OCC 2001-47
Subject: Third-Party Relationships
Description: Risk Management Principles
Date: November 1, 2001

TO:  Chief Executive Officers of National Banks, Federal 
     Branches and Agencies, Service Providers, Software 
     Vendors, Department and Division Heads, and 
     Examining Personnel

PURPOSE 

This bulletin provides guidance to national banks on 
managing the risks that may arise from their business 
relationships with third parties.  It supplements, but 
does not replace, previous guidance on third-party risk.  
The principles presented are largely derived and adapted 
from supervisory principles that the OCC or the federal 
banking agencies have already issued. (Additional guidance
on third-party relationships can be found in the documents 
listed in the appendix of this document.) 

A banks use of third parties to achieve its strategic 
goals does not diminish the responsibility of the board 
of directors and management to ensure that the third-party 
activity is conducted in a safe and sound manner and in 
compliance with applicable laws.  Many third-party 
relationships should be subject to the same risk 
management, security, privacy, and other consumer 
protection policies that would be expected if a national 
bank were conducting the activities directly.

The OCC expects the boards of directors and management of 
national banks to properly oversee and manage third-party
relationships.  National banks should adopt a risk 
management process that includes:

-- A risk assessment to identify the banks needs and 
   requirements;
-- Proper due diligence to identify and select a third-
   party provider;
-- Written contracts that outline duties, obligations, 
   and responsibilities of the parties involved; and
-- Ongoing oversight of the third parties and third-party 
   activities.

The risk management principles identified in this 
guidance are intended to be used as tools for banks and 
adapted as necessary to reflect specific circumstances 
and individual risk profiles.  In practice, a banks risk
management system should reflect the complexity of its 
third-party activities and the overall level of risk 
involved.  Each banks risk profile is unique and 
requires a tailored risk mitigation approach appropriate 
for the scale of its particular third-party relationships, 
the materiality of the risks present, and the ability of 
the bank to manage those risks. (National banks that 
provide services to other national banks should expect to 
be held to the same standards of due diligence, controls,
and oversight as they would apply to their servicing 
entities.)

No single system is ideal for every bank.  Large banks 
typically require sophisticated risk management systems 
involving a complex and diverse array of third-party 
products and services.  On the other hand, community banks 
may be able to adopt this guidance in a less formal and 
systematic manner because of the relative simplicity of 
their risk exposures and managements direct knowledge of
the third parties.  The OCC does not view the supervisory
principles in this guidance as all-inclusive, since many 
risk management techniques and controls are evolving 
rapidly to keep pace with new technologies and business 
applications.

BACKGROUND

More and more banks are looking to third-party 
relationships as a way to gain a competitive edge.  The 
OCC recognizes that third-party relationships can offer 
banks a variety of legitimate and safe opportunities to 
improve financial performance.  With the rapid evolution 
of the financial services industry, many national banks 
are utilizing third-party relationships by implementing 
advanced technologies, leveraging expertise, and 
specializing in core competencies.  Through effective use 
of third-party relationships, banks can enhance product 
offerings, diversify assets and revenues, access superior 
expertise and industry best practices, devote scarce 
human resources to core businesses, facilitate operations 
restructuring, and reduce costs.  Third-party 
relationships also enhance opportunities for banks to 
provide particular products or services when banks have 
strategic or operational advantages in producing or 
delivering those products or services.

Banks utilize third parties in three main ways (Third 
parties subject to this guidance may be bank or nonbank, 
regulated or nonregulated, foreign or domestic, affiliated 
or independent.  National banks considering operating 
subsidiaries, financial subsidiaries, and minority 
interests as service providers should refer to OCC 
regulations 12 CFR 5.34, 5.36, and 5.39 regarding the 
permissibility of the activities to be conducted.  Also, 
affiliate relationships are subject to their own rules.  
See sections 23A and 23B of the Federal Reserve Act, 12 
USC 371c and 12 USC 371c(1).):

1.  To perform functions on the banks behalf.  A bank 
    contracts with third-party servicers to perform 
    functions of the banks operations rather than 
    conduct them internally (commonly referred to as 
    "outsourcing").

    This type of third-party relationship covers a wide 
    variety of arrangements, including core information 
    and transaction processing.  Banks also may use third-
    party servicers to provide back-office management and 
    support, such as electronic funds transfer, payroll 
    processing, and mortgage servicing.  More recently, 
    banks are contracting with third-party servicers to 
    provide Internet banking services, bill payment, bill 
    presentment, account aggregation, digital 
    certification, merchant processing activities, and 
    customer call centers.  In addition, some banks have 
    outsourced internal functions such as loan review, 
    asset management, network security management, human 
    resources administration, treasury operations, and 
    internal audit.

2.  To provide products and services that the bank does 
    not originate.  A bank makes available to its 
    customer products and services produced by third 
    parties.

    A bank can expand products and services using third-
    party relationships to remain competitive and meet 
    customer needs.  For example, a national bank may 
    enter into joint marketing relationships in which the
    bank sells to its customers nonbank products (e.g., 
    nondeposit investments or insurance) made available 
    by a brokerage firm or insurance company.  A bank may 
    choose to sell these products as principal or agent 
    directly on its premises or make them available as a 
    finder to its customers over the Internet by means of 
    links on the banks Web site to the Web sites of the 
    third parties.  

3.  To "franchise" the banks attributes.  The bank lends 
    its name or regulated entity status to products and 
    services originated by others or activities 
    predominantly conducted by others.

    Banks authorizing third parties to conduct business 
    in the banks name is potentially the most 
    problematic of the third-party relationships and often 
    warrants significant additional supervisory scrutiny 
    by the OCC.  This third-party activity takes many 
    forms, from complete pass-through type arrangements, 
    in which the bank basically receives a fee in return 
    for the use of its name, to more participatory 
    arrangements on the banks part.  

    The risks to the bank from these franchising 
    arrangements vary based on the terms of the agreement 
    between the bank and third party and the nature of 
    the products offered.  In all of these relationships 
    with third parties, however, the bank must conduct 
    adequate due diligence of all third parties and 
    understand the market, customer base, products offered, 
    and attendant risks prior to entering into 
    contractual relationships.  Franchising activities 
    often involve significant reputation, strategic, 
    transaction, and compliance risk to the bank.

    National banks should be especially mindful of any 
    third party seeking to avail itself of the benefits 
    of a national bank charter, particularly with respect 
    to the application of state and local law.  In some 
    instances, nonbank vendors may target national banks 
    to act as delivery vehicles for certain products and 
    services, or to act as the nominal deliverer of 
    products or services actually provided by the third 
    party, in order to avoid state law standards that 
    would otherwise apply to their activities.  Further, 
    some product vendors engage in practices that may be 
    considered predatory, abusive, or unfair and 
    deceptive to consumers under OCC guidelines.

    Whenever a bank permits itself to be used as a 
    delivery vehicle for products or services that are 
    offered under the banks name, but provided by an 
    unrelated third party, it can be exposed to 
    substantial financial loss and damage to its 
    reputation if it fails to maintain adequate quality 
    control over those products and services and adequate 
    oversight over the third-party activities.  National 
    banks that participate in this kind of program with 
    nonbank vendors or marketers should take special care 
    to avoid violating fair lending and consumer 
    protection laws and regulations, particularly when 
    the actual involvement of the bank and the third party 
    may be invisible to the customer.  National banks 
    should be extremely cautious before entering into any 
    third-party relationship in which the third party 
    offers products or services through the bank with 
    fees, interest rates, or other terms that cannot be 
    offered by the third party directly.  Such arrangements 
    may constitute an abuse of the national bank charter.

    The OCC will scrutinize carefully any such arrangement 
    and may use its supervisory authority to examine the 
    operations of third parties who act as service 
    providers to national banks which are sought out to 
    deliver potentially abusive, predatory, or unfair and 
    deceptive products.  Accordingly, the OCC will likely 
    conduct regular examinations of both the bank and the 
    third party to assess the risks associated with these 
    activities.

RISKS ASSOCIATED WITH THIRD-PARTY RELATIONSHIPS

Reliance on third-party relationships can significantly 
increase a banks risk profile, notably strategic, 
reputation, compliance, and transaction risks.  Increased 
risk most often arises from poor planning, oversight, and 
control on the part of the bank and inferior performance 
or service on the part of the third party, and may result 
in legal costs or loss of business.  To control these 
risks, management and the board must exercise appropriate 
due diligence prior to entering the third-party 
relationship and effective oversight and controls 
afterward.

STRATEGIC RISK.  Strategic risk is the risk to earnings or 
capital arising from adverse business decisions or 
improper implementation of those decisions.  National 
banks are individually exposed to strategic risk if they 
use third parties to conduct banking functions or offer 
products and services that are not compatible with the 
banks strategic goals or that do not provide an adequate 
return on investment.  Strategic risk exists in banks 
that, in an effort to remain competitive or boost earnings, 
use third-party relationships without fully performing 
due diligence reviews or implementing the appropriate 
risk management infrastructure to oversee the activity.  
Strategic risk also arises if management does not possess 
adequate expertise and experience to properly oversee the 
activities of the third party.  The board and management 
should fully understand the key risks associated with the 
use of third-party relationships.

REPUTATION RISK.  Reputation risk is the risk to earnings 
or capital arising from negative public opinion.  Third-
party relationships that do not meet the expectations of 
the banks customers expose the bank to reputation risk.  
Poor service, disruption of service, inappropriate sales 
recommendations, and violations of consumer law can 
result in litigation, loss of business to the bank, or 
both.  In particular, when the third partys employees 
interact directly with bank customers (in joint marketing 
arrangements or from call centers, for example), such 
arrangements pose reputation risk if the interaction is 
not consistent with the banks policies and standards.  
Also, publicity about adverse events surrounding the 
third parties may increase the banks reputation risk.  
Banks that use third-party relationships to offer new 
products or services or expand existing ones should 
closely monitor the quality and appropriateness of the 
providers products and services to ensure ongoing 
customer satisfaction.

COMPLIANCE RISK.  Compliance risk is the risk to earnings
or capital arising from violations of laws, rules, or 
regulations, or from nonconformance with internal 
policies and procedures or ethical standards.  This risk 
exists when products, services, or systems associated 
with the third-party relationship are not properly 
reviewed for compliance, or when the third partys 
operations are not consistent with law, ethical standards, 
or the banks policies and procedures.  The potential for 
serious or frequent violations or noncompliance exists 
when a banks oversight program does not include 
appropriate audit and control features, particularly when 
the third party is implementing new bank activities or 
expanding existing ones.  Compliance risk increases when 
privacy of consumer and customer records is not 
adequately protected, when conflicts of interest between 
a bank and affiliated third parties are not appropriately 
managed, and when a bank or its service providers have not 
implemented an appropriate information security program.  
Banks should involve their compliance management function 
in the due diligence and monitoring process when third-
party products or services present significant risk to 
regulatory compliance.

TRANSACTION RISK.  Transaction risk is the risk to 
earnings or capital arising from problems with service or 
product delivery.  Transaction risk is evident in each 
product or service offered by the third party.  
Transaction risk can increase when the products, services, 
delivery channels, and processes that are designed or 
offered by a third party do not fit with the banks 
systems, customer demands, or strategic objectives.  A 
third partys inability to deliver products and services, 
whether arising from fraud, error, inadequate capacity, 
or technology failure, exposes the bank to transaction 
risk.  Lack of effective business resumption and 
contingency planning for such situations also increases 
the banks transaction risk.  

CREDIT RISK.  Credit risk is the risk to earnings or 
capital arising from an obligors failure to meet the 
terms of any contract with the bank or otherwise to 
perform as agreed.  Credit risk may arise under many 
third-party scenarios.  Third parties that market or 
originate certain types of loans subject the bank to 
increased credit risk if bank management does not 
exercise effective due diligence over, and monitoring of, 
the third party.  Third-party arrangements can have 
substantial effects on the quality of receivables and 
other credit performance indicators when the third party 
conducts account management, customer service, or 
collection activities.  Improper oversight of third 
parties who solicit and refer customers (e.g., brokers, 
dealers, merchant processing ISOs, and credit card 
marketers), conduct underwriting analysis (credit card 
processing and loan processing arrangements), or set up 
product programs (overdraft protection, payday lending, 
and title lending) can also result in substantial credit 
risk.  The credit risk for some of these third-party 
programs may be shifted back to the bank if the third 
party does not fulfill its responsibilities or have the 
financial capacity to fulfill its obligations.  In those 
situations, it will be important for bank management to 
assess the financial strength of the third party at the 
outset of the relationship and periodically thereafter 
and to have a contingency plan in the event the third 
party is unable to perform.

OTHER RISKS.  Depending on the circumstances, third-party 
relationships may also subject the bank to liquidity, 
interest rate, price, and foreign currency translation 
risk.  In addition, a bank may be exposed to country risk 
when dealing with a foreign-based service provider.  
Country risk is the risk that economic, social, and 
political conditions and events in a foreign country will 
adversely affect the banks financial interests.

OCC SUPERVISORY APPROACH

Supervision by Risk

The OCC expects bank management to engage in a rigorous 
analytical process to identify, measure, monitor, and 
establish controls to manage the risks associated with 
third-party relationships and, as with all other risks, 
to avoid excessive risk-taking that may threaten the 
safety and soundness of a national bank.  Because third-
party relationships are important in assessing a banks 
overall risk profile, the OCCs primary supervisory 
concern in reviewing a banks relationships with third 
parties is whether the bank is assuming more risk than it 
can identify, monitor, manage, and control.  

Examiners will review the risks associated with all 
material third-party relationships and activities 
together with other bank risks using the supervision-by-
risk framework.  They will review the effectiveness of 
the banks oversight program, including its strategic 
planning, third-party selection process, and ongoing 
monitoring.

In addition, the OCC will review the banks information 
security and privacy protection programs regardless of 
whether the activity is conducted directly by the bank or 
by a third party.

Bank Service Company Act

The OCC treats as subject to the Bank Service Company Act, 
12 USC 1867(c), situations in which a bank arranges, by 
contract or otherwise, for the performance of any 
applicable functions of its internal operations.  
Therefore, the OCC generally has the authority to 
examine and to regulate the functions or operations 
performed or provided by third-party servicers to the 
same extent as if they were performed by the bank itself 
on its own premises.  (If the third party is a 
functionally regulated entity (FRE), the Gramm-Leach-
Bliley Act of 1999 limits the OCC's ability to examine 
and require reports from it.  However, in these situations, 
the OCC still regulates how the bank oversees and manages 
the risk posed by the FRE.)  Such examinations may 
evaluate safety and soundness risks, the financial and 
operational viability of the servicer to fulfill its 
contractual obligations, compliance with applicable 
consumer protection, fair lending, and anti-money-
laundering laws, and whether the third party engages in 
unfair or deceptive acts or practices in violation of 
federal or applicable state law.  In addition, the OCC 
will pursue appropriate corrective measures, including 
enforcement actions, to address violations of law and 
regulations or unsafe or unsound banking practices by the 
national bank or its third party.

The OCC will use its supervisory authority to examine the 
operations of service providers who seek out national 
banks to deliver potentially abusive, unfair and 
deceptive, or predatory products.

The OCC has the authority to assess a national bank a 
special examination or investigation fee when the OCC 
examines or investigates the activities of a third party 
that provides services to the bank.  The OCC will conduct 
such special examinations or investigations if the 
activities conducted by the service provider for the bank 
present heightened risks or are of an unusual nature, or 
if the banks risk management system is insufficient. 
(OCC 2001-28, "Assessment of Fees; Special Examination of 
Third Party Service Providers" (June 22, 2001).  The 
factors the OCC will consider in determining whether to 
impose a fee for the examination of a bank's third-party 
service providers are (1) the high risk or unusual nature 
of the activities conducted by the service provider for 
the bank; (2) the significance to the bank's operations 
and income of the activities conducted by the service 
provider for the bank; and (3) the extent to which the 
bank has sufficient systems, controls, and personnel to 
adequately monitor, measure, and control risks arising 
from activities conducted by the service provider for the 
bank.)

Notwithstanding the OCCs authority to examine the 
performance of services by service providers directly, 
the OCC emphasizes that the board and management of 
national banks are responsible for adequately managing 
third-party relationships and identifying and controlling 
the risks that can arise from them.

RISK MANAGEMENT PROCESS

Managing the risks of third-party relationships is 
fundamental.  Reliance on third parties to perform 
banking functions, to provide products or services to 
bank customers, or to provide products or services under 
the banks name decreases managements direct control, 
and therefore requires managements intensified oversight 
efforts.  Banks should rigorously analyze and manage the 
risks posed by material third-party relationships.  Doing 
so involves understanding the risks associated with the 
activity, conducting thorough due diligence of the 
proposed third party, implementing an ongoing oversight 
program of the third party that includes performance 
monitoring, and developing a contingency plan in the event 
the third party cannot perform as expected.

The following risk management principles are essential 
components of well-structured risk management processes.  
While the principles apply to all third-party activities, 
not all of the specific elements presented may be 
necessary for a bank to achieve the desired goal of 
effective oversight, depending on the scale of the 
activity and the risks presented.

Risk Assessment and Strategic Planning

Integration with overall strategic objectives.--  When 
considering whether to enter into a third-party 
relationship, the board and management should identify 
the role of the relationship given the banks overall 
business strategy and objectives and should ensure that 
third-party activities are clearly integrated with 
corporate strategic goals.  At the outset, banks should 
identify the strategic purposes, benefits, legal aspects, 
costs, and risks associated with the third-party activity, 
including reputational risks if the standards associated 
with the activity or product differ from those 
customarily employed by the bank.  Management should 
develop a complete and realistic understanding of what 
the relationship can do for the bank.  This analysis 
requires a thorough corporate self-assessment of core 
competencies, managerial strengths and weaknesses, and 
the banks overall values and goals.  This assessment, 
which should be performed at the highest levels of 
management, is integral to the banks strategic planning.

The risk assessment phase should include the 
identification of performance criteria, internal controls, 
reporting needs, and contractual requirements.  Internal 
auditors, compliance officers, and legal counsel could 
help to analyze the risks associated with the third-
party relationship and to establish the necessary control 
and reporting structures.  Banks should also consider how 
best to ensure that third parties meet information 
security and customer privacy requirements.  Based on 
this strategic planning and risk assessment, objectives 
should be set and specific third-party activities 
evaluated.  Banks may also develop an appropriate exit 
strategy and contingency plan should the need to 
terminate the third-party relationship arise.

Expertise to oversee and manage the activity.-- Management 
should assess internal expertise to evaluate and manage 
the activity and the third-party relationship.  It is 
crucial that banks have the requisite expertise to 
understand and oversee the risks presented by the third-
party relationship.  Responsibilities for managing third-
party relationships should be clearly assigned. The bank 
must be able to devote the resources necessary to monitor 
and measure performance under the terms of the third-party 
agreement.  Management may consider appointing a senior 
officer to sponsor the third-party relationship.  The 
sponsor would be responsible for the due diligence, 
implementation, management, and monitoring of the 
arrangement, including periodic reports to the board.  
The sponsor should have sufficient knowledge and skills 
to critically evaluate the design, operation, and 
oversight of the third-party relationship.

Cost/benefit relationship.--  Banks should be careful to 
measure long-term stability and viability against 
potential short-term profits or cost savings.  While 
third-party relationships can be an effective means of 
reducing operating costs or boosting fee income, these 
goals should always be balanced with due diligence and 
adequate oversight.  The financial risks posed by an 
ineffective selection process and inadequate oversight 
are potentially much larger than any short-term profits 
and operational cost savings achieved.  Without adequate 
up-front strategic review and ongoing performance-to-plan 
assessments, banks are at risk of underestimating the 
cost and of overestimating the benefits of third-party 
relationships.

Customer expectations. -- The board and management should 
also consider how they will manage customer expectations 
and understandings with respect to joint marketing and 
franchising activities.  Whenever a bank provides its 
customers with access to products and services not 
originated by the bank, it must recognize that a wide 
range of customer relationship issues will inevitably 
arise.  The banks reputation rests upon its ability to 
develop standards that meet customer expectations 
regarding the quality of products and services that are 
provided through the bank, regardless of whether the 
product or service is originated by the bank.

Selecting a Third Party and Due Diligence

Regardless of the type of third-party relationship, 
selecting a competent and qualified third-party provider 
is essential to managing third-party risk.  The due 
diligence process provides the bank with an opportunity 
to identify qualitative and quantitative aspects, both 
financial and operational, of a third party and to assess 
whether the third party can help the bank achieve its 
strategic goals.  Banks should conduct appropriate due 
diligence before selecting a third party and at 
appropriate intervals thereafter. 

Due diligence should involve a thorough evaluation of all 
available information about the third party, and may 
include:

-- Experience in implementing and supporting the proposed 
   activity, possibly to include requiring a written 
   proposal;

-- Audited financial statements of the third party and its 
   significant principals (the analysis should normally 
   be as comprehensive as the bank would undertake if 
   extending credit to the party);

-- Business reputation, complaints, and litigation (by 
   checking references, the Better Business Bureau, state 
   attorneys general offices, state consumers affairs 
   offices, and, when appropriate, audit reports and 
   regulatory reports);

-- Qualifications, backgrounds, and reputations of 
   company principals, to include criminal background 
   checks, when appropriate;

-- Internal controls environment and audit coverage;

-- Adequacy of management information systems;

-- Business resumption, continuity, recovery, and 
   contingency plans;

-- Technology recovery testing efforts;

-- Cost of development, implementation, and support;

-- Reliance on and success in dealing with sub-
   contractors (the bank may need to consider 
   whether to conduct similar due-diligence 
   activities for material subcontractors);

-- Insurance coverage.

Other important elements of due diligence include probing 
for information on intangibles, such as the third partys 
business strategies and goals, human resources policies, 
service philosophies, quality initiatives, and policies 
for managing costs and improving efficiency.  The third 
partys culture, values, and business styles should fit 
the banks.  

The due diligence process that a bank uses to select a 
third party will depend on the complexity of the service 
to be performed.  How formal the process is may depend on 
the nature of the service and the banks familiarity with 
the prospective providers.  When selecting third parties, 
banks may find expert consultants helpful. 

Contract Issues

The board and management should ensure that the 
expectations and obligations of each party are clearly 
defined, understood, and enforceable.  The following 
topics should normally be considered when entering into a
binding contract or agreement (some points may not apply 
in every circumstance). (The OCC recognizes that some 
existing contracts may not establish clear and specific 
responsibilities and obligations of both parties.  In 
this situation, the OCC recommends that banks renegotiate 
the contracts at the earliest opportunity to address 
pertinent risk controls and legal protections.)

Scope of arrangement. -- The contract should specify the 
scope of the relationship.  For example, outsourcing 
contracts should specifically identify the frequency, 
content, and format of the service or product to be 
provided.  The contract should also include, as 
applicable, such services to be performed by the service 
provider as software support and maintenance, training of 
employees, and customer service.  Contracts should detail 
which activities the third party is permitted to conduct,
whether on or off the banks premises, and should 
describe the terms governing the use of the banks space, 
personnel, and equipment.  When dual employees are used, 
their duties and responsibilities should be clearly 
articulated.  The agreement should also indicate whether 
the service provider is prohibited from assigning any 
portions of the contract to subcontractors or other 
entities.

Performance measures or benchmarks. -- When clearly 
specified, performance measures define the expectations 
and responsibilities for both parties.  This understanding 
is the basis for monitoring ongoing performance and 
measuring the success of the arrangement.  Such measures 
can also be used to motivate third-party performance, 
especially if poor performance is penalized or outstanding 
performance rewarded.  Industry standards for service-
level agreements may provide a reference point for 
commodity-like services, such as payroll processing.  
For more customized services, there may be no standard 
measures.  Instead, the bank and service provider should 
agree upon a range of measures.

Responsibilities for providing and receiving information.
-- Management information reports received from the third 
party should be timely, accurate, and comprehensive 
enough to allow the bank to adequately assess performance, 
service levels, and risks.  The contract should discuss 
the frequency and type of reports received (e.g., 
performance reports, control audits, financial statements, 
security reports, and business resumption testing reports).  
The bank should consider materiality thresholds and 
procedures to be used to notify the bank when service 
disruptions, security breaches, and other events pose a 
material risk to the bank.  Banks should consider 
requiring the third party to notify them in the event of 
financial difficulty, catastrophic events, material change 
in strategic goals, and significant staffing changes, all 
of which might result in a serious impact to service.

The right to audit. -- Banks should make certain that they 
have the right to audit third parties (and their 
subcontractors) as needed to monitor performance under 
the contract.  Generally, in an outsourcing contract, 
banks should ensure that periodic independent internal 
and/or external audits are conducted at intervals and 
scopes consistent with in-house functions.  Banks should 
generally include in the contract the types and frequency 
of audit reports the bank is entitled to receive from the 
service provider (e.g., financial, internal control, and 
security reviews).  The bank may reserve the right to 
conduct its own audits of the function, or it may engage 
an independent auditor.  The bank should consider whether
to accept independent internal audits conducted by the 
third-party providers audit staff or external audits and 
reviews (e.g., SAS 70 reviews). (AICPA Statement of 
Auditing Standards 70, "Reports of Processing of 
Transactions by Service Organizations," known as SAS 70 
Reports, are one form of external review.  Type II SAS 70 
reports review the service provider's policies and 
procedures and provide tests of actual controls against 
policies and procedures.) In any event, audit 
reports should include a review of the third partys 
internal control environment as it relates to the service 
or product being provided to the bank.  Reports should 
also include a review of the third partys security 
program and business continuity program. 

Cost and compensation. -- For both the bank and the third 
party, the contract should fully describe compensation, 
fees, and calculations for base services, as well as any 
charges based upon volume of activity and fees for 
special requests.  It should indicate which party is 
responsible for payment of legal, audit, and examination 
fees associated with the activity.  Cost and 
responsibility for purchasing and maintaining hardware 
and software may also need to be addressed.  Any 
conditions under which the cost structure may be changed 
should be addressed in detail, including any limits on any 
cost increases.

Ownership and license. -- The contract should state 
whether and how the third party has the right to use the 
banks data, hardware and software, system documentation, 
and intellectual property, such as the banks name, logo, 
trademark, and copyrighted material.  It should indicate 
whether any records generated by the third party are the 
property of the bank.  If the bank purchases software, 
management should also consider establishing escrow 
agreements to provide for the banks access to source 
code and programs under certain conditions (e.g., 
insolvency of the vendor), documentation of programming 
and systems, and verification of updated source code.

Confidentiality and security. -- Service providers must 
do all they can to keep information confidential and 
secure.  The agreement should prohibit the third party 
and its agents from using or disclosing the banks 
information, except as necessary to provide the 
contracted services.  If the third party receives 
nonpublic personal information regarding the banks 
customers, the bank should notify the third party to 
assess the applicability of the privacy regulations, and 
the third party must implement appropriate security 
measures designed to meet the objectives of regulatory 
guidelines with which the bank must comply.  Banks should 
require the third party to fully disclose breaches in 
security resulting in unauthorized intrusions that may 
materially affect the bank or its customers.  The third 
party should report to the bank when material intrusions 
occur, should estimate the intrusions effect on the bank, 
and should specify the corrective action taken.  
Arrangements should address the powers of each party to 
change security procedures and requirements, and should 
resolve any confidentiality/security issues arising out 
of shared use of facilities owned by a third party.

Business resumption and contingency plans. -- The contract 
should provide for continuation of the business function 
in the event of problems affecting the third partys 
operations, including system breakdown and natural (or 
man-made) disaster.  The contract should address the 
third partys responsibility for backing up and otherwise 
protecting program and data files, for protecting 
equipment, and for maintaining disaster recovery and 
contingency plans.  
Responsibilities should include testing of the plans and 
providing results to the bank.  The bank also should 
consider requiring the third party to provide the bank 
with operating procedures that are to be carried out in 
the event business resumption contingency plans are 
implemented.  Contracts should include specific time 
frames for business resumption and recovery that meet the 
banks business requirements.  Further, the banks own 
contingency plan should address potential financial 
problems or insolvency of the third party.

Indemnification. -- Indemnification provisions would 
require the bank to hold the third party harmless from 
liability for the negligence of the bank, and vice versa.  
These provisions should be reviewed to reduce the 
likelihood that the bank will be held liable for claims 
citing failure of the third party.

Insurance. -- The third party should maintain adequate 
insurance and should notify the bank of material changes 
to coverage.

Dispute resolution. -- The bank should consider whether 
the contract should establish a dispute resolution 
process (arbitration, mediation, or other means) for the 
purpose of resolving problems between the bank and the 
third party in an expeditious manner, and whether it 
should provide that the third party continue to perform 
during the dispute resolution period.  

Limits on liability. -- Some standard contracts with 
service providers may limit the third partys liability.  
If the bank is considering such a contract, management 
should determine whether the proposed limit is in proper 
proportion to the amount of loss the bank might experience 
as a result of the third partys failure to perform.

Default and termination. -- There can be significant risks 
associated with contract default and/or termination.  
Therefore, the contract should stipulate what constitutes 
default, it should identify remedies, and it should allow 
for opportunities to cure defaults.  The extent and 
flexibility of termination rights sought vary with the 
type of service.  Termination rights may be sought for a 
variety of eventualities, including change in control, 
merger or acquisition, convenience, substantial increase 
in cost, repeated failure to meet service standards, 
failure to provide critical services and required notices, 
failure to prevent violations of law or unfair and 
deceptive practices, bankruptcy, company closure, and 
insolvency.  In addition, the contract should include 
a provision that enables the bank to terminate the 
contract, upon reasonable notice and without penalty, in 
the event that the OCC formally objects to the particular 
third-party arrangement.  Management should consider 
whether the contract permits the bank to terminate the 
relationship in a timely manner without prohibitive 
expense.  The contract should state termination and 
notification requirements with time frames to allow for 
the orderly conversion to another third party.  The 
contract should provide for the timely return of the 
banks data and other bank resources.  Any costs and 
servicers obligations associated with transition 
assistance should be clearly stated.

Customer Complaints. -- The third party should forward to 
the bank any complaints it receives from the banks 
customers.  The contract should specify whether the bank 
or third party is responsible for responding to the 
complaints.  If the third party responds, a copy of the 
response should be forwarded to the bank.

Foreign-based service providers. -- Banks entering into 
contracts with foreign-based service providers should 
carefully consider including in those contracts choice-of-
law covenants and jurisdictional covenants that provide 
for adjudication of all disputes between the parties 
under the laws of a single, specific jurisdiction.  Such 
contracts and covenants, however, may be subject to the 
interpretation of foreign courts relying on local laws.  
These local laws may substantially differ from U.S. laws 
in how they apply and enforce choice of law covenants, 
what they require of banks, and how they protect bank 
customers.  Therefore, a bank should seek legal advice 
regarding the enforceability of all aspects of a proposed 
contract with a foreign-based service provider and the 
other legal ramifications of each such arrangement.

OCC Supervision. -- As discussed earlier, the performance 
of services by external parties for the bank is subject 
to OCC examination oversight.  This fact should be 
included in all contracts when services are performed for 
the bank. 

Oversight of Third-Party Relationships

After entering into a contract or agreement with a third 
party, management should monitor the third party with 
respect to its activities and performance.  Management 
should dedicate sufficient staff with the necessary 
expertise to oversee the third party.  While the extent 
of a banks oversight activities will vary depending on 
the nature of the activity, the oversight program should 
monitor the third partys financial condition, its 
controls, and the quality of its service and support.  
Performance monitoring may include, as appropriate, the 
following:

Monitor Financial Condition

-- Evaluate the third partys financial condition at 
   least annually, and more frequently when risk is high 
   or moderate and increasing.  This analysis should be 
   as comprehensive as the ongoing credit analysis the 
   bank would conduct of its borrowers.  Audited 
   financial statements should be required for significant 
   relationships with third parties.

-- If applicable, ensure that the third partys financial 
   obligations to subcontractors are being met in a timely 
   manner.

-- Review the adequacy of the third partys insurance 
   coverage.

-- Compare actual earnings/costs with projections. 

Monitor Controls

-- Review audit reports (e.g., internal audits, external 
   audits, SAS 70 reviews, security reviews), as well as 
   examination reports, if available. (Some services 
   provided to national banks by service providers are 
   examined by the FFIEC member agencies.  Regulatory 
   examination reports, which are only available to 
   client financial institutions of the service provider, 
   may contain information regarding a service provider's 
   operations.  However, regulatory reports are not a 
   substitute for a bank's due diligence, audit, or 
   oversight of the service provider.)  Follow up on any 
   deficiencies noted.

-- Review the third partys policies relating to internal 
   controls and security to ensure that they continue to 
   meet the banks minimum guidelines and contract 
   requirements.

-- Perform on-site quality assurance reviews, targeting 
   adherence to specified policies and procedures, where 
   practicable and necessary.

-- Sponsor coordinated audits and reviews with user 
   groups, as applicable.

-- Review compliance with the Bank Secrecy Act, fair 
   lending, and other consumer protection laws and 
   regulations, as applicable.

-- Review the third partys business resumption 
   contingency planning and testing to ensure that all 
   bank services can be restored within an acceptable 
   time.  For many critical services, annual or more 
   frequent tests of the contingency plan are typical.  
   Review any results of those tests and ensure that 
   recovery times meet bank requirements.

-- Monitor changes in key third-party personnel allocated 
   to the bank.

Assess Quality of Service and Support

-- Regularly review reports documenting the third partys 
   performance relative to service level agreements.  
   Determine whether contractual terms and conditions are 
   being met, and whether any revisions to service-level 
   agreements or other terms are needed.

-- Document and follow up on performance problems in a 
   timely manner.

-- Evaluate the third partys ongoing ability to support 
   and enhance the banks strategic plan and goals.

-- Determine the adequacy of training provided to bank 
   employees.

-- Review customer complaints on the products and services 
   provided by the third party and the resolution of 
   these complaints.

-- Administer mystery shopper, customer call-back, or 
   customer satisfaction programs.

-- Periodically meet with contract parties to discuss 
   performance and operational issues.

-- Maintain documents and records regarding contract 
   compliance, revision, and dispute resolution.

Documentation

If a bank is to manage third-party relationships 
successfully, it must properly document its oversight 
program.  Proper documentation will facilitate the 
monitoring and management of the risks associated with 
third-party relationships.  Proper documentation 
typically includes:

-- A list of significant vendors or other third parties, 
   i.e., those for which management spends substantial 
   amounts of money, or those deemed critical to the 
   operation (Under 12 USC 1867(c)(2), national banks are
   required to notify the OCC of the existence of a 
   servicing relationship within 30 days after the making
   of a contract or the performance of the services, 
   whichever occurs first.);

-- Valid, current, and complete contracts; 

-- Business plans for new lines of business or products 
   that identify managements planning process, decision 
   making, and due diligence in selecting a third party;

-- Regular risk management and performance reports 
   received from the third party (for example, audit 
   reports, security reviews, reports indicating 
   compliance with service-level agreements); and

-- Regular reports to the board, or delegated committee, 
   of the results of the ongoing oversight activities.

CONCLUSION

The OCC supports and encourages national banks use of 
third parties to take advantage of the many legitimate 
and safe opportunities to enhance product offerings, 
improve earnings, and diversify assets and revenues.  To 
maximize benefits from third-party relationships, banks 
should have an effective process for managing the 
associated risks.  The value a bank will derive from its 
use of third-party business relationships is directly 
proportional to the quality of managements strategic 
planning, due diligence and ongoing oversight activities, 
and sensitivity to customer expectations and 
understandings with regard to the services and products 
offered by the third parties.

Questions regarding this bulletin should be addressed to 
Core Policy Development at (202) 874-5190.

Emory W. Rushton
Chief National Bank Examiner

REFERENCES

More guidance about third-party relationships can be 
found in the following documents. 

 Issuance   Date    Subject          Applicability
OCC2001-31 7/3/01 Weblinking      Highlights the risks
                                  and provides risk
                                  management guidance
                                  concerning banks    
                                  weblinking relationships   
                                  with third parties.   
                                                                          
OCC2001-28 6/22/01 Assessment     Describes the factors
                    of Fees       the OCC the OCC will 
                                  consider in determining    
                                  whether imposition of a  
                                  fee for the examination    
                                  of a third-party     
                                  servicer is warranted.                                     
                                      
OCC2001-12 8/28/01 Bank Provided  Includes guidance for 
                   Account        banks that offer 
                   Aggregation    aggregation services 
                   Services       through third-party 
                                  service providers.
                     
 AL2001-8  2/15/01 Guidelines     Alerts banks that
                   Establishing   oversight program of
                   Standards for  service providers
                   Safeguarding   should include
                   Customer       confirmation that the
                   Information    providers have
                                  implemented appropriate
                                  measures designed to
                                  meet the objectives of 
                                  the guidelines.
           
 AL2001-5  5/11/01 Interagency    Includes guidance that 
                   Advisory on    banks should implement 
                   Brokered and   adequate due diligence 
                   Rate-Sensitive procedures before 
                   Deposits       entering any business 
                                  relationship with a 
                                  deposit broker.
                                       
 AL2001-4  4/24/01 Network        Alerts banks to review 
                   Securities     contracts with service 
                   Vulnerabilities providers to ensure 
                                  that security 
                                  maintenance and 
                                  reporting 
                                  responsibilities 
                                  are clearly described.
                     
AL 2001-2 1/22/01 Privacy         Includes guidance for 
                  Preparedness    banks to evaluate 
                                  agreements with 
                                  nonaffiliated third 
                                  parties that involve 
                                  the disclosure of 
                                  consumer information. 
                  

Comptrollers 1/01The Internet    Includes guidance on 
Corporate         and the         the use of vendors/
Manual            National Bank   outsourcing.
                  Charter
                         
Comptrollers12/00Asset           Includes guidance on 
Handbook          Management      vendor management.
                
AL2000-12 11/28/00Interagency     Transmits detailed 
                  Guidance on     guidance on risk 
                  Risk Management mitigation practices 
                  of Outsourcing  when outsourcing 
                  Technology      technology services, 
                  Services        including information 
                                  and transaction 
                                  processing and internet
                                  banking activities.
                  
AL2000-11 11/27/00 Title Loan     Alerts national banks 
                   Programs       to OCC concerns over 
                                  title loan programs, 
                                  including the 
                                  involvement of third-
                                  party vendors.
                   
AL2000-10 11/27/00 Payday Lending Alerts national banks 
                                  to OCC concerns over 
                                  payday lending programs, 
                                  including the 
                                  involvement of third-
                                  party vendors.

OCC2000-25 9/8/00  Privacy Laws   Includes guidance for 
                   and            banks to evaluate 
                   Regulations    agreements with third 
                                  parties that involved 
                                  the disclosure of 
                                  consumer information. 
 
AL2000-9 8/29/00   Third-Party    Alerts national banks 
                   Risk           to potential credit 
                                  risks arising from 
                                  arrangements with third 
                                  parties.

Comptrollers 7/00 Internal and   Provides guidelines for
Handbook           External       banks that outsource 
                   Audits         internal audit.     
                                  
OCC2000-14 5/15/00 Infrastructure Provides guidance on 
                   Threats --     how to prevent, detect,
                   Intrusion      and respond to 
                   Risks          intrusions into bank 
                                  computer systems, 
                                  including outsourced 
                                  systems.
                                      
Comptrollers10/99 Internet       Includes a discussion 
Handbook           Banking        of the pros and cons of
                                  conducting internet 
                                  activities in-house or 
                                  of outsourcing them.  
                                  Examination procedures 
                                  include a section on 
                                  vendor management.      

AL 99-6     5/4/99 Guidance to    Provides guidance on 
                   National Banks privacy policies 
                   Privacy on     regarding customers who
                   Website        access bank Internet 
                   Statements     sites.       
               
OCC 99-9   3/5/99 Infrastructure  Identifies the threats 
                  Threats from    and vulnerabilities 
                  Cyber-          created by cyber-
                  Terrorists      terrorism.
                                  
               
OCC 98-38 8/24/98 PC Banking      Includes information on
                                  risk controls for banks 
                                  that rely on service 
                                  providers and software 
                                  vendors for PC banking.

OCC 98-31 7/30/98 FFIEC Guidance  Provides guidance on 
                  on Electronic   federal consumer 
                  Financial       protection laws as they
                  Services and    apply to electronic 
                  Consumer        financial services and 
                  Compliance      operations. 
                     
OCC 98-3 3/17/98  Technology Risk Includes a short 
                  Management      description of a banks
                                  responsibility with 
                                  regard to outsourcing 
                                  its technology products
                                  and services.
                 
OCC 98-1 1/7/98   Interagency     Includes specific 
                 Policy Statement guidance on the use of 
                  on Internal     outsourcing the 
                  Audit and       internal audit function.
                  Internal Audit  (Note:  A revision is 
                  Outsourcing     pending.)
                 
OCC 97-23 5/16/97 Interagency     Alerts national banks 
                  Statement on    to assess the business 
                  Corporate       resumption and 
                  Business        contingency planning of
                  Resumption and  service providers.
                  Contingency 
                  Planning 
                  
AL 96-8 10/6/96   Insurance and   Includes guidance on 
                  Annuity Sales   third-party arrangements 
                  Activities      involving bank sales of  
                                  insurance products and 
                                  annuities. 
                  
FFIEC       9/96  Information     Provides guidance for 
Information       Systems         regulatory examiners in
Systems 1996      Operations      the examination of 
Examination                       information systems 
Handbook                          operations in financial
                                  institutions and 
                                  independent service 
                                  bureaus.  It also 
                                  includes an overview of 
                                  information systems 
                                  concepts and practices, 
                                  examples of sound 
                                  information systems 
                                  controls, and FFIEC 
                                  examination work 
                                  programs. 

OCC 94-13 2/24/94 Nondeposit      Includes a section on 
                  Investment      board oversight of third-
                  Sales           party vendors.                                                         
                  Examination 
                  Procedures 
                  (temporary 
                  insert - 
                  Comptrollers 
                  Handbook)

BC 260    7/14/92 Interagency     Alerts banks to risks 
                  Statement on    involved in outsourcing 
                  EDP Service     information technology 
                  Contracts       services.
                   
BC 187    1/18/85 Financial       Alerts national banks to 
                  Information on  the importance of 
                  Data Processing performing financial 
                  Servicers       reviews of organizations
                                  providing data
                                  processing services.

BC 181    8/2/84  Purchases Of    Describes prudent 
                  Loans In Whole  purchases of loans and
                  Or In Part -    loan participations.
                  Participations