Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

On May 3, the Federal Deposit Insurance Corporation, Federal Reserve System Board of Governors and Office of the Comptroller of the Currency published <a href="https://www.fdic.gov/resources/bankers/third-party-relationships/third-party-risk-management-guide.pdf" target="_blank" rel="noreferrer noopener">“Third-Party Risk Management: A Guide for Community Banks”</a> (“2024 Guide”) as a resource to help community banks develop and implement third-party risk management programs, policies, and practices. Although the 2024 Guide is intended for community banks, all organizations that rely on third-party service providers, especially for technology-related services (e.g., cloud storage, online platforms, data retention), will find it useful.

contentpilot/introduction

core/heading

The banking regulators understand that there is significant risk when third parties collect and retain customer data on behalf of a financial institution, and some of the most significant data breaches in recent years have targeted information technology (IT) service providers, who often furnish IT services to hundreds, if not thousands of companies. The banking regulators have indicated that “engaging a third party does not diminish or remove a bank’s responsibility to operate in a safe and sound manner and to comply with applicable legal and regulatory requirements, including consumer protection laws and regulations, just as if the bank were to perform the service or activity itself.”

core/paragraph

In June 2023, the banking regulators published <a href="https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management" target="_blank" rel="noreferrer noopener">“Interagency Guidance on Third-Party Relationships: Risk Management”</a> (<a>“</a>Interagency Guidance<a>”</a>), which set forth principles to support a risk-based approach to third-party risk management that banking organizations should consider when developing and implementing risk management practices for all stages in the life cycle of third-party relationships. The 2024 Guide is intended to assist community banks when developing and implementing their third party risk-management practices and is not a substitute for, nor does it replace, the Interagency Guidance.

According to the 2024 Guide, not all business relationships require the same level of oversight, and organizations should apply more rigorous risk-management practices for service providers that support higher-risk activities. In determining whether an activity is higher-risk, a bank should assess various factors, such as if the third party has access to sensitive data (including customer data), processes financial transactions, or provides essential IT or other business services. Further, it should “adjust and update [its] third-party risk-management practices commensurate with [its] size, complexity, and risk profile by periodically analyzing the risks associated with each third-party relationship.”

The 2024 Guide describes key principles within each of the five stages of risk management: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination.

According to the 2024 Guide, “careful planning enables a community bank to consider potential risks in the proposed third-party relationship” and “risk assessments are an important component of managing third-party relationships and help a bank evaluate the extent of risk-management resources and practices for effective oversight of the proposed third-party relationship throughout the subsequent stages of the third-party relationship life cycle.” Key issues to consider in the planning stage include identifying:

core/list

The 2024 Guide reinforces the Interagency Guidance, noting that “[a]s part of sound risk management, effective planning allows a banking organization to evaluate and consider how to manage risks before entering into a third-party relationship.”

Due diligence is the process for assessing a third party’s ability to perform its services in accordance with its contractual expectations, applicable law and regulations, and internal policies and procedures. According to the 2024 Guide, “[e]ffective due diligence assists with the selection of capable and reliable third parties to perform activities for, through, or on behalf of the community bank” and “[i]f the bank cannot obtain desired due diligence information from the third party, the bank may consider alternative information, controls, or monitoring.” <a>Key issues to consider in this phase include:</a>

The 2024 Guide identifies several sources that can provide information on a third party’s capabilities and risk profile, such as its financial statements, business licenses, internal policies and procedures, independent audit results, staffing level, volume and nature of consumer complaints against it, sanctions list reports, current insurance coverage, press releases, references and feedback from peer institutions or clients, disclosures and information in the media or in any of its publications, and internet searches to determine whether the service provider has been partnered with institutions subject to certain consent orders and litigation.

Before entering a formal business relationship with a third party, an organization needs to ensure that its contract provisions satisfy its business objectives, regulatory obligations, and risk-management policies and procedures. The 2024 Guide provides that when an organization “has limited negotiating power,” it is important for it “to understand any resulting limitations and consequent risks” and “[p]ossible actions [it] might take in such circumstances include determining whether the contract can still meet the community bank’s needs, whether the contract would result in increased risk to the community bank, and whether residual risks are acceptable.” Key issues to consider include:

Importantly, the 2024 Guide notes that an organization’s risk assessment and due diligence findings must be used to determine the provisions to include in the contract, and the third party’s proposed service level agreements should be included in contracts to “set applicable performance and security metrics.”

According to the 2024 Guide, an organization’s “ongoing monitoring” of the third party’s contract performance enables it to determine if the third party is performing as required for the duration of the contract and to adapt and refine its risk-management practices. Key issues to consider in this phase include:

The 2024 Guide emphasizes the following point set forth in the Interagency Guidance: “Ongoing monitoring enables [an organization] to (i) confirm the quality and sustainability of a third party’s controls and ability to meet contractual obligations; (ii) escalate significant issues or concerns [such as data breaches]; and (iii) respond to such significant issues or concerns” in a timely manner.

There are a variety of reasons an organization may choose to end its relationship with a third party. It should consider the impact of a potential termination during the planning stage of the life cycle, which may assist in mitigating costs and disruptions caused by termination, particularly for higher-risk activities. Accordingly, organizations should consider:

An organization’s contract with the third party should assess how parties may exit the relationship and the conditions under which fees or penalties will be imposed for early termination.

A third-party risk management framework is an essential part of any organization’s operations. Given the recent trend in cybersecurity attacks against third-party service providers, this type of framework is especially important for organizations to comply with their legal and regulatory obligations.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/05/Privacy-Cybersecurity-Update-Banking-Regulators-Publish-Third-Party-Risk-Management-Guide.pdf

Banking Regulators Publish Third-Party Risk Management Guide

Services