ABA Letter on the Proposed Interagency Guidance on Third-Party Relationships: Risk Management

VIA ELECTRONIC SUBMISSION

Ann E. Misback
Secretary
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue NW
Washington, DC 20551

James P. Sheesley, Assistant Executive Secretary
Attention: Comments-RIN 3064-ZA26, Legal ESS
Federal Deposit Insurance Corporation
550 17th Street, NW
Washington D.C. 20429

Chief Counsel’s Office
Attention: Comment Processing
Office of the Comptroller of the Currency
400 7th Street SW, Suite 3E-218
Washington, DC 20219

Ladies and Gentlemen:

The American Bankers Association is pleased to comment on the interagency third-party risk management guidance proposed by the Board of Governors of the Federal Reserve System (Federal Reserve), the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC)(collectively, the agencies). The proposed guidance describes the third-party risk management life cycle and identifies principles applicable to the six stages of a third-party relationship, including: (1) strategy and planning; (2) due diligence; (3) contract negotiation; (4) governance and oversight; (5) monitoring; and (6) termination.

Over the years, each of the agencies has issued third-party risk management guidance for its respective supervised institutions. To promote consistency across the agencies, regulators are jointly seeking comments on the proposed guidance, which is based largely on OCC Bulletin 2013-29. The proposed joint guidance would replace each agency’s existing third-party risk management guidance. 

ABA supports this joint effort. This undertaking is especially valuable as a bank’s ability to compete in the marketplace depends increasingly on the institution’s ability to leverage the expertise of third-party service providers and manage those relationships prudently. 

I. Summary of Comments

Below are the highlights of our comments on the proposal.  

• Scope and Application. The guidance is broad in scope, yet provides that a bank’s third-party risk management efforts should be risk-based. As an initial step to addressing this tension, any final guidance should: (1) be limited to situations where there is a written contract between the bank and a third party pursuant to which a bank receives services on an ongoing basis and (2) exclude ad hoc arrangements with limited duration. We also recommend that the agencies explain how banks might apply the principles articulated in the guidance to relationships with particular characteristics.  
• Contracting and Due Diligence. The guidance should clarify that the enumerated due diligence factors and suggested contractual considerations are not intended to apply to all third-party relationships and should not be viewed as a mandatory checklist. Our comments offer several examples to illustrate why applying the specified criteria to all third-party relationships is unnecessary and does not enhance a bank’s ability to manage its third-party risk.  
• Subcontractors. The guidance should expressly acknowledge that banks do not have legal standing with fourth parties and should specify that the recommended contractual considerations regarding bank approval of subcontractors are intended to apply only to a third party’s subcontractors that are “material” or “significant” to the service that the third party is providing to the bank.  
• FAQs.  Any FAQs adopted as part of any updated guidance should be issued on an interagency basis.
• Implementation. Regulators should provide banks with sufficient time to adapt to any final guidance. The proposed guidance is broader and more detailed than the third-party risk management guidance that exists today for banks regulated by the FDIC and the Federal Reserve. Regulators should be mindful that banks regulated by these agencies will need time to identify any gaps between their current practices and the new guidance and align their programs accordingly.      
• Opportunities for Agency Coordination and Communication. In addition to updating and aligning their respective third-party management guidance documents, the agencies should take additional actions to reduce some of the friction and duplication associated with third-party risk management. In particular, we urge each of the federal banking agencies to participate in the FDIC’s work to establish a public/private standard-setting partnership and corresponding certification program to help reduce the cost, inefficiencies, and uncertainty related to bank onboarding of third-party service providers. Additionally, the agencies should proactively share “lessons learned” from service provider examinations and should expedite the sharing of service provider examination reports to the extent permitted by law.

Download the comment letter to read the full text.