Banking and Finance Law Daily Wrap Up, TOP STORY—Fed advises banks on potential risk of service providers, (Dec 6, 2013)
By Lisa M. Goolik, J.D.
The Federal Reserve Board is reminding financial institutions it supervises to exercise appropriate risk management and oversight when using service providers. In its guidance, Fed describes the factors financial institutions should consider when choosing a service provider and how service providers should be overseen. The guidance is applicable to state-chartered banks that are members of the Federal Reserve System, bank and savings and loan holding companies and their nonbank subsidiaries, and U.S. operations of foreign banking organizations (SR 13-19/CA 13-21, Dec. 5, 2013).
Broad definition. The Fed defines a service provider as “any organization or entity—such as a consultant—that enters into a contractual relationship with a financial institution to provide business functions or activities, such as accounting, auditing, loan review, compliance, and risk management.” The guidance supplements existing guidance on technology service provider risk and applies to all service provider relationships, regardless of the type of bank activity that is outsourced.
Risks of use. While the Fed does not discourage financial institutions from outsourcing activities to service providers, it advises firms to be aware of the potential risks. If service providers are not supervised effectively, financial institutions may be exposed to risks that can result in loss of reputation, financial loss, or regulatory actions. According to the guidance, financial institutions should consider the following risks:
compliance risks—when the services, products, or activities of a service provider fail to comply with applicable U.S. laws and regulations;
concentration risks—when outsourced services or products are provided by a limited number of service providers or are concentrated in limited geographic locations;
reputational risks—when actions or poor performance of a service provider causes the public to form a negative opinion about a financial institution;
country risks—when a financial institution engages a foreign-based service provider, exposing the institution to possible economic, social, and political conditions and events from the country where the provider is located.;
operational risks—when a service provider exposes a financial institution to losses due to inadequate or failed internal processes or systems or from external events and human error; and
legal risks—when a service provider exposes a financial institution to legal expenses and possible lawsuits.
Responsibilities of senior management. In addition, the guidance reminds institutions that the use of service providers does not relieve a financial institution's board of directors or senior management of responsibility for the activities performed by service providers. The board of directors should establish policies regarding the use of service providers, including a service provider risk management program. The program should address risk assessments and due diligence, standards for contract provisions and considerations, ongoing monitoring of service providers, and business continuity and contingency planning. Senior management must ensure that the board’s policies and risk management program are appropriately executed and is also responsible for regularly reporting to the board of directors on adherence to policies governing outsourcing arrangements.
MainStory: TopStory BankingOperations DirectorsOfficersEmployers FederalReserveSystem