The Federal Reserve, the FDIC, and the OCC issued a clarification on bank oversight of core processing providers and other critical vendors. The interagency statement outlines expectations for third-party risk management, including due diligence, contracting, ongoing monitoring, and exit planning. It emphasizes that banks remain accountable for compliance and highlights contract terms such as audit rights, service-level agreements, incident notification timelines, data ownership, and termination assistance. The agencies note coordinated examinations of service providers through the FFIEC to align supervisory expectations. The concentration of core providers like Fiserv, FIS, and Jack Henry raises operational and negotiation risks, prompting banks to revisit contracts and reporting. Fintechs and Banking-as-a-Service partners should expect longer procurement and deeper control reviews, including SOC 2 reports, penetration testing, and financial resilience documentation.
Learn more on this news by visiting us at: https://greyjournal.net/news/