After decades of being heavily restricted by complex proprietary technology stacks, banks are becoming increasingly reliant on external technology vendors for everything from cloud infrastructure to payments, cybersecurity and fintech services. However, while this has proven vital for interoperability and delivering modern consumer experiences, there are unique and complex risks surrounding those relationships. Regulators in the US are now proposing to change how financial institutions manage those risks, with the Federal Reserve publishing a joint announcement on September 11, alongside the FDIC, National Credit Union Administration and Office of the Comptroller of the Currency. The proposed guidance aims to make oversight align more closely with the actual risk posed by individual vendors and partnerships.
The main idea behind the new guidance is that not every vendor relationship deserves the same level of oversight. The new proposal would have banks and credit unions assessing the magnitude and likelihood of potential harm associated with each third party, before tailoring risk-management practices accordingly. For example, factors would include the size and complexity of the institution, its own risk profile, and the nature of the service being provided. The OCC says this would help move institutions away from the blanket process-driven approaches that effectively end up treating every third-party relationship as inherently high risk.
The distinction is especially relevant as financial institutions grow more dependent on outside technology companies. For example, a provider hosting a bank’s core payment and transaction processing environment will likely create very different operational and financial risks compared to a supplier that provides a noncritical internal service. This extends to fintech partnerships too, some of which may involve regulated customer data, lending or deposit products, thereby making questions around cybersecurity, compliance and accountability all the more consequential. The new guidance essentially encourage banks to concentrate their risk-management resources on areas where disruption or failure could cause the greatest harm.
The proposal also reflects a broader challenge facing smaller institutions. Community banks, for example, tend to be heavily dependent on core technology providers, but often have considerably less negotiating power or technical expertise than large banks. In the same joint announcement, the Federal Reserve also proposed an additional third-party risk-management guide specifically tailored to the needs of traditional community banks.
Nonetheless, questions remain with regard to how much discretion banks should actually have. Lisa Cook, Governor of the Federal Reserve, for example, supported the general direction but called for feedback on whether regulators should provide greater specificity around cybersecurity and the division of responsibility for consumer protection, records management and anti-money laundering in partnerships between banks and fintechs. Meanwhile, Governor Michael Barr dissented, arguing that the proposal could end up creating supervisory gaps and uncertainty around more complex fintech relationships.
For banks and fintechs, the main takeaway is that understanding dependency and materiality is becoming much more important than just maintaining a uniform checklist. Institutions also need to know which vendors support critical functions, what data and systems they can access, how failures would impact operations and customers, and who’s ultimately responsible if something goes wrong. The proposed guidance remains non-binding and will be open for comment until November 16.