party relationships falls heavily on banks ( particularly small banks ), and sometimes bleeds over to their core service providers, because the core service providers often make the technical changes to core systems to enable integration with innovative new products and services. core service providers are already subject to activities - based supervision under the bank service company act. but with the expansion of third - party relationships, it is worth considering whether this allocation of responsibility remains sound, or whether additional parties — like fintechs and other technology companies — should be subject to closer scrutiny for the products and services they provide to banks. if third parties provide - 12 products and services to bank customers, it also may be appropriate for these providers to bear greater responsibility for their own products and services, including to ensure that they are provided in a safe and sound manner and in compliance with financial and consumer laws and regulations. cybersecurity we do not often talk about cybersecurity in the context of innovation, but improving cybersecurity can complement innovation. when a bank is planning to develop new technology or pursue innovation, those new activities often bring new risks. as you know, bankers often refer to cybersecurity as one of the top risks facing the banking industry, and the federal reserve has issued guidance and examination procedures on a range of cybersecurity issues to help banks prepare for cyber events when they occur. cyber threats constantly evolve, and banks ’ cybersecurity efforts must be dynamic in response. banks must respond to emerging threats by adapting risk - management practices, engaging with regulators and law enforcement when an attack occurs, and participating in training and exercises to ensure cyber preparedness. as i have noted in the past, the federal reserve continues to work closely with banks to support these efforts. 10 other important trends although i won ’ t be able to take questions today, i would like to address a few other issues that may be of interest to this group related to bank regulation and supervision. community reinvestment act reform. as you all know, last may, the federal banking agencies issued a notice of proposed rulemaking that would amend the community see michelle w. bowman, “ welcoming remarks ” ( speech at the midwest cyber workshop, organized by the federal reserve banks of chicago, kansas city, and st. louis, february 15, 2023 ), https : / / www. federalreserve. gov / newsevents / speech / bowman20230215a. htm. - 13 reinves

in helping banks continue to innovate through third - party partnerships. specifically, the agencies have been working to develop joint guidance to clarify regulatory expectations around thirdparty risk management, which will be an important step in supporting innovation built on thirdparty partnerships. this guidance could be particularly helpful for small banks. but clearer guidance and regulatory expectations will not fully address these challenges. guidance alone cannot address the challenges that a small bank faces in conducting due diligence on third parties and the difficulty in negotiating a contract with larger nonbank service providers and partners. icba has taken some important first steps in determining if there are opportunities to fill these knowledge gaps by leveraging collective action to help with due diligence. in addition, some interesting preliminary work has been done to consider whether a standards - setting organization, in the form of a public – private partnership, could expedite due diligence on thirdparty fintech partners. a centralized, standards - setting organization could help develop minimum standards to ensure better consistency in the diligence banks apply to these partnerships. i see a great deal of promise in these efforts, and i support continued work to develop these mechanisms to help small banks innovate through third - party partnerships. another area in need of attention is in assisting small banks achieve similar treatment in their contracts in comparison to larger nonbank service providers and partners. - 11 all banks should understand regulatory expectations with respect to due diligence, risk management, and ongoing compliance when engaging in third - party relationships. banking regulators can support this approach by providing clear expectations and the tools smaller banks may need to help them meet these expectations. for example, in 2021 the federal reserve began providing state member banks with supervisory reports on their third - party partners that are subject to supervision under the bank service company act. these reports contain information that may provide helpful insight in assessing the performance of bank service providers, depending on the services used and the risk the services pose. as we are considering additional opportunities to provide resources in this space, your feedback and experience would be helpful to understand where we should focus our future efforts. bank service company oversight another area that complements third - party risk management is the agencies ’ regulatory authority over bank service companies. while banks who engage in partnerships with third parties continue to bear responsibility for due diligence and compliance, we should also consider whether the bank itself, or the third - party service provider, is best positioned to address risks. the regulatory burden of third -