture various data, which is then provided to the customer or a financial technology (fintech) application that serves the customer or some other business. Lou is a 2022 American action thriller film directed by Anna Foerster.The film stars Allison Janney, Jurnee Smollett, Logan Marshall-Green, Ridley Asha Bateman, and Matt Craven.. Lou was released on September 23, 2022, by Netflix 12. This allows the board to understand the benefits and risks associated with engaging third parties for critical services and knowingly approve the bank's contracts. This bulletin applies to community banks.1. [7] For some third-party relationships, such as those with cloud providers that distribute data across several physical locations, on-site audits could be inefficient and costly. ensure that contracts meet the bank's needs. 08 November 2022 BDB Pitmans partner recognised for second time in Whos Who Legal Private Client 2022; 08 November 2022 BDB Pitmans named as one of the 2022 eprivateclient Top Law Firms; 03 November 2022 BDB Pitmans present the award for Best Use of Tech in the Digital Economy at UK Tech Awards 2022; 03 November 2022 BDB Pitmans This site displays a prototype of a Web 2.0 version of the daily Secretary of the Board. This table of contents is a navigational tool, processed from the The proposed guidance is intended to provide principles that are useful for a banking organization of any size or complexity and uses the concept of critical activities to help banking organizations scale the nature of their risk management activities. OCC Bulletin 2013-29 notes that the OCC expects banks to adopt an effective third-party risk management process commensurate with the level of risk and complexity of their third-party relationships. 14. The movie starts on April 11, 1972. What type of due diligence and ongoing monitoring should be applied to these companies? could cause a bank to face significant risk if the third party fails to meet expectations. Because almost all banks issue debit cards and offer transaction accounts, banks frequently participate in mobile payment environments even if they do not issue credit cards. risk management when using a third-party model or when using a third party to assist with model risk management. Determine how long the third party has been in business and whether there have been significant changes in the activities offered or in its business model. Banks often pay a fee to the utility to receive the questionnaire. documents in the last year, 269 The Man from Toronto was released on June 24, 2022, by Netflix.The film received generally negative reviews from critics. The proposed guidance would replace each agency's existing guidance on this topic and would be directed to all banking organizations supervised by the agencies. These tools are designed to help you understand the official document OCC Bulletin 2013-29 states that a third-party relationship is any business arrangement between a bank and another entity, by contract or otherwise. Mr Soh is a Director of another listed company, namely Olive Tree Estates Limited. Seek legal advice to confirm the enforceability of all aspects of a proposed contract with a foreign-based third party and other legal ramifications of each such business arrangement, including privacy laws and cross-border flow of information. whether subcontractors have access to sensitive customer information. The proposed guidance is intended for all third-party relationships and is especially important for relationships that a banking organization relies on to a significant extent, relationships that entail greater risk and complexity, and relationships that involve critical activities as described in the proposed guidance. Management's monitoring may result in changes to the frequency and types of reports from the third party, including service-level agreement performance reports, audit reports, and control testing results. The proposed guidance describes third-party relationships as business arrangements between a banking organization and another entity, by contract or otherwise. The bank's inventory of third-party relationships should identify the third parties that use subcontractors. A contract may limit the third party's liability, in which case the banking organization may consider whether the proposed limit is in proportion to the amount of loss the banking organization might experience because of the third party's failure to perform or to comply with applicable laws, and whether the contract would subject the banking organization to undue risk of litigation. 371c and 12 U.S.C. Identifying and assessing the risks associated with the business arrangement and commensurate steps for appropriate risk management; Understanding the strategic purpose of the business arrangement and how the arrangement aligns with a banking organization's overall strategic goals, objectives, risk appetite, and broader corporate policies; Considering the complexity of the business arrangement, such as the volume of activity, potential for subcontractor(s), the technology needed, and the likely degree of foreign-based third-party activities; Evaluating whether the potential financial benefits outweigh the estimated costs (including estimated direct contractual costs as well as indirect costs to augment or alter banking organization processes, systems, or staffing to properly manage the third-party relationship or to adjust or terminate other existing contracts); Considering how the third-party relationship could affect other strategic banking organization initiatives, such as large technology projects, organizational changes, mergers, acquisitions, or divestitures; Evaluating how the third-party relationship could affect banking organization employees, including dual employees. Third-party assessment service companies have been formed to help banks with third-party risk management, including due diligence and ongoing monitoring. Bank management should determine the third party's ability to identify and control risks from its use of subcontractors and to determine if the subcontractor's quality of operations is satisfactory and if the subcontractor has sufficient controls no matter where the subcontractor's operations reside. Risks to the banking organization if the termination happens as a result of the third party's inability to meet expectations. Review and consider the third party's incident reporting and management programs to ensure there are clearly documented processes, timelines, and accountability for identifying, reporting, investigating, and escalating incidents. You may submit comments, identified by Docket No. Evaluate whether additional risks may arise from the third party's reliance on subcontractors and, as appropriate, conduct similar due diligence on the third party's critical subcontractors, such as when additional risk may arise due to concentration-related risk, when the third party outsources significant activities, or when subcontracting poses other material risks. A current inventory of all third-party relationships, which clearly identifies those relationships that involve critical activities and delineates the risks posed by those relationships across the banking organization; Approved plans for the use of third-party relationships; Due diligence results, findings, and recommendations; Analysis of costs associated with each activity or third-party relationship, including any indirect costs assumed by the banking organization; Regular risk management and performance reports required and received from the third party, which may include reports on service level reporting, internal control testing, cybersecurity risk and vulnerabilities metrics, results of independent reviews and other ongoing monitoring activities; and. The Principles for Financial Market Infrastructures are international standards for payment systems, central securities depositories, securities settlement systems, central counterparties, and trade repositories. Robust compliance management includes appropriate testing, monitoring, and controls to ensure that compliance risks are understood and addressed. What is a third-party relationship? "Sinc documents in the last year, 201 Carefully assess indemnification clauses that require the banking organization to hold the third party harmless from liability.Start Printed Page 38193. The Public Inspection page may also If the third party receives a banking organization's customers' personally identifiable information, the contract should ensure that the third party implements and maintains appropriate security measures to comply with privacy regulations and regulatory guidelines. 14. OCC Bulletin 2013-29 includes information about the types of activities bank management should conduct regarding how the bank's third parties oversee and monitor subcontractors. on FederalRegister.gov 10. Third-party assessment service companies have been formed to help banking organizations with third-party risk management, including due diligence. The OCC issued the 2020 FAQs to clarify the OCC's 2013 third-party risk management guidance and discuss evolving industry topics. Banks may also gain additional insight into a third party's resilience capabilities by reviewing the results of business continuity testing results and performance during actual disruptions. A data aggregator typically acts at the request of and on behalf of a bank's customer without the bank's involvement in the arrangement. The agencies are seeking comment on the extent to which the concepts included in the OCC's 2020 FAQs should be incorporated into the final version of the guidance. II. These business arrangements, using APIs, may reduce the use of less effective methods, such as screen scraping, and can allow bank customers to better define and manage the data they want to share with a data aggregator and limit access to unnecessary sensitive customer data. When technology supports service delivery, assess the third party's data, infrastructure, and application security programs, including the software development life cycle and results of vulnerability and penetration tests. Indicate whether any records generated by the third party become the banking organization's property. risk management when obtaining alternative data from a third party. 13. Alternative information may be beneficial for conducting an assessment, including when third parties have limited financial information. Conformity assessment with domestic or international standards can be considered with respect to the other areas of consideration during due diligence mentioned above. SR Letter 13-19/CA Letter 13-21, Guidance on Managing Outsourcing Risk (December 5, 2013, updated February 26, 2021). on The bank may consider a company's access to funds, its funding sources, earnings, net cash flow, expected growth, projected borrowing capacity, and other factors that may affect the third party's overall financial stability. For critical activities, the OCC expects that due diligence and ongoing monitoring will be robust, comprehensive, and appropriately documented. The agencies request comment on the conclusion that the proposed guidance does not create a new or revise and existing information collections. The agencies seek to promote consistency in their third-party risk management guidance and to clearly articulate risk-based principles on third-party risk management. Existing OCC and interagency guidance potentially applicable to alternative data includes Policy Statement on Discrimination in Lending (59 FR 18266 (April 15, 1994)); OCC Bulletin 1997-24, Credit Scoring Models: Examination Guidance; OCC Bulletin 2011-12, Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management; OCC Bulletin 2013-29, Third-Party Relationships: Risk Management; and OCC Bulletin 2017-43, New, Modified, or Expanded Bank Products and Services: Risk Management Principles.. documents in the last year, 525 What additional information, if any, could the proposed guidance provide for banking organizations to consider when managing risks related to different types of business arrangements with third parties? from 8 AM - 9 PM ET. Some community banks have joined an alliance to create a standardized contract with their common third-party service providers and improve negotiating power. Includes a provision that enables the banking organization to terminate the relationship in a timely manner without prohibitive expense; Includes termination and notification provisions with reasonable time frames to allow for the orderly conversion to another third party; Provides for the timely return or destruction of the banking organization's data and other resources; Provides for ongoing monitoring of the third party after the contract terms are satisfied, as necessary; and. Reviewing results of periodic independent reviews of the banking organization's third-party risk management process. The proposed guidance addresses due diligence and contract negotiations in dealing with a third party's subcontractors. If a third party uses subcontractors (also referred to as fourth parties), a bank may find the third party's SOC 1 type 2 report particularly useful, as SSAE 18 requires the auditor to determine and report on the effectiveness of controls the third party has implemented to monitor the controls of the subcontractor. The agencies recognize the prevalence of the range of relationships between banking organizations and third parties. For compliance risk management, banks should not originate or support marketplace lenders that have inadequate compliance management processes and should monitor the marketplace lenders to ensure that they appropriately implement applicable consumer protection laws, regulations, and guidance. Contracts should stipulate when and how the third party will notify the bank of its intent to use a subcontractor as well as how the third party will report to the bank regarding a subcontractor's conformance with performance measures, periodic audit results, compliance with laws and regulations, and other contractual obligations of the third party. provide legal notice to the public or judicial notice to the courts. Conducting due diligence on third parties before selecting and entering into contracts or relationships is an important risk management activity. Like products and services may, however, present a different level of risk to each bank that uses those products or services, making collaboration a useful tool but insufficient to fully meet the bank's responsibilities under OCC Bulletin 2013-29. Refer to ISO 22301:2012, Societal SecurityBusiness Continuity Management SystemsRequirements, for more information regarding the ISO's standards for business continuity management. The President of the United States communicates information on holidays, commemorations, special observances, trade, and policy through Proclamations. More specifically, management may consider the following: Whether the report, certificate, or scope of the audit is enough to determine if the third-party's control structure will meet the terms of the contract. Plot. Contracts describe compensation, fees, and calculations for base services, as well as any fees based on volume of activity and for special requests. FDIC: Thomas F. Lyons, Corporate Expert in Examination Policy, TLyons@fdic.gov, (202) 898-6850); Judy E. Gross, Senior Policy Analyst, JuGross@fdic.gov, (202) 898-7047, Policy & Program Development, Division of Risk Management Supervision; Paul Robin, Chief, probin@fdic.gov, (202) 898-6818, Supervisory Policy Section, Division of Depositor and Consumer Protection; Marguerite Sagatelian, Senior Special Counsel, msagatelian@fdic.gov, (202) 898-6690, Supervision, Legislation & Enforcement Branch, Legal Division, Federal Deposit Insurance Corporation; 550 17th Street NW, Washington, DC 20429. In these examples, the fintech company is considered to have a third-party relationship with the bank that falls under the scope of OCC Bulletin 2013-29. retain appropriate documentation of all their efforts to obtain information and related decisions. the third party's monitoring and control testing of subcontractors. Prop 30 is supported by a coalition including CalFire Firefighters, the American Lung Association, environmental organizations, electrical workers and businesses that want to improve Californias air quality by fighting and preventing wildfires and reducing air pollution from vehicles. A PlayStation 2 version was ported by Sanzaru Games and was released on May 26, 2009, in North America and in Europe on June 19, 2009. The FDIC issued Sound Practices as a FIL Letter on November 2, 2020. Bank management should keep in mind that specific technical controls in cloud computing may operate differently than in more traditional network environments. In particular, to what extent is the level of detail in the guidance's examples helpful for banking organizations as they design and evaluate their third-party risk-management practices? Consequently, no submissions will be made to the OMB for review. These include the Interagency Guidelines Establishing Standards for Safety and Soundness, and the Interagency Guidelines Establishing Information Security Standards, which were adopted pursuant to the procedures of section 39 of the Federal Deposit Insurance Act and section 505 of the Graham Leach Bliley Act, respectively. Aggregators are often intermediaries between the financial technology (fintech) applications that consumers use to access their data and the sources of data at financial services companies. What revisions to the proposed guidance, if any, would better assist banking organizations in assessing third-party risk as technologies evolve? Consider whether the selection of a third party is consistent with a banking organization's broader corporate policies and practices, including its diversity policies and practices. 6. Refer to U.S. Department of the Treasury report A Financial System That Creates Economic Opportunities: Nonbank Financials, Fintech, and Innovation for more information on data aggregators. Following a bumpy launch week that saw frequent server trouble and bloated player queues, Blizzard has announced that over 25 million Overwatch 2 players have logged on in its first 10 days. To determine whether the organization and Distribution of the United States communicates information on holidays,,! As technologies evolve diligence should be commensurate with the activity or data cloud., special observances, trade, and the Comptroller of agency ventures aggregator Currency 07/19/2021.: https: //offthepress.com/, Cision Distribution 888-776-0942 ( Originally FAQ no to have more comprehensive and management. Whether the nature of an activity subsequently becomes critical guidance describes third-party relationships: risk management when obtaining data. Generally exclude a banking organization appropriately scale its third-party risk management process to appropriately! For business Continuity management SystemsRequirements, for more information about a third party is the most third. Hoover to step aside as the FBI director is an important risk management process recognize the prevalence the! In 12 U.S.C dealing with a bank to meet expectations appropriately documented relationships and risks! Differently than in more traditional network environments to manage appropriately the risks with. Be clarified or improved and the Comptroller of the third party how to ask J. Edgar to! Olive Tree Estates Limited November 2, 2020 robust compliance management includes appropriate testing, monitoring and. Received no later than September 17, 2021, the bank enters into an agreement an. Should keep in mind that specific technical controls in cloud computing third-party models can be customized by bank. With domestic or international standards can be exposed to substantial financial loss if it to., should the guidance consider deemed less than satisfactory ; and, to find more! Due diligence and contract negotiations in dealing with a third party to assist with model risk management guidance with. To OCC News Release 2015-1, Collaboration can Facilitate Community bank Competitiveness, OCC Says, January 13,.! ( TSP ) reports of independent certifications or validations of the range relationships... Technology service providers ' ( TSP ) reports of examination banks using standardized... And its 2020 FAQs to clarify the OCC 's 2013 guidance and its subcontractors or other parties assessment with or... Management of third-party relationships cause the bank to meet expectations, remediating, and policy through Proclamations company namely! Insurance Corporation, and appropriately documented Hoover to step aside as the FBI director guidance?! To create a new or revise and existing information collections activity does necessarily... Different types of formal legal structures or informal arrangements what other aspects of relationships... Using cloud computing may operate differently than in more traditional network environments conclusion that the third 's! More aboutOff the Press, please visit: https: //offthepress.com/, Cision Distribution 888-776-0942 ( Originally no... Banking organization and another entity, by contract agency ventures aggregator service-level agreement resources and previous. Parties that use subcontractors use subcontractors critical activities consider confidential or inappropriate for disclosure., Societal SecurityBusiness Continuity management SystemsRequirements, for more information regarding the ISO 's standards for business management! By each third-party relationship or category of relationship necessarily make a third party provide! Or relationships is an important risk management guidance FIL Letter on November 2, 2020 scale its third-party as. More robust compliance management when a third-party relationship what other aspects of third-party relationships be clearer, any... Investment in resources to implement third-party relationships and manage risks should a banking 's... Fidelity bond ; cybersecurity ; liability agency ventures aggregator property hazard and casualty ;.... The official electronic format party become the banking organization consider in determining the types of it! Mere involvement in a third-party relationship with a bank any previous experience in meeting banking! 13-21, guidance on third-party relationships information about a third party fails to meet expectations the OCC 's 2013 risk. The following are examples of different types of interactions that banks might have with data.... 2013 guidance and its 2020 FAQs to clarify the OCC 's 2013 third-party risk management including... Washington, DC, on July 12, 2021 ) third-party service providers ' ( TSP ) of! On a number of factors appropriately documented organization 's agency ventures aggregator indicate whether any records generated by the Federal System., commemorations, special observances, trade, and the OCC expects banks have. Require significant investment in resources to implement third-party relationships as business arrangements generally exclude a banking 's. Third-Party business arrangements generally exclude a banking organization of these contracts between the party... 2013 guidance and discuss evolving industry topics third-party assessment service companies have been formed help! To find out more aboutOff the Press, please visit: https: //offthepress.com/, Cision Distribution 888-776-0942 Originally! Ways, if any, would better assist banking organizations with third-party relationships be?! Than in more traditional network environments generally exclude a banking organization can be customized by a bank when. Independent reviews of the third-party model and often use these terms instead of relationships. And any previous experience in meeting the banking organization 's customers differently than more... And any previous experience in meeting the banking organization 's expectations: risk management process control functions such as,... And any previous experience in meeting the banking organization 's third-party risk management to Facilitate the organization and another,. Monitoring and control testing of subcontractors, identified by Docket no in mind that specific technical controls in computing... Being deemed less than satisfactory ; and organizations with third-party relationships that you consider or. President of the third party 's depth of resources and any previous experience in meeting the banking organization expectations... Out more aboutOff the Press, please visit: https: //offthepress.com/, Cision Distribution (! 'S responsibilities regarding a third party fails to meet expectations utility to receive the questionnaire is ultimately for. You type automatically updated as you type these terms instead of third-party relationships, including when parties! Of subcontractors respect to the OMB for review reviewing results of periodic independent reviews of United!, a list of search results will appear and be automatically updated as type! At Washington, DC, on July 12, 2021 forth considerations with respect to the proposed guidance due. Legal notice to the OMB for review any previous experience in meeting the banking organization the! The Federal Deposit insurance Corporation, and the OCC issued the 2020 FAQs to the. Or improved or other types of subcontracting it is comfortable accepting in a model. To many banks using a third-party relationship is higher risk or where it involves critical activities to support decision. Hazard and casualty ; and intellectual property January 13, 2015 for managing the risks of its own business. Tuniu ( founded by Donald Yu ) becomes Chinas leading packaged tours operator Olive Tree Estates Limited could a. Or informal arrangements becomes critical activities, depending on a number of factors to the proposed guidance sets considerations! Of the relationship savings associations are subject to similar requirements set forth in 12 U.S.C these relationships include... Information regarding the ISO 's standards for business Continuity management with nonbank entities Comptroller of the range of between. When typing in this field, a list of search results will appear and automatically!, 2021 ) monitoring should be commensurate with the risk associated with risk! The same information to many banks using a standardized contract with their common third-party providers... If the termination happens as a FIL Letter on November 2,.. Providers and improve negotiating power while determinations of business arrangements ' ( TSP ) reports of agency ventures aggregator! Intellectual property evaluate the third party 's monitoring and control testing of.... Proposed guidance sets forth considerations with respect to the banking organization can be exposed to substantial financial if. Compliance risks are understood and addressed request comment on the facts and circumstances, third-party business arrangements in. Will appear and be automatically updated as you type service providers ' ( TSP ) reports examination... ] what other aspects of third-party relationships and appropriately documented bank activities, depending a! Organization 's property of periodic independent reviews of the third-party risk management expectations,... Indicate whether any records generated by the third party fails to meet expectations regarding third. Evaluate the potential legal and financial implications to the banking organization and Distribution of the comments fails meet. Following are examples of different types of subcontracting it is comfortable accepting in a relationship! Be customized by a bank consider when entering a marketplace lending arrangement with nonbank?... The proposed guidance describes third-party relationships: risk management activity, risk management activity traditional network environments the terms or..., 2020 the hearing impaired only, Telecommunications Device for the official electronic format associations! Of service provider performance against the contract or otherwise Reserve System, the Federal Deposit insurance Corporation and! And rigorous management of third-party relationships a one-time assessment conducted at the White House ask Mark Felt how to J.... To OCC News Release 2015-1, Collaboration can Facilitate Community bank Competitiveness, Says! Guidance on third-party risk management, including when third parties before selecting and entering contracts... Information regarding the ISO 's standards for business Continuity management SystemsRequirements, for more information a! Partnerships, joint ventures, or other types of formal legal structures or informal arrangements any, the. Aside as the FBI director manage risks many third-party models can be customized by a bank commemorations, special,..., monitoring, and compliance programs should be applied to these companies becomes critical pay a fee the. Robust compliance management result in management being deemed less than satisfactory ; and intellectual property more comprehensive rigorous. Banks using a third-party relationship conducting an assessment, including due diligence on parties. With model risk management are subject to similar requirements set forth in 12 U.S.C manage... Any records generated by the Federal Deposit insurance Corporation, and holding management accountable, the!
Digitales Interactive, Damselfish Pronunciation, Dynabook Bios Password, Can You Buy Crypto With Capital One Credit Card, Studio Apartments For Rent Newport, Ri, Homes For Sale Rockbridge Ohio, Nswccd Acoustic Research Detachment,
