OCC Issues New Guidance on Banks’ Third-Party Relationships
Risk managers might want to add a little “Irish” to their coffee this morning.
The Office of the Comptroller of the Currency issued new guidance for banks’ third-party relationships today, citing concerns about the growing complexity of financial institutions’ relationships with vendors.
“We have concerns regarding the quality of risk management on the growing volume, diversity, and complexity of banks’ third-party relationships, both foreign and domestic,” said Comptroller of the Currency Thomas J. Curry in a press release accompanying the guidelines. “This guidance provides more comprehensive instruction for banks to ensure these relationships and activities are conducted in a safe and sound manner.”
The guidance lays out the five stages in the “risk-management life cycle,” as recommended by the OCC:
- Planning;
- Due Diligence and Third-Party Selection;
- Contract Negotiation
- Ongoing Monitoring; and
- Termination.
The guidance, which runs to 23 pages, lays out some specific points for information technology. Here are those two sections in full:
Information Security
Assess the third party’s information security program. Determine whether the third party has sufficient experience in identifying, assessing, and mitigating known and emerging threats and vulnerabilities. When technology is necessary to support service delivery, assess the third party’s infrastructure and application security programs, including the software development life cycle and results of vulnerability and penetration tests. Evaluate the third party’s ability to implement effective and sustainable corrective actions to address deficiencies discovered during testing.Management of Information Systems
Gain a clear understanding of the third party’s business processes and technology that will be used to support the activity. When technology is a major component of the third-party relationship, review both the bank’s and the third party’s information systems to identify gaps in service-level expectations, technology, business process and management, or interoperability issues. Review the third party’s processes for maintaining accurate inventories of its technology and its subcontractors. Assess the third party’s change management processes to ensure that clear roles, responsibilities, and segregation of duties are in place. Understand the third party’s performance metrics for its information systems and ensure they meet the bank’s expectations.
Will this new guidance make banks wary of working with fintech startups? With hundreds of fintech startups launching every month — 380 from February to April 2013, for example — and looking to partner with financial institutions, a brake on innovation at this point would be an unfortunate consequence.
