InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
Comptroller Identifies BSA/AML Risks, Calls For Increased Information Sharing
On November 17, the Comptroller of the Currency, Thomas Curry, delivered remarks at the American Bar Association/American Bankers Association BSA/AML conference in which he identified common BSA/AML compliance risks and failures, and identified steps industry participants and regulators should take to improve compliance. The Comptroller explained that successful BSA/AML compliance is dependent not only on “the strength of the institution’s technology and monitoring processes, and the effectiveness of its risk management,” but also on strong corporate governance processes and management’s willingness to commit adequate resources. Comptroller Curry called on banks to commit sufficient resources and take a “holistic approach” toward BSA/AML compliance, for example, by dispersing accountability throughout the organization instead of concentrating compliance in a single unit. Noting that this is particularly important in the M&A context, the Comptroller stated that it is vital that due diligence go beyond a target’s credit portfolio to include a review of the target’s BSA/AML program. In addition to lack of compliance resources, the Comptroller identified as risk trends: (i) poor management of international activities—foreign correspondent banking, cross-border funds transfers, bulk cash repatriation, and embassy banking; (ii) third-party relationships and payment processors; and (iii) emerging payment technologies, including virtual currencies. He stressed the importance of information sharing among institutions and between institutions and their regulators, and called for (i) legislation that would encourage the filing of SARs by strengthening the statutory safe harbor from civil liability for filing financial institutions, (ii) broadening the Patriot Act safe harbor for institutions that share information with each other about potential crimes and suspicious transactions, and (iii) exploring ways government can provide more robust and granular information about money laundering schemes and typologies to institutions in a more timely way.
OCC, FDIC Finalize Deposit Advance Guidance
On November 21, the OCC and the FDIC separately issued guidance that establishes numerous expectations for institutions offering deposit advance products, including with regard to consumer eligibility, capital adequacy, fees, compliance, management oversight, and third-party relationships. For example, under the guidance the agencies expect banks to offer a deposit advance product only to customers who (i) have at least a six month relationship with the bank; (ii) do not have any delinquent or adversely classified credits; and (iii) meet specific financial capacity standards. The guidance also establishes, among other things, that (i) each deposit advance loan be repaid in full before the extension of a subsequent loan; (ii) banks refrain from offering more than one loan per monthly statement cycle and provide a “cooling-off period” of at least one monthly statement cycle after the repayment of a loan before another advance is extended; and (iii) banks reevaluate customer eligibility every six months. The final guidance is substantially the same as the versions proposed in April. However, the agencies added language to clarify that eligibility and underwriting expectations do not require the use of credit reports, and to emphasize that the guidance applies to all deposit advance products regardless of how the extension of credit is offered. Acknowledging the demand for short-term, small-dollar credit products, and dismissing the concerns that the guidance might restrict such credit, the FDIC encouraged banks to continue to offer “properly structured products” and to develop new or innovative programs to effectively meet the need for small-dollar credit. As a reminder, the Federal Reserve Board did not propose similar guidance, but instead issued a policy statement.
Governor Yellen Addresses Bank Director Removal Over Foreclosure Practices; Lawmakers Press Regulators On Independent Foreclosure Review Details
On November 18, Federal Reserve Chair nominee Janet Yellen responded to a recent inquiry by Senator Elizabeth Warren (D-MA) seeking more details about the Federal Reserve Board’s process for determining whether bank officers or directors should be removed because they directly or indirectly participated in the alleged violations that have resulted in various mortgage servicer settlements. Governor Yellen stated that the Federal Reserve Board “has not, to date, taken any actions removing or prohibiting insiders of the mortgage servicing organizations that were subject to the 2011 and 2012 mortgage servicing enforcement actions for their conduct in connection with servicing or foreclosure activities”, but “[the Federal Reserve Board is], however, continuing to investigate whether such removal or prohibition actions are appropriate.” In addition, on November 15, Senator Warren, joined by Representatives Elijah Cummings (D-MD) and Maxine Waters (D-CA), again pressed the Federal Reserve Board and the OCC to release a public report on the Independent Foreclosure Review process. This latest request follows other similar requests made earlier this year.
OCC Continues OTS Integration, Rescinds OTS Compliance Documents
On November 20, the OCC announced in Bulletin 2013-34 that as part of its ongoing implementation of the Dodd-Frank Act’s mandate that the OCC integrate Office of Thrift Supervision (OTS) policies with existing OCC policies, the OCC is rescinding the OTS compliance documents listed in an appendix provided with the announcement. A second appendix lists OCC policy guidance that the OCC is applying to federal savings associations in cases where policy guidance did not already exist. The announcement does not cover OTS policies and guidance related to the FCRA, the CRA, UDAP, or mortgage regulations, which the OCC plans to address at a later date.
Banking Regulators Finalize Revised CRA Guidance
On November 15, the Federal Reserve Board, the FDIC, and the OCC finalized revisions to the “Interagency Questions and Answers Regarding Community Reinvestment” (Q&As). The agencies adopted the revisions largely as proposed, with some minor changes in response to comments. The new Q&As, which include revisions to five questions and answers and two new questions, generally are intended to: (i) clarify how the agencies consider community development activities that benefit a broader statewide or regional area that includes an institution’s assessment area; (ii) provide guidance related to CRA consideration of, and documentation associated with, investments in nationwide funds; (iii) clarify the consideration of certain community development services, such as service on a community development organization’s board of directors; (iv) address the treatment of loans or investments to organizations that, in turn, invest those funds and use only a portion of the income from their investment to support a community development purpose; and (v) clarify that community development lending performance is always a factor considered in a large institution’s lending test rating. The new Q&As take effect when they are published in the Federal Register.
OCC Establishes Standards For Independent Consultants Required Under Enforcement Actions
On November 12, the OCC issued Bulletin 2013-33, which establishes the standards the OCC uses when it requires banks to employ independent consultants as part of an enforcement action. The Bulletin explains that when conducting its initial assessment of the need for an independent consultant, the OCC considers, among other factors: (i) the severity of the violations; (ii) the criticality of the function requiring remediation; (iii) confidence in bank management’s ability to identify violations and take corrective action in a timely manner; (iv) the expertise, staffing, and resources of the bank to perform the necessary actions; (v) actions already taken by the bank to address the violations or issues; and (vi) the services to be provided by an independent consultant. The bulletin outlines the OCC’s process for reviewing a consultant selected by a bank, including its expectations for a bank’s due diligence process when retaining an independent consultant. The bulletin also describes the OCC’s oversight of the performance of the consultant, the nature of which can be impacted by, among other things: (i) the nature of deficiencies or violations the independent consultant is engaged to identify, including with respect to recommendations regarding remediation; (ii) the scope and duration of work; and (iii) the potential for and materiality of harm to consumers and the bank.
Prudential Regulators Release Stress Test Scenarios
On November 12, the FDIC released the economic scenarios that will be used by certain financial institutions with total consolidated assets of more than $10 billion for stress tests required under the Dodd-Frank Act. Each scenario includes key variables that reflect economic activity, including unemployment, exchange rates, prices, income, interest rates, and other salient aspects of the economy and financial markets. The baseline scenario represents expectations of private sector economic forecasters; the adverse and severely adverse are hypothetical scenarios designed to assess the strength and resilience of financial institutions and their ability to continue to meet the credit needs of households and businesses under stressed economic conditions. The FDIC release follows the recent release of stress test scenarios by the Federal Reserve Board and the OCC. The Federal Reserve Board also recently issued a final policy statement that describes the process by which it will develop future stress test scenarios.
Report On CFPB's Auto Finance Forum
This morning, the CFPB hosted an auto finance forum, which featured remarks from CFPB staff and other federal regulators, consumer advocates, and industry representatives.
Some of the highlights include:
- Patrice Ficklin (CFPB) confirmed that the CFPB, both before issuing the March bulletin and since, has conducted analysis of numerous finance companies’ activities and found statistically significant disparities disfavoring protected classes. She stated that there were “numerous” companies whose data showed statistically significant pricing disparities of 10 basis points or more and “several” finance companies with disparities of over 20 or 30 basis points.
- Much of the discussion focused on potential alternatives to the current dealer markup system. The DOJ discussed allowing discretion within limitations and with documentation of the reasons for exercising that discretion (e.g., competition). The CFPB focus was exclusively on non-discretionary “alternative compensation mechanisms”, specifically flat fees per loan, compensation based on a percentage of the amount financed, or some variation of those. The CFPB said it invited finance companies to suggest other non-discretionary alternatives. Regardless of specific compensation model, Ms. Ficklin stated that in general, nondiscretionary alternatives can (i) be revenue neutral for dealers, (ii) reduce fair lending risk, (iii) be less costly than compliance management systems enhancements, and (iv) limit friction between dealers on the one hand and the CFPB on the other.
- There was significant debate over whether flat fee arrangements, or other potential compensation mechanisms, actually eliminate or reduce the potential for disparate impact in auto lending. There was also criticism of the CFPB’s failure to empirically test whether these “fixes” would result in other unintended consequences. Industry stakeholders asserted that such arrangements fail to mitigate fair lending risk market-wide while at the same time potentially increase the cost of credit and constrain credit availability. Industry stakeholders also questioned the validity of the large dollar figures of alleged consumer harm caused by dealer markups. When assessing any particular model, the CFPB’s Eric Reusch explained, finance companies should determine whether (i) it mitigates fair lending risk, (ii) creates any new risk or potential for additional harm, and (iii) it is economically sustainable, with sustainability viewed through the lens of consumers, finance companies, and dealers.
- Numerous stakeholders urged the CFPB to release more information about its proxy methodology and statistical analysis, citing the Bureau’s stated dedication to transparency and even referencing its Data Quality Act guidelines. The DOJ described its commitment to “kicking the tires” on its statistical analyses and allowing institutions to do the same. The CFPB referenced its recent public disclosure of its proxy methodology, noting that this was the methodology the CFPB intended to apply to all lending outside of mortgage.
- Steven Rosenbaum (DOJ) and Donna Murphy (OCC) pointedly went beyond the stated scope of the forum to highlight potential SCRA compliance risks associated with indirect auto lending.
Additional detail from each panel follows. Please note that these details are based on notes taken during the event and could differ from actual statements made during the event. The entire report is subject to alteration or clarification, particularly if a transcript or archived video are made available.
Opening Remarks
Director Cordray opened the forum. He stressed the importance of vehicles to individual consumers and to the broader economy. He stated that some consumers may be subject to discrimination that may result in millions of dollars in consumer harm each year.
As he did in a Senate hearing earlier this week, Mr. Cordray emphasized that neither the 2012 fair lending bulletin nor the March 2013 auto finance bulletin were new; they simply served as a reminder to finance companies of liability under ECOA, particularly with regard to indirect auto finance.
He stated that the CFPB uses proven statistical methods and publicly available data to assess the probability that a particular customer belongs to a particular racial group or is of a particular national origin.
The March bulletin provided guidance about steps auto finance companies might consider taking to ensure they are ECOA-compliant. One approach described by the Director is to develop robust fair lending compliance management systems to monitor for disparate impact and promptly remedy consumer harm on an ongoing basis when it is identified. The bulletin also stated that finance companies could take steps to comply with the law by adopting some other pricing mechanism that fairly compensates dealers for their work but avoids the fair lending risks that are inherent in pricing by discretionary markup. Director Cordray stated that such mechanisms include: a flat fee per transaction, or a fixed percentage of the amount financed, or other nondiscretionary approaches that market participants may devise that would work to address these concerns.
He acknowledged that dealers are entitled to fair compensation, but stressed that the CFPB wants to make sure the process is transparent. He stated it is worth considering further how the disclosure of markup practices actually works.
Panel 1
Patrice Ficklin (CFPB): Ms. Ficklin described and defended the March bulletin, asserting that the CFPB did not provide any new legal interpretations, but rather reminded finance companies about existing law. She noted and defended the CFPB’s proxy methodology, as described recently in letters to Congress, but did not provide additional detail. She stated that the CFPB’s supervisory and enforcement work in this area is more substantial than it was in March, and continues to indicate fair lending risk—the CFPB has found “substantial and statistically significant” disparities between African Americans, Hispanics, and Asians and similarly situated white borrowers. The CFPB has identified numerous institutions with disparities over 10 basis points, and several over 20 or 30 basis points.
Going forward, the CFPB is committed to continuing a constructive dialogue with industry, a dialogue in which alternative compensation structures has been the key theme to date.
Melissa Yap (FRB): Ms. Yap described the Fed’s ECOA authority post-Dodd-Frank. She stated that pricing remains the greatest area of risk. The Fed employs the 2009 interagency fair lending procedures and looks at (i) financial incentives, (ii) the amount of discretion, and (iii) disparities in note rate and markup over buy rate. She described the Fed’s proxy methodology, which differs slightly from the CFPB’s, but which the Fed believes is appropriate for the size and complexity of the institutions it supervises. For race, the Fed geocodes and defines majority-minority census tracts as those over 50%. She defended name proxies for gender and ethnicity, stating they are as likely to over count as under count. She also referenced two webinars the Fed and other hosted this year, which included discussion of these issues, see e.g., August webinar.
Steven Rosenbaum (DOJ): Mr. Rosenbaum described the DOJ’s broad authority to enforce ECOA and noted that it has a number of investigations ongoing, including joint investigations with the CFPB. He stated that Congress created the issue that requires the use of proxies, given that ECOA protects classes in consumer lending but does not require data collection similar to HMDA. The DOJ is using the CFPB’s method on joint investigations, but it continues to “kick the tires” on its methods and analyses and invites finance companies to do the same.
He stated, twice, that ECOA does not require nor prohibit discretion in pricing; risk from discretion can be managed, for example by setting caps or requiring justifications and documentation.
Mr. Rosenbaum added that the DOJ also enforces SCRA, and stated that if finance companies have not thought about SCRA compliance in their auto finance programs, they ought to do so. He also acknowledged the DOJ’s ongoing investigation of buy-here, pay-here dealers, though the issues differ in that those dealers may be offering predatory products in minority neighborhoods.
Keith Ernst (FDIC): Mr. Ernst similarly described the FDIC’s jurisdiction and addressed in broad terms its approach to indirect auto financing. He stated that all examination and statistical results that are consistent with a violation are subject to independent review and all statistical analyses are reviewed by a team. The FDIC provides institutions with the results, data, and methods and provides an opportunity for questions and other feedback. Mr. Ernst also noted that this dialogue includes providing institutions with the opportunity to provide non-discriminatory explanations for statistical disparities. According to Mr. Ernst, the FDIC has amended analyses as part of these processes. The FDIC believes the vast majority of its banks are effectively managing fair lending risk in auto finance, but that examinations can reveal compliance management systems concerns that fall short of a fair lending violation.
Tonya Sweat (NCUA): Ms. Sweat stated that the practices identified in the CFPB bulletin are not prevalent in the credit union industry, but NCUA still examines for fair lending risk and safety and soundness. The NCUA advises credit unions that sound practices include sampling and testing of loans, particularly to ensure third-party compliance. Credit unions should implement written policies that require written approval of any changes to underwriting criteria.
Donna Murphy (OCC): Ms. Murphy provided only brief comments, and generally referenced and incorporated what others had said on proxies. The OCC is revising and updating its methods for fair lending risk assessments and scoping based on changes in markets, the legal environment, and technology. These changes are intended to result in more consistency in examinations and the ability of the OCC to conduct more analysis across banks. For auto finance, the OCC is looking at how it gathers factors regarding use of third-parties. Ms. Murphy also noted the OCC’s attention to SCRA, stating that last year it revised examination procedures and enhanced examiner training for SCRA, including in auto finance, and that those enhancements are reflected in this year’s examination cycle.
Panel 2
The second panel was moderated by the CFPB’s Rohit Chopra and featured remarks from the National Association of Minority Automobile Dealers (NAMAD), the National Consumer Law Center (NCLC), the Consumer for Auto Reliability and Safety (CARS), and the NAACP.
Stuart Rossman from the NCLC described his part in a series of class actions against auto finance companies in the 2000s. Those actions, as he described, resulted in markup caps, the last of which sunsetted last year. He asserted that the market forces that led to those actions persist, as do fundamental problems in discretionary pricing policies. Citing more restrictive class action requirements and less access to critical data, he called on the CFPB to take the lead in enforcement.
NAMAD acknowledged the possibility that bad actors exist in the market, but argued against eliminating discretion. NAMAD called for approval and documentation requirements for discretionary programs. NAMAD supports uniform data collection, enhanced proxies, training and education for dealers and consumers.
CARS noted California’s markup cap statute and reported that a proposal for a ballot proposition outlawing dealer discretion has been filed with the state attorney general. CARS also encouraged the CFPB to look at the impact of percentage rate markups in the motor home market.
Panel 3
Bill Himpler, American Financial Services Association (AFSA): Mr. Himpler stressed that the current indirect auto finance model is efficient and proven. He noted that auto finance complaints are at record lows, and pointed out that even the CFPB’s database shows a small number of complaints compared to other markets. Since the CFPB has refused to assess the impact of a broad market shift towards flat fee compensation structures or other alternatives, AFSA is commissioning an independent study to assess the present model and evaluate costs and benefits of alternative models.
Chris Kukla, Center for Responsible Lending (CRL): Mr. Kukla countered that the current compensation model gives rise to potential discrimination and should be ended. Consumers have no ability to know what part of their rate is based on risk and what is due to compensation. He defended the CRL’s 2011 study on indirect auto finance from attacks, including those that followed Senator Warren’s reference to the study during a Senate hearing earlier this week. That study concluded that consumers pay $26 billion each year in markups. Mr. Kukla explained that CRL never said consumers would not otherwise be charged a portion of those fees, and only sought to define the size of the market. He referenced other research that indicates a market-wide adoption of flat fee arrangements would have little impact on dealers.
Paul Metrey, National Automobile Dealers Association (NADA): Mr. Metrey outlined a preferred approach by federal regulators to unintentional disparate impact discrimination: (i) understand the market, (ii) develop appropriate methods, and (iii) if present, address in a manner that assists consumers. He called for the CFPB to pursue more open processes on this issue, including by identifying its complete statistical methodology and fully accounting for neutral legitimate factors. He presented NADA’s case against flat fee arrangements, in part on the basis that dealers still will have discretion to select among finance sources that may offer different flat fee arrangements.
Rich Riese, American Bankers Association (ABA): Mr. Riese challenged the CFPB’s post hoc approach to obtaining input on its auto finance program, stating that the forum does not substitute for the kind of engagement the issue requires. He argued that the guidance should have been proposed and subject to notice and comment. The ABA believes proxies should be viewed with skepticism; they can be useful to identify risks and can be useful in compliance programs, but they should not be used to prove violations. Citing the 1999 interagency exam procedures, he argued that discretion is not an appropriate area to apply disparate impact, and, before straying too much from prior policy, regulators should recognize that Reg. B applies to creditors determination of creditworthiness and the discretion being applied in auto finance is for compensation and is not part of a creditor’s determination of creditworthiness.
The panelists also discussed the comparison of indirect auto finance to the mortgage market, particularly the use of broker yield spread premiums. Mr. Riese pointed out that in the mortgage context, brokers were alleged to have steered borrowers into “bad” loans without considering suitability; that is not the case in the auto market where there are no option arms, teaser rates, etc. Mr. Himpler and Mr. Metrey agreed. Mr. Metrey added that the comparison is apples to oranges—the markets have performed differently; there is nothing going on in auto ABS like there was in MBS. He added that Congress directed an end to yield spread premiums and there has been no similar action in auto, and the Fed tested to see if a fix was necessary but there has been no similar testing in auto.
Mr. Kukla responded that the mechanics may be different, but the impact and incentives are the same. A broader view of “steering” covers any instance in which a consumer is provided a loan with less advantageous terms than the consumer otherwise would have received.
OCC Releases Comptroller Handbook Addition And Revisions
On November 6, the OCC issued two bulletins to announce an addition and revisions to the Comptroller’s Handbook. The OCC also rescinded certain Handbook provisions. Bulletin OCC 2013-30 adds to the Handbook the “Qualified Thrift Lender” (QTL) booklet, which includes the “Qualified Thrift Lending Test,” issued June 2002 as part of the Office of Thrift Supervision’s Examination Handbook. The revisions are statutory in nature and include, among other things, new language pursuant to the Dodd–Frank Act regarding QTL failure and the violation of HOLA section 5 and additional limitations in the payment of dividends. Bulletin OCC 2013-31 updates the “Insider Activities” booklet and provides guidance for examiners and bankers on how national banks and federal savings associations may legally and prudently engage in transactions with insiders. The booklet explains how to implement risk management processes that provide for the appropriate control and monitoring of insider activities and how examiners review and assess insider activities during the supervisory process.
Special Alert: OCC Updates Third-Party Risk Management Guidance
On October 30, the OCC issued Bulletin 2013-29 to update guidance relating to third-party risk management. The Bulletin, which rescinds OCC Bulletin 2001-47 and OCC Advisory Letter 2000-9, requires banks and federal savings associations (collectively “banks”) to provide comprehensive oversight of third parties, including joint ventures, affiliates or subsidiaries, and payment processors. It is substantially more prescriptive than CFPB Bulletin 2012-3, and incorporates third-party relationship management principles underlying recent OCC enforcement actions.
The Bulletin warns that failure to have in place an effective risk management process commensurate with the risk and complexity of a bank’s third-party relationships “may be an unsafe and unsound banking practice.” It outlines a “life cycle” approach and provides detailed descriptions of steps that a bank should consider taking at five important stages:
Planning: A third party relationship should begin with an internal assessment of risks relating to third parties in general, and to the intended third party in particular. Such planning should focus on both the potential impact to the bank and the bank’s customers, as well as potential security, regulatory, and legal ramifications.
Due Diligence and Third Party Selection: The Bulletin requires that the bank conduct an adequate due diligence review of the third party prior to entering a contract. Proper due diligence includes a thorough evaluation of all potential third parties, and the degree of diligence should be commensurate with the level of risk and complexity. In particular, banks should look to external organizations such as trade associations, the Better Business Bureau, the FTC, and state regulators when performing diligence on consumer-facing third parties. While prior Bulletin 2001-47 contained a list of potential items for due diligence review, Bulletin 2013-29 describes them in more detail and adds to the specific areas that due diligence should focus on, including:
- Legal and regulatory compliance: The bank should “evaluate the third party’s legal and regulatory compliance program to determine whether the third party has the necessary licenses to operate and the expertise, processes and controls to enable the bank to remain compliant with domestic and international laws and regulations;”
- Fee structure and incentives: The bank should determine if the fee structure and incentives would create burdensome upfront fees or result in inappropriate risk taking by the third party or the bank;
- Risk management systems: The bank should have adequate policies, procedures, and internal controls, as well as processes to escalate, remediate, and hold management accountable for audit and independent testing reviews;
- Human resource management: The bank should review the third party’s training program and processes to hold employees accountable for compliance with policies and procedures; and
- Conflicting contractual arrangements: The bank should check a third-party vendor’s contractual arrangements with other third parties, which may indemnify the vendor and may therefore expose the bank to additional risk.
Contract Negotiation: All relationships should be documented by a written contract that clearly defines the responsibilities of both the bank and the third party. Among other things, the contract should provide for performance benchmarks, information retention, the right to perform an audit, and OCC supervision. Bulletin 2013-29 expands upon Bulletin 2001-47 with respect to the following areas:
- Legal and regulatory compliance: Contracts should require compliance with applicable laws and regulations, including GLBA, BSA/AML, OFAC, and fair lending, as well as other consumer protection laws and regulations;
- Audits and remediation: Contracts should provide for the bank’s right to conduct audits and periodic regulatory compliance reviews, and to require remediation of issues identified;
- Indemnification: Contracts should include indemnification as appropriate for noncompliance with applicable law, and for failure to obtain any necessary intellectual property licenses;
- Consumer complaints: The bank should specifically require the third party to submit “sufficient, timely, and usable information on consumer complaints to enable the bank to analyze customer complaint activity and trends for risk management purposes;” and
- Subcontractor management: The bank should incorporate provisions specific to the third party’s own use of subcontractors, including obligations to report on conformance with performance measures and compliance with laws and regulations, and should reserve the right to terminate the contract if the subcontractors do not meet the third party’s obligations to the bank.
Ongoing Monitoring: The bank should dedicate sufficient staff to monitor the third party’s activities throughout the relationship as it may change over time. Bulletin 2013-29 expands upon Bulletin 2001-47 in the following notable ways:
- Legal and regulatory compliance: The bank should monitor third-party vendors for compliance with all applicable laws and regulations;
- Early identification of issues: The bank should consider whether the third party has the ability to effectively manage risk by self-identifying and addressing issues;
- Subcontractor management: The bank should continuously monitor a third-party vendor’s reliance on or exposure to subcontractors and perform ongoing monitoring and testing of subcontractors; and
- Consumer complaints: The bank should monitor the “volume, nature, and trends” of consumer complaints relating to the actions of third-party vendors, particularly those that may indicate compliance or risk management deficiencies.
Termination: The Bulletin specifies for the first time a termination “stage” in the third-party relationship management life cycle. Banks should develop a contingency plan for the end of the relationship, either through the normal course or in response to default. The contingency plan may transfer functions to a different third party or in-house.
The Bulletin defines as “critical” any activities involving significant bank functions (payments, clearing, settlements, and contingency planning); significant shared services (information technology); or other activities that (i) could cause a bank to face significant risk as a result of third-party failures, (ii) could have significant customer impacts, (iii) involve relationships that require significant investments in resources to implement and manage, and (iv) could have a major impact on bank operations if an alternate third party is required or if the outsourced activity must be brought in-house.
These “critical” activities should be the focus of special, enhanced risk management processes. Specifically, the bank should conduct more extensive due diligence on the front end, provide summaries of due diligence to the board of directors, ensure that the board of directors reviews and approves third-party contracts, engage in more comprehensive ongoing monitoring of the third party’s performance and financial condition (including, potentially, a look comparable to the analysis the bank would perform when extending credit), ensure that the board of directors reviews the results of ongoing monitoring, and periodically arrange for independent testing of the bank’s risk controls.
Finally, the Bulletin sets forth obligations and responsibilities relating to third-party relationships from the bank employees who manage them to the board of directors, including retention of due diligence results, findings, and recommendations, as well as regular reports to the board and senior management relating to the bank’s overall risk management process.
Questions regarding the matters discussed in this Alert may be directed to any of our lawyers listed below, or to any other BuckleySandler attorney with whom you have consulted in the past.
- Jeffrey P. Naimon, (202) 349-8030
- Christopher M. Witeck, (202) 349-8051
- Jon David Langlois, (202) 349-8045