A pair of regulatory actions issued Friday (Sept. 11) could change how banks think about third-party risk.
The Federal Reserve Board, the Federal Deposit Insurance Corp., the Office of the Comptroller of the Currency and the National Credit Union Administration proposed replacing existing third-party risk-management guidance with a principles-based framework designed to let financial institutions calibrate oversight to the actual risk posed by individual relationships. The proposal emphasizes the magnitude and likelihood of potential harm rather than a purely process-driven approach that treats third parties uniformly.
A separate statement issued simultaneously by the Fed, FDIC and OCC pointed to the harder problem underneath that framework. What happens when community banking organizations (CBOs) identify a major third-party risk but have little practical ability to change it?
“[C]ertain core provider business practices and market dynamics may pose obstacles to a CBO’s ability to efficiently and effectively identify, assess and address the attendant risks,” the agencies said in the statement, adding that a “significant percentage of the core provider market is represented by just a few large providers, which limits CBOs’ negotiating power.”
Many banks depend on outside providers not merely for ancillary services, but for infrastructure fundamental to how the institution operates. Core processing, payments, digital banking, cloud computing, identity and artificial intelligence can sit partly or entirely outside the bank.
The result is a potential imbalance. Financial institutions can remain accountable for infrastructure over which they may have little practical control.
Read also: Smart Firms Treat Vendor Risk Like Their Own
The Problem Isn’t How Many Vendors a Bank Has
The agencies focused specifically on community banks’ relationships with core service providers, the companies supplying transaction processing, account management, payments, compliance, online banking and other infrastructure necessary to keep a bank running. These are not ordinary software vendors. Regulators described them in the statement as community banks’ “most material, complex, and highest-risk third-party relationships.”
In essence, the agencies have given banks a straightforward message about outsourcing. You can outsource the work, but you cannot outsource the responsibility.
However, regulators are acknowledging that community banks may not have enough leverage to manage those relationships in the way traditional vendor-risk frameworks assume. That turns third-party risk from a vendor-management problem into a dependency-management problem.
In today’s interconnected third-party landscape, the relevant measure of risk is not necessarily how many vendors a bank uses. It is how much of the bank becomes dependent on the vendors it cannot easily replace.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
Some vendors are replaceable. Others have become infrastructure. Core providers sit in the second category. Their platforms can underpin payments, deposits, lending, account management and customer-facing banking services. The agencies said in the statement that the availability, integrity and security of a core processing platform are vital to “nearly all banking operations.
The PYMNTS Intelligence report “From Opening to Ongoing: How Modern Payments Unlock Community Banks’ Deposit Growth” found in April that 55% of community bank decision-makers said they have fully modernized their technology stacks, yet many of the accounts these banks open fail to become primary relationships. However, many community banks, while confident in their modernization efforts, lack the payments capabilities needed to support continuous engagement.
“It’s not about abandoning legacy systems, but modernizing around them intelligently,” Garrett Baird, vice president of product, banking and FinTech at Paymentus, told PYMNTS in May.
See also: B2B Pricing Power Changes When Software Can Prove Its Own ROI
An Exit Strategy Isn’t a Control If You Can’t Exit
The most revealing part of the regulators’ statement concerned what happens when a bank tries to leave. Banks may determine that they need to replace an underperforming core provider or supplement its services with products from another company. But contractual provisions can themselves become obstacles to doing so.
The agencies described the consequence in the statement. Community banks can be “forced to acquiesce to suboptimal core provider relationships” in which their needs are not adequately met and their ability to manage third-party risk is limited. They specifically identified opaque pricing, complicated billing practices, undefined deconversion fees and excessive limitations on unaffiliated providers integrating with core platforms as practices warranting supervisory attention.
That reframes the exit strategy, one of the foundational ideas in vendor management.
Migrating a core banking platform is different from replacing a software-as-a-service subscription. Data must move. Integrations must be rebuilt. Systems must be tested. Customer experiences can be affected. Payments, deposits, lending and compliance processes may all depend on the infrastructure being replaced.
This is where Friday’s regulatory action reaches beyond compliance. If institutions are expected to concentrate resources on the third parties capable of causing the greatest harm, then executives need to understand not only the probability of vendor failure but the cost of dependency. These companies may contractually be vendors. Operationally, some have become part of the machinery of banking itself.
For all PYMNTS B2B coverage, subscribe to the daily B2B newsletter.
Add as Preferred Source
