How to meet the interagency guidance on third-party relationships

Two shapes of program are allowed, and the guidance declines to prefer one. Some banking organizations "disperse accountability for their third-party risk management processes among their business lines." Others "centralize the processes under their compliance, information security, procurement, or risk management functions." Either way, three roles are fixed.

Your board "has ultimate responsibility for providing oversight for third-party risk management and holding management accountable." It provides guidance on acceptable risk appetite, approves policies and confirms that procedures and practices exist. Management "is responsible for developing and implementing third-party risk management policies, procedures, and practices." Business lines feed the process, in the agencies' footnote, "by completing risk assessments, reviewing due diligence information, and evaluating the controls over the third-party relationship." If your charter does not name all three, the first finding is already written.

Assign skills as deliberately as accountability: the guidance expects "staff with the requisite knowledge and skills in each stage," drawn from "compliance, risk, or technology, as well as legal counsel," with external support where it supplements in-house expertise. For a mature program that means a named second-line owner for the methodology, a named relationship owner for every inventory row, and a legal reviewer on every contract above a defined risk tier. Certa's third party risk management guidance resource covers how those roles turn into workflow ownership once the program runs on one system.

Planning is the stage most programs skip, because the business has chosen the vendor by the time risk hears about it. It comes first on purpose: "effective planning allows a banking organization to evaluate and consider how to manage risks before entering into a third-party relationship." Where critical activities are involved, "plans may be presented to and approved by a banking organization's board of directors (or a designated board committee)."

Critical activities are the ones that could "cause a banking organization to face significant risk if the third party fails to meet expectations," "have significant customer impacts," or "have a significant impact on a banking organization's financial condition or operations." The agencies leave the designation to you ("an activity that is critical for one banking organization may not be critical for another") and ask that the methodology be sound and applied consistently.

Written out, the planning factors make a good one-page intake memo. Searches for OCC third-party risk management guidance 2023 tend to land on the bulletin, but the planning list is interagency text and reads the same in all three releases:

• Strategic purpose, and how the arrangement aligns with strategic goals, objectives, risk appetite, risk profile and corporate policies
• Benefits and risks of the arrangement, and how the identified risks will be managed
• Nature of the arrangement: volume of activity, use of subcontractors, technology needed, interaction with customers, use of foreign-based third parties
• Estimated costs, both direct contractual costs and indirect costs to augment or alter staffing, systems, processes and technology
• Impact on employees, including dual employees, and the transition steps when an internal activity is outsourced
• Impact on customers: access to or use of customer information, interaction with customers, potential for consumer harm, handling of complaints and inquiries
• Information security and physical security implications, including access to systems, confidential information and facilities
• How the third party will be selected, assessed and overseen, including monitoring compliance and requiring remediation
• Whether the organization can oversee the relationship on an ongoing basis, with the staffing, expertise, systems and internal controls that will take
• Contingency plans if the activity must move to another third party or come in-house

Two of those factors do the most work: the oversight-capacity question (can we run this relationship with the staff and systems we have) separates a plan from a purchase request, and the contingency plan written here becomes the exit strategy in step 6, so write it as if you will need it. Capital, liquidity and credit teams already plan this way for balance-sheet risk. Certa's primer on risk management in banking shows where third-party exposure fits in that same discipline.

Due diligence is the longest part of the interagency guidance on third-party relationships risk management text: fourteen lettered factors, plus rules for what to do when you cannot get the information. Scope comes first, and the agencies put it in one sentence: due diligence "should be commensurate with the level of risk and complexity of the third-party relationship." More is expected for higher-risk activities, including critical ones, and "relying solely on experience with or prior knowledge of a third party is not an adequate proxy for performing appropriate due diligence."

In the guidance's order, the fourteen factors are:

1. Strategies and goals. Pending mergers, acquisitions and partnerships, service philosophy, employment practices.
2. Legal and regulatory compliance. Ownership including beneficial ownership, licenses, OFAC sanctions on the third party or its owners, past compliance issues, a process to mitigate consumer harm.
3. Financial condition. Audited financial statements, annual reports, SEC filings, litigation, unfunded liabilities, debt ratings.
4. Business experience. Depth of resources, prior experience with the activity, complaint and litigation history.
5. Qualifications and backgrounds of key personnel. Background checks, removal of unsuitable or barred staff, training, succession.
6. Risk management. Policies, controls, governance, audit coverage, SOC reports and certifications with scope checked against the activity.
7. Information security. Consistency with your own program, multifactor authentication and encryption, vulnerability and penetration test results, remediation.
8. Management of information systems. Service-level and interoperability gaps, inventories of technology and contractors.
9. Operational resilience. Disaster recovery and business continuity plans with recovery time frames, test results, single-provider dependency, end-of-life technology.
10. Incident reporting and management processes. Documented timelines and accountability for reporting and escalating incidents, consistent with the Computer-Security Incident Notification Rule.
11. Physical security. Controls over people, facilities, systems and data, including physical access on- and off-boarding.
12. Reliance on subcontractors. Volume and type of subcontracting, selection and oversight of subcontractors, geographic location.
13. Insurance coverage. Fidelity bond, liability, property, and gaps a general policy may leave such as cyber or intellectual property.
14. Contractual arrangements with other parties. Commitments to others that may create or transfer risk to you or your customers.

Treating that list as one questionnaire for everyone is the trap. Scale it. A working tiering for a mid-size or large institution:

When a third party cannot or will not provide what you ask (a short operating history, no on-site visits, restricted information), the guidance does not let you skip the step. It expects you to "identify and document any limitations of its due diligence, understand the risks from such limitations, and consider alternatives," such as obtaining alternative information, adding controls or monitoring, or choosing a different third party. Write the limitation into the file with the compensating control beside it. Industry utilities and consortiums may supplement your work, and using them "does not abrogate the responsibility of the banking organization."

This is the stage where volume hurts. Certa's financial services page lists the OCC, FDIC and FRB interagency guidance among the frameworks its platform runs for financial services compliance teams, with risk-tiered assessments across every relevant domain and an audit trail at each decision point. A Top 5 EU financial institution cut vendor onboarding from 10 weeks to 1 day on it, and a large US firm automated its entire bespoke TPRM process in 2 days using Certa AI. Reviewers still own the conclusion. What moves to the platform is the chasing.

Contracts are where third-party risk management becomes enforceable, and the guidance lists seventeen provisions (a through q) a banking organization "typically considers," tailored to risk and complexity. It also acknowledges the real world: third parties open with standard paper, negotiating power is sometimes limited, and when that happens you must "understand any resulting limitations and consequent risks," decide whether residual risk is acceptable, and consider another third party or doing the work in-house. For higher-risk activities the board "should be aware of and, as appropriate, may approve or delegate approval of contracts," and legal counsel review "may also be warranted prior to finalization."

Read as a clause checklist, the OCC third party risk management expectations (which are the FDIC's and the Board's as well, since the text is shared) look like this:

• Nature and scope of the arrangement, including ancillary services and the terms for use of your information, facilities, personnel, systems and intellectual property
• Performance measures or benchmarks, with service-level agreements that do not reward volume or speed over accuracy and compliance
• Responsibilities for providing, receiving and retaining information: timely access to your data, sharing with regulators, notice of compliance lapses, enforcement actions, mergers, subcontractor use and key personnel changes, and the reports you receive
• The right to audit and require remediation, including which audit reports you receive (SOC reports, PCI reports) and your right to audit the third party and its relevant subcontractors
• Responsibility for compliance with applicable laws and regulations, with your right to monitor and to require timely remediation
• Costs and compensation, with no incentives for inappropriate risk taking and clarity on upfront and termination fees
• Ownership and license, including who owns data the third party generates, and source code escrow where you buy software
• Confidentiality and integrity, including when and how the third party discloses security breaches or unauthorized intrusions
• Operational resilience and business continuity, with recovery time and recovery point objectives and joint testing
• Indemnification and limits on liability proportionate to the loss you could experience
• Insurance types and amounts, notice of material changes, evidence of coverage
• Dispute resolution, including whether service continues while a dispute is resolved
• Customer complaints: who responds, and how you receive complaint data and trends
• Subcontracting: notice of use, prohibited subcontractors, no assignment without consent, liability for subcontractor actions
• Foreign-based third parties: choice of law, jurisdiction and cross-border data flows
• Default and termination (see below)
• Regulatory supervision: the third party's performance is "subject to regulatory examination and oversight," with retention of and access to all relevant documentation

Default and termination earns its own paragraph, because it is the clause that most often fails under pressure. Here the guidance asks for provisions that "provide termination and notification requirements with reasonable time frames to allow for the orderly transition of the activity," "provide for the timely return or destruction of the banking organization's data," "assign all costs and obligations associated with transition and termination," and let you "terminate the relationship with reasonable notice and without penalty, if formally directed by the banking organization's primary federal banking regulator." If your master services agreement lacks that regulator-directed termination right, raise it at the next renewal.

Set a review cycle for executed contracts as well. "Periodic reviews of executed contracts allow a banking organization to confirm that existing provisions continue to address pertinent risk controls and legal protections," and new risks may warrant renegotiation. A practical cadence: every contract supporting a critical activity at renewal and no less than every three years, with a clause-by-clause gap list kept on file.

Ongoing monitoring has three jobs in the guidance: "confirm the quality and sustainability of a third party's controls and ability to meet contractual obligations," "escalate significant issues or concerns," and "respond to such significant issues or concerns when identified." It runs "throughout the duration of a third-party relationship," may be "periodic or continuous," and gets deeper or more frequent for higher-risk activities, including critical ones. Typical activities are review of the third party's reports, periodic visits and meetings, and regular testing of your own controls, with direct testing of the third party's controls "in certain circumstances, based on risk."

Read the agencies' monitoring factors as a watch list for every relationship owner. Changes in business strategy and in agreements with other entities. Changes in financial condition. Lapses in insurance. Audit and testing results. Compliance and performance against the contract. Key personnel changes. Subcontractor reliance and location. Training on both sides. Response to new threats and incidents. Ability to keep your data confidential, available and intact. Business continuity testing. External conditions such as changing laws and economic conditions. And the volume, nature and trends of customer complaints.

Once a year is not a cadence for most of that. Escalation triggers named in the guidance (material or repeat audit findings, deterioration in financial condition, security breaches, data loss, service interruptions, compliance lapses) arrive on the third party's timetable, not yours. A workable model for OCC third party vendor management programs, and their FDIC and Federal Reserve equivalents, is an annual full reassessment for critical and high tiers, trigger-based review for every tier, and continuous feeds for the signals that can be automated. Certa's resource continuous monitoring explained covers which signals run continuously and which still need a person.

That is also the model Certa builds for. Its platform scores every third party across seven risk domains and monitors continuously, so, in its own description, "Your team doesn't work the whole portfolio, it works the rows that changed." For the exam file, every screen, adjudication and disposition "is captured with documented rationale, citations, and timestamps, immutable and exportable on demand."

Termination gets the shortest section of the guidance and the least attention in most programs, which is why it produces findings out of proportion to its length. Management is expected "to terminate relationships in an efficient manner, whether the activities are transitioned to another third party, brought in-house, or discontinued," and the agencies list six factors to plan for:

1. Options for an effective transition of services, including potential alternate third parties
2. The capabilities, resources and time frame required to move the activity or bring it in-house while managing legal, regulatory, customer and other impacts
3. Costs and fees associated with termination
4. Risks around data retention and destruction, information system connections and access control, and other controls that need monitoring after the relationship ends
5. Handling of joint intellectual property
6. Risks to the organization, including any impact on customers, when termination follows the third party's inability to meet expectations

An exit strategy is the planning-stage contingency plan from step 2, kept current through the life of the relationship. Under the OCC guidance on third party risk management, which is the same text the FDIC and the Board issued, the contingency plan sits in planning and the termination mechanics sit in the contract, and the exit strategy joins the two. For every critical activity, keep a one-page exit plan with the alternate providers you have identified, the realistic transition time, the data return and destruction steps and who verifies them, the access to be revoked on day one, and the customer communication if service degrades.

Test the data-return step on a low-risk relationship before you need it on a critical one, so you know what "timely" means in practice with that provider's export formats and notice periods.

Everything above is only as good as what you can show. Three governance practices run through the guidance: oversight and accountability (step 1), independent reviews, and documentation and reporting. Proof lives in the last two.

"It is important for a banking organization to conduct periodic independent reviews to assess the adequacy of its third-party risk management processes." Such a review asks whether relationships align with strategy, policy and standards, whether risks are "identified, measured, monitored, and controlled," whether processes and controls "are designed and operating adequately," whether staffing and expertise are engaged across the life cycle, and whether conflicts of interest are avoided when selecting or overseeing third parties. Management is expected to respond promptly and escalate to the board as appropriate. Internal audit normally owns this review. If the audit plan has not covered third-party risk in the last cycle, schedule it.

Nothing in the guidance states examiner expectations more plainly than its documentation and reporting list:

• A current inventory of all third-party relationships (and, as appropriate to the risk, related subcontractors) with higher-risk activities, including critical activities, clearly identified
• Planning and risk assessments for the use of third parties
• Due diligence results and recommendations
• Executed contracts
• Remediation plans and reports on the quality and sustainability of the third party's controls
• Risk and performance reports required and received through ongoing monitoring
• Customer complaint and inquiry monitoring reports and any remediation, where applicable
• Third-party reports of service disruptions, security breaches or other events that pose a material risk
• Results of independent reviews
• Periodic reporting to the board, including, as applicable, dependency on a single provider for multiple activities

How that file is used is spelled out in the supervisory review section. Examiners "assess the ability of the banking organization's management to oversee and manage" its third-party relationships, assess the impact on the risk profile, "perform transaction testing or review results of testing," discuss material risks with senior management and the board, review remediation plans, and carry findings into the applicable rating and the Report of Examination. For technology service providers, examiners also work from the FFIEC IT Examination Handbook, whose Outsourcing Technology Services booklet covers board and management responsibilities, risk assessment, service provider selection, contract issues and ongoing monitoring. Teams that search for FFIEC third-party risk management guidance should read that booklet beside the interagency text, and the agencies' May 2024 community bank guide lists further FFIEC resources in its appendix.

Below, each expectation is mapped to what gets asked for. Use it to build the evidence index for every relationship.

Examiners work from what they can read. Build the index now, and the week before the exam becomes a week like any other.