Third Party Risk Guidance

Question 1

Do indemnity agreements relinquish the bank from responsibility over a third party’s actions?

Answer 1

No. A bank may property seek to mitigate risks of third party relationships through the use of indemnity agreements, such agreements do not insulate the bank from its ultimate responsibility to conduct banking activities in compliance with consumer protection laws and regulations, including fair lending laws.

Question 2

What types of third party relationships are considered significant? (11)

Answer 2

• the institution’s relationship with the third party is a new
relationship or involves implementing new institution activities;

• the relationship has a material effect on the institution’s revenues or expenses;
• the third party performs critical functions;
• the third party stores, accesses, transmits, or performs transactions on sensitive customer information;
• the third-party relationship significantly increases the institution’s geographic market;

• the third party provides a product or performs a service
involving l ending or card payment transactions;

• the third party poses risks that could materially affect the
institution’s earnings, capital, or reputation;

• the third party provides a product or performs a service that
covers or could cover a large number of consumers;

• the third party provides a product or performs a service that
implicates several or higher risk consumer protection regulations;

• the third party is involved in deposit taking arrangements
such as affinity arrangements; or

• the third party markets products or services directly to institution customers that could pose a risk of financial loss to the individual.

Question 3

What is a third party?

Answer 3

All entities that have entered into a business relationship with the bank, whether the third party is a bank or non bank, affiliated or non affiliated, regulated or non regulated, a wholly or partially owned subsidiary, or a domestic or foreign institution.

Question 4

When reviewing for third party risk, examiners should request a list of what to ensure all appropriate relationships have been captured?

Answer 4

Examiners should request a listing of all functions and services outsourced to ensure that appropriate relationships that have third party risk are captured for review.

Some banks will use the term outsourced and third party interchangeably, even if outsourced relationships have varied degrees of risk.

Question 5

Failure to manage third party risk can expose the bank to what? (5)

Answer 5

• supervisory action
• financial loss
• litigation
• reputational damage
• impair a banks ability to establish new or manage existing consumer relationships

Question 6

The decision to enter into third party relationships should be considered by who within the bank? why?

Answer 6

The board of directors and management, because the Board is ultimately responsible for managing activities conducted through third party relationships and identifying and controlling the risks to the same extent as if the activity were handled within the institution.

Question 7

What potential risks can arise from third party relationships? (8)

Answer 7

• compliance risk
• reputational risk
• strategic risk
• operational risk
• transaction risk
• credit risk
• country risk
• other risks

Question 8

What is compliance risk?

Answer 8

Risk arising from violations of compliance laws or regulations or from noncompliance with the bank’s internal policies, procedures, or business standards.

Compliance risk is exacerbated when the bank has inadequate oversight, monitoring, or audit functions over third party relationships.

ex: marketing practices by a third party that violate UDAP.

Question 9

What is reputational risk?

Answer 9

Risk arising from negative public opinion. Third party relationships that result in dissatisfied customers, unexpected financial loss, interactions not consistent with bank policies, inappropriate recommendations, security breaches and violations are all examples that could harm reputation.

Any negative publicity even if unrelated to the third party could result in reputational risk.

Question 10

What is strategic risk?

Answer 10

Risk arising from adverse business decisions, or the failure to implement appropriate business decisions in a manner consistent with the bank’s strategic goals.

Use of a third party to perform banking functions or to offer products/services that do not help the bank achieve strategic goals and provide an adequate return on investment exposes the bank to strategic risk.

Question 11

What is operational risk?

Answer 11

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events. Third-party relationships often
integrate the internal processes of other organizations with the
institution’s processes and can increase the overall operational
complexity.

Question 12

What is transactional risk?

Answer 12

Transaction risk is the risk arising from problems with service or product delivery. A third-party’s failure to perform as expected by customers or the institution due to reasons such as inadequate capacity, technological failure, human error, or fraud, exposes the institution to transaction risk. The lack of an effective business resumption
plan and appropriate contingency plans increase transaction
risk. Weak control over technology used in the third-party arrangement may result in threats to security and the integrity of systems and resources. These issues could result in unauthorized transactions or the inability to transact business as expected.

Question 13

What is credit risk?

Answer 13

Risk that a third party is unable to meet the terms of the contract with the bank or otherwise financially perform as agreed.

The basic form of this risk involves the financial condition of the third party. Some contracts provide that the third party ensure some measure of performance related to obligations arising from the relationship. (ex: origination programs)

Credit risk also arises from the use of third parties that market or originate certain types of loans, solicit and refer customers, conduct underwriting analysis, or set up product programs for the bank. Appropriate monitoring of the financial activities of the third party is necessary to ensure that credit risk is understood and remains within board approved limits.

Question 14

What is country risk?

Answer 14

Country risk is the exposure to the economic, social, and political conditions and events in a foreign country that may adversely affect the ability of the foreign based third party to meet the level of service required by the arrangement, resulting in harm to the bank.

In extreme cases this could result in loss of data, research and development efforts, or other assets.

Managing country risk requires the ability to gather and assess information regarding the foreign govt policies, including those addressing information access as well as local, political, social, economic, and legal conditions.

Question 15

What other risks can a third party impose?

Answer 15

Third party relationships may also subject the bank to liquidity, interest rate, price, legal and foreign currency translation risks.

Question 16

What are some examples of concerns that can surface if there is a lack of appropriate oversight and monitoring of third party relationship and associated CMSs? (8)

Answer 16

• Where the institution lends its name or regulated entity status to products and services originated by others or activities predominantly conducted by others, and those vendors engage in practices that may be considered
predatory, abusive, or unfair and deceptive to consumers;

• When possible violations of fair lending and consumer protection laws and regulations occur, particularly when the
actual involvement of the institution and the third party is invisible to the customer;

• Where the third-party relationships do not meet the expectation of the institution’s customers;
• Where, due to the third party, the customer experiences poor service, disruption of service, financial loss resulting from not understanding product or service risks or alternatives, and inferior choices stemming from lack of disclosure(s);
• When privacy of consumer and customer records is not adequately protected;

• Where the third party is unable to deliver products or services due to fraud, error, inadequate capacity, or
technology failure, and where there is a lack of effective business resumption and contingency planning for such situations;

• Where a problem or issue lies with a service being rendered by a third party that went undetected by the institution because an appropriate audit or monitoring program was not in place for the third-party relationship; and

• Where the third party is the auditor for the institution’s CMS and management failed to properly oversee and
manage the scope and intensity of these audits to ensure reviews were comprehensive or covered areas of significant risk.

Question 17

What is the key to the effective and successful use of a third party?

Answer 17

For the bank’s management to appropriately assess, measure, monitor, and control the risks associated with the relationship and weave that process into its CMS.

Question 18

What are the four main elements of an effective third-party risk CMS?

Answer 18

• Risk assessments
• Due diligence in selecting a third party
• contract structuring and review
• oversight

Question 19

What is third party oversight?

Answer 19

The process of reviewing the operational and financial performance of third party activities over those products and services performed through third party arrangements on an ongoing basis, to ensure that the third party meets and can continue to meet the terms of the contractual arrangement.

Question 20

What is contract structuring and review?

Answer 20

The process of ensuring that the specific expectations and obligations of both the institution and the third party are outlined in a
written contract prior to entering into the arrangement—a contract should act as a map to the relationship and define its structure.

Question 21

What procedures should examiners follow when evaluating a third party risk assessment? (8)

Answer 21

• Determine if management, prior to entering into the relationship ensured the relationship is consistent with the strategic plan/business strategy.
• Determine if management, prior to starting the relationship, analyzed the strategic risk the bank is willing to accept.
• Determine if, prior to entering into the relationship, management analyzed the benefits, costs, legal aspects, and the potential risks associated with the third party.
• Determine if management performed a risk/reward analysis, comparing the proposed third party to other methods of performing the activity or product offering. This should be performed by management and reviewed by the Board or appropriate committee.
• Determine if bank employees have the knowledge and skills to adequately perform the risk assessment.
• Determine if management reviewed the third party’s activities for potential predatory, discriminatory, abusive, unfair, or deceptive actions to consumers.
• Determine if management reviewed its ability to provide adequate oversight and management of the third party on an ongoing basis.
• Determine if management has a process in place for evaluating new or significant third party relationships and issues to the board for review and approval.

Question 22

The risk assessment of a third party should identify what? (4)

Answer 22

• performance criteria
• internal controls
• reporting needs
• contractual requirements

All would be critical to the ongoing assessment and control of identified risks.

ex: if the activity involves consumer products or services, the board and management should establish a clear solicitation and origination strategy that allows for an assessment of performance, as well as mid course corrections.

Question 23

When performing due diligence on a third party, a bank should focus on what aspects? (5)

Answer 23

The scope and due diligence should be directly related to the importance and magnitude of the third party relationship and should focus on:

• financial condition
• relevant experience
• knowledge of laws and regulations
• reputation
• scope and effectiveness of its operations and controls

Question 24

What are some examples of things that can be included for review in the due diligence evaluation?

Answer 24

• Audited financial statements, annual reports, Securities and
Exchange Commission filings, and other available financial
information;

• Significance of the proposed contract on the third-party’s
financial condition;

• Experience and ability in implementing and monitoring the
proposed activity;

• Business reputation, including any complaints filed;
• Span of business operations in which the third party is engaged;
• Qualifications and experience of the company’s principals;

• Strategies and goals, including service philosophies, quality
initiatives, efficiency improvements, and employment policies;

• Existence of any significant complaints or litigation (past and pending), or supervisory actions against the company or its owners or principals;
• Ability to perform the proposed functions using current systems or the need to make additional investment;
• Use of other parties or subcontractors by the third party;
• Scope of internal controls, systems and data security, privacy protections, and audit coverage;
• Business resumption strategy and contingency plans;

• Knowledge of and background and experience with
consumer protection laws and regulations;

• Underwriting criteria;
• Adequacy of management information systems;
• Insurance coverage;

• Marketing materials to determine how the institution’s name
will be associated with the product;

• Websites; and
• Vendor and institution management responsibilities.

Question 25

Contracts should reviewed by the Board. What should examiners consider when reviewing the Boards approval of a contract? (5)

Answer 25

- if Board members are fully aware of the risks, issues, and responsibilities associated with the third party relationship. - if board members have close ties to or have a vested interest in the third party relationship - if the members abrogate their responsibilities during the review and approval of any relationship - if board members had access and reviewed due diligence findings, and were findings accurately presented. - is the review addressed in the board minutes.

Question 26

What procedures should examiners follow when reviewing third party contract structuring and review? (5)

Answer 26

- Determine if management ensures the expectations and obligations of the bank and the third party are outlined in a written contract prior to starting the relationship. Including the prohibition, transfer, or subcontracting by the third party of its obligations. - determine if the Board approved prior to entering into the arrangement. - Determine if appropriate legal counsel reviewed the contract prior to finalization - Determine if clearly defined performance standards are identified to measure the third party's performance. Management should periodically review these standards to ensure they still meet the bank's performance objectives. They can be used as a factor in third party compensation. - Review the contract to ensure it contains all applicable elements.

Question 27

What third party compensation agreements are prohibited?

Answer 27

The FDIC enforces laws and regulations that prohibit the use of compensation arrangements that encourage third-party originators to inappropriately steer borrowers into higher cost products or avoid mortgage lending in low-income neighborhoods where home prices are lower. Compensation arrangements should not create unintended incentives to engage in unfair or deceptive acts or practices, particularly with respect to product sales, loan originations, and collections; or be tailored to circumvent other applicable consumer protection laws and regulations, including fair lending laws and regulations.

Question 28

A third party contract should contain what elements? (10)

Answer 28

- Outline fees, compensation, variable charges, cost and responsibility for purchasing and maintaining equipment/software. Including obligations for retaining documentation for compensation agreements, and the party responsible for payment of legal or audit expenses. - Type and frequency of management information reports to be received from the third party. (performance, audits, financial, security, complaints, business resumption testing) - the bank's right to audit the third party as needed to monitor performance under the contract. (scope of audits, and compliance risks) - prohibits the third party and agents from using or disclosing the bank's information except as necessary to perform the functions designated by the contract or as permitted by law. (ex: privacy information and disclosure of breaches) - specifies who responds to complaints received by the third party from bank customers. if the third party responds, documentation of complaints and responses as well as summary reports/trend analysis of complaints. - Responsibility for continuation of services in event of operational failure. (man made/ natural disasters). Including providing disaster recovery and contingency plans and testing. - circumstances that constitute default, identifies remedies, and allows for opportunity to cure default. Including termination rights (ex: failure to prevent violations of law) - dispute resolution process. - ownership and right to use bank property, including intellectual property (name/logo). - Indemnification provisions

Question 29

What procedures should examiners follow when evaluating Board and management Oversight of third parties? (6)

Answer 29

- Determine if Board initially approved and annually reviews significant third party arrangements and what Board considered in approval. - Determine if management periodically reviews third party operations to verify consistency with contract and that risks are controlled (compliance with laws and internal policies and procedures). - Determine if management allocates sufficient qualified staff to monitor and provide necessary oversight. (extent of oversight depends on the potential risks, scope, and magnitude of the arrangement) - determine if management is following the bank's policies and procedures for terminating or probating third party relationships based on findings from audits/monitoring - determine if results of oversight activities are periodically reported to the board or committee. Weaknesses should be identified and promptly addressed. - determine if the bank maintains documents and records of all aspects of the relationship.

Question 30

What is an institution affiliated third party? (4)

Answer 30

By statute, an IAP is defined as: * Any director, officer, employee, or controlling stockholder (other than a bank holding company) of, or agent for, an insured depository institution; * Any other person who has filed or is required to file a change-in-control notice with their primary Federal banking regulator; * Any shareholder (other than a bank holding company), consultant, joint venture partner, and any other person as determined by the appropriate Federal banking agency (by regulation or case-by-case) who participates in the conduct of the affairs of an insured depository institution; or • Any independent contractor (including any attorney, appraiser, or accountant) who knowingly or recklessly participates in any violation of: ° any law or regulation; ° any breach of fiduciary duty; or ° any unsafe or unsound practice, which caused or is likely to cause more than a minimal financial loss to, or a significant adverse effect on, the insured depository institution.

Question 31

Why is the IAP designation important with regard to enforcement actions?

Answer 31

Because when the FDIC is considering bringing an enforcement action against a third party they are limited in jurisdiction to insured State nonmember banks, foreign institutions with an insured branch, and their IAPs.

Question 32

What types of items can be transaction tested during a third party review?

Answer 32

* Advertisement and marketing documentation; * New product development documentation; * Procedural manuals, including those for servicing, collections, and safeguarding customer information; * Employee training records; * Audit/monitoring report findings; * Customer disclosures, notices, agreements, and periodic statements for each product and service reviewed; * Account statements; * Contracts with third parties; * Compensation programs; * Promotional materials; * Telemarketing scripts; and * Recorded calls for telemarketing or collections.

Question 33

True or false: Appropriate corrective action, including enforcement action, may be pursued for deficiencies related to a third-party relationship, including IAP activities that pose compliance management concerns or result in violations of applicable consumer protection laws and regulations.

Answer 33

True Examiners are reminded that indemnity or other contractual provisions with third parties cannot insulate the institution from regulatory corrective action.