# Purpose

This policy provides for joint examinations of data centers providing
services to insured institutions supervised by more than one federal
regulatory agency. It is expected to eliminate the need for separate
examinations of data processors by more than one federal financial
institution regulator and to result in more efficient use of examiner
resources. This policy supercedes the previously issued interagency EDP
examination policy, including the Multiregional Data Processing
Servicers policy.

## Examination Responsibility

Examination responsibility is determined based on the class/type of
servicer as well as the class/type of insured financial institution(s)
being serviced.

A.  Insured Institutions

> Data centers operated by an insured financial institution or its
> subsidiary will be examined by the federal regulatory agency
> responsible for the institution.

B.  Financial Institution Holding Companies

Data centers operated by a holding company or its affiliate which
service only one class of insured financial institution will be examined
by the federal regulatory agency responsible for that class of
institution.

Data centers operated by a holding company or its affiliate which
service more than one class of insured financial institution will be
examined jointly, or on a rotated basis, as agreed to by the federal
regulatory agencies responsible for that class of institution.

Data centers operated by a holding company which controls only one
insured financial institution, or its affiliate, will be examined by the
federal regulatory agency responsible for the institution.

C.  Independent Data Centers

Responsibility for the examination of independent data centers will be
based on the class of insured financial institution being serviced. If
more than one class of insured institution is serviced, the examination
will be conducted jointly, or on a rotated basis, as agreed to by the
federal regulatory agencies responsible for that class of institution.

D.  Financial Institution Service Corporation

Responsibility for the examination of service corporations will be based
on the class of insured financial institution being serviced.

E.  Multiregional Data Processing Servicers (MDPS)

MDPS examinations are to be conducted on a joint basis by the federal
agencies having responsibility for the class of institution serviced.
MDPS examinations will be administered by the FFIEC EDP Subcommittee of
the Task Force on Supervision in Washington, D.C. The EDP subcommittee
will determine the data centers subject to examination under the MDPS
program. Generally, an organization will be considered for examination
under the MDPS program provided: the organization processes major
applications for a large number of insured financial institutions,
thereby posing a high degree of systemic risk; or the organization
processes work from a number of data centers located in diverse
geographic regions.

No federal regulatory agency is precluded from conducting an independent
examination of any data center that is providing data processing
services to an insured financial institution for which the agency is
responsible or where an agency has regulatory responsibility for holding
company data centers.

## Scheduling

Scheduling of joint/rotated EDP examinations and issuance of the EDP
Report of Examination will be handled at the regional/district level.
However, the examination of data centers under the MDPS program will be
administered at the national level. A list of regions and contact
personnel will be forwarded under separate cover and will be revised as
appropriate.

F.  Joint and Rotated Examinations

Regional/district representatives should meet annually (as early in the
scheduling cycle as possible, but no later than December 1) to arrange
for upcoming examinations and ensure that all data centers are examined
in accordance with existing agency guidelines. As regional/district
boundaries vary, it may be necessary for an agency to send
representatives from more than one regional/district office to attend
the scheduling meeting. Conversely, a representative may be required to
attend more than one meeting. State agencies interested in participating
in joint examinations may be invited to these meetings as deemed
appropriate.

The meeting should identify all data centers, except for MDPS.
Examinations of these data centers are to be conducted jointly and
examination schedules agreed upon by participating agencies. If an
agency cannot complete its schedule as agreed, it shall promptly notify
the appropriate agencies so that alternative arrangements can be made.

When joint examinations cannot be scheduled, one agency will be
designated to perform the examination on behalf of all concerned
agencies. In these situations, examination responsibilities will be
rotated for two-year periods. However, when the data center\'s overall
condition is determined to be less than satisfactory, subsequent
examinations should be conducted on a joint basis until the data
center\'s overall condition is satisfactory as defined in the EDP
Examination Handbook policy statement SP-2: Uniform Interagency Rating
System For Data Processing Operations.

The regional examination schedule should establish: the data centers to
be examined; the date, time and agency responsible for any rotated or
joint examinations; and the agency responsible for authoring and
processing the examination report.

G.  Multiregional Data Processing Servicers

Scheduling of MDPS examinations will be the responsibility of the FFIEC
EDP Subcommittee of the Task Force on Supervision. By September 30 of
each year, the EDP Subcommittee will prepare and publish an annual
schedule for MDPS examinations designating the data center, the date of
examination and the lead agency. This schedule will be distributed by
the EDP Subcommittee agency representatives to their regional/district
offices as soon as practical. An agency will be in charge of no more
than two consecutive MDPS examinations.

> Institutions with a composite rating of 1 or 2 will be subject to a
> full examination on a 24 month examination cycle, 3 rated institutions
> should be examined at an 18 month cycle and those institutions rated 4
> or 5 at a 12 month cycle. The ongoing condition of MDPS should be
> monitored between examinations through periodic visitations and
> progress reports, as appropriate.
>
> The lead agency is responsible for conducting a pre-examination review
> to determine: the scope of the examination, resource requirements,
> schedule of events and procedures to be followed during the course of
> the examination. At minimum this pre- examination report should
> provide details on the organization\'s: corporate history, corporate
> and organizational structure, scope of the upcoming examination, data
> centers included in the examination and examiner requirements. The
> pre- examination report should be forwarded to the Washington, D.C.
> office of the lead agency at least 60 days prior to the commencement
> of the MDPS examination.
>
> Examinations of individual data centers or processing sites may
> commence prior to the start of the headquarters examination if more
> than one facility is involved. However, these time frames must be
> approved by the lead agency.

## Report Preparation

H.  Joint Examinations

Responsibilities will be divided among the EDP examiners assigned to the
examination. When preparing joint examination reports, the participating
agencies are required to reach agreement on the report comments. In rare
instances when agreement cannot be reached at the regional level, the
differences should be appealed to the Washington office of the
participating agencies for final resolution.

The processing of the final Report of Examination (FFIEC 007) is the
responsibility of the authoring agency. All changes made to the joint
report in the course of its processing should be approved by the
regional staffs of the agencies participating in the examination.

I.  MDPS Examinations

Only one consolidated Report of Examination will be prepared by the lead
agency. The objective is to give the overall view of the organization,
not each individual data center comprising the Multiregional Data
Processing Servicer. However, the relative strength of each facility
should be evaluated. In some instances it may be necessary to issue a
specific data center report, although such action would be taken at the
discretion of the EIC and the lead agency\'s Washington office.

## Report Distribution Policies and Procedures

J.  Joint Examinations

> The lead agency is responsible for providing each affected federal and
> state banking agency with a copy of the completed report, including
> the Administrative Section. (A complete list of all serviced financial
> institutions, by charter, should be included in this section as well.)
> Each agency is responsible for reproducing the report comments and
> distributing them to serviced institutions in accordance with the
> provisions below. A transmittal letter will be used to advise each
> recipient that the comments are for their internal use only, are not
> to be construed to satisfy audit requirements and remain the
> confidential property of the lead agency. A written receipt will be
> obtained from each recipient.
>
> In all instances, examination reports should be distributed to the
> board of directors of the examined data center. Where the data center
> is a subsidiary of a holding company, the report should be forwarded
> to the board of directors of the data center, where applicable, or
> otherwise senior management of the data center and to the board of
> directors of the holding company. In the case of a service
> corporation, a copy should be forwarded to the corporation\'s board of
> directors as well as to the board of directors of each financial
> institution owning stock in the corporation.
>
> Independent Service Bureau reports should be directed to the board of
> directors or senior management of the servicer. If the independent
> service bureau is a branch of a multi-branch servicing organization,
> an additional copy should be forwarded to the board of directors at
> the corporate headquarters.
>
> Distribution of examination reports to serviced institutions for joint
> examinations will be at the discretion of the federal regulatory
> agency responsible for regulating the institution serviced, except for
> data centers rated composite 4 or 5, which must be distributed to all
> insured serviced institutions. Where an examination report is to be
> distributed by a participating agency, the lead agency must be so
> notified prior to transmitting the examination report. When an
> examination report is requested by a serviced financial institution,
> only the examiner\'s conclusions, recommendations and comments are to
> be transmitted to the serviced institutions. Matters of a proprietary
> or competitive nature relating to the servicer will be excluded from
> the report comments prepared for distribution to serviced
> institutions, but will be contained in the report provided to the
> servicer and the other federal agencies. In cases where the servicer
> fails to respond to corrective action requests, it may be necessary to
> report the uncorrected deficiencies to the serviced institutions. In
> these situations, the regulatory agencies of all serviced institutions
> must be in agreement regarding the need for this course of action and
> must meet with the servicer to convey this intent.
>
> The FFIEC interagency procedures do not affect existing distribution
> agreements with state agencies. However, no state agency shall
> distribute examination reports to any serviced institution without the
> express consent of the lead agency. Only the agency conducting the
> examination will provide nonparticipating state authorities copies of
> the report. In the case of joint examinations, participation by state
> agencies and report distribution to those state agencies will be
> decided on an individual basis at the district/regional level by the
> participating federal agencies.

K.  MDPS Examinations

The consolidated report of examination should be sent to the Washington
office of the lead agency and to the board of directors of the data
servicer. The lead agency\'s Washington office is to provide a copy of
the report to the other FFIEC EDP Subcommittee members for distribution
to the respective agency regional/district offices. The agency in charge
is responsible for sending a copy of the report to the appropriate state
supervisory agencies. Excluding the provisions noted above, distribution
of MDPS reports should otherwise be in accordance with the provisions
governing the distribution of joint interagency examinations.