GUIDANCE FOR MANAGING THIRD-PARTY RISK Introduction An institution’s board of directors and senior management are ultimately responsible for managing activities conducted through third-party relationships, and identifying and controlling the risks arising from such relationships, to the same extent as if the activity were handled within the institution. This guidance includes a description of potential risks arising from third-party relationships, and provides information on identifying and managing risks associated with financial institutions’ business relationships with third parties.1 This guidance applies to any of an institution’s third-party arrangements, and is intended to be used as a resource for implementing a third-party risk management program. This guidance provides a general framework that boards of directors and senior management may use to provide appropriate oversight and risk management of significant third-party relationships. A third-party relationship should be considered significant if the institution’s relationship with the third party is a new relationship or involves implementing new bank activities; the relationship has a material effect on the institution’s revenues or expenses; the third party performs critical functions; the third party stores, accesses, transmits, or performs transactions on sensitive customer information; the third party markets bank products or services; the third party provides a product or performs a service involving subprime lending or card payment transactions; or the third party poses risks that could significantly affect earnings or capital. The FDIC reviews a financial institution’s risk management program and the overall effect of its third-party relationships as a component of its normal examination process. As noted, the FDIC evaluates activities conducted through third-party relationships as though the activities were performed by the institution itself. In that regard, it must be noted that while an institution may properly seek to mitigate the risks of third-party relationships through the use of indemnity agreements with third parties, such agreements do not insulate the institution from its ultimate responsibility to conduct banking and related activities in a safe and sound manner and in compliance with law. Management should consider the principles addressed in this guidance and ensure that appropriate procedures are in place, taking into account the complexity and risk potential for each of its third-party relationships. The precise use of a risk management process is dependent upon the nature of the third-party relationship, the scope and magnitude of the activity, and the risk identified. Background Financial institutions generally enter into third-party relationships by outsourcing certain operational functions to a third party or by using a third party to make products and services available that the institution does not originate. Also, financial institutions may enter into arrangements with third parties in which the institution funds certain products originated by a third party. As the financial services industry continues to evolve, some financial institutions are also using third parties for functions that are either new or have traditionally been performed in- 1 This guidance supplements, but does not replace, previously issued information on third-party risk and is intended to assist in the management of third-party relationships. house. For purposes of this guidance, the term “third party” is broadly defined to include all entities that have entered into a business relationship with the financial institution, whether the third party is a bank or a nonbank, affiliated or not affiliated, regulated or nonregulated, or domestic or foreign. The FDIC recognizes that the use of third parties can assist management in attaining strategic objectives by increasing revenues or reducing costs. The use of a third party also commonly serves as a vehicle for management to access greater expertise or efficiency for a particular activity. The decision about whether to use a third party should be considered by an institution’s board of directors and management taking into account the circumstances unique to the potential relationship. The use of third parties in no way diminishes the responsibility of the board of directors and management to ensure that the third-party activity is conducted in a safe and sound manner and in compliance with applicable laws, regulations, and internal policies. This guidance provides a general framework for the implementation of an effective third-party risk management process. This guidance does not supersede previously issued FDIC and interagency guidance on managing third-party risk in the context of specific functions or activities. Also, transactions with affiliated entities remain subject to sections 23A and 23B of the Federal Reserve Act—the specific requirements of which are not addressed here. This guidance applies to any of an institution’s third-party arrangements, and is intended to be used as a resource for implementing a third-party risk management program, including functions and activities not specifically addressed in other guidance. The guidelines should not be considered a set of mandatory procedures, but management should ensure that sufficient procedures and policies are in place to control the risks associated with a particular third-party relationship. Potential Risks Arising from Third-Party Relationships There are numerous risks that may arise from a financial institution’s use of third parties. Some of the risks are associated with the underlying activity itself, similar to the risks faced by an institution directly conducting the activity. Other potential risks arise from or are heightened by the involvement of a third party. Failure to manage these risks can expose an institution to regulatory action, financial loss, litigation and reputation damage, and may even impair the institution’s ability to establish new or service existing customer relationships. Not all of the following risks will be applicable to every third-party relationship; however, complex or significant arrangements may have definable risks in most areas. The financial institution’s board of directors and senior management should understand the nature of these risks in the context of the institution’s current or planned use of third parties. The following summary of risks is not considered all-inclusive. Strategic risk. Strategic risk is the risk arising from adverse business decisions, or the failure to implement appropriate business decisions in a manner that is consistent with the institution’s strategic goals. The use of a third party to perform banking functions or to offer products or services that do not help the financial institution achieve corporate strategic goals and provide an adequate return on investment exposes the financial institution to strategic risk. 2 Reputation risk. Reputation risk is the risk arising from negative public opinion. Third-party relationships that result in dissatisfied customers, interactions not consistent with institution policies, inappropriate recommendations, security breaches resulting in the disclosure of customer information, and violations of law and regulation are all examples that could harm the reputation and standing of the financial institution in the community it serves. Also, any negative publicity involving the third party, whether or not the publicity is related to the institution’s use of the third party, could result in reputation risk. Operational risk. Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events. Third-party relationships often integrate the internal processes of other organizations with the bank’s processes and can increase the overall operational complexity. Transaction risk. Transaction risk is the risk arising from problems with service or product delivery. A third party’s failure to perform as expected by customers or the financial institution due to reasons such as inadequate capacity, technological failure, human error, or fraud, exposes the institution to transaction risk. The lack of an effective business resumption plan and appropriate contingency plans increase transaction risk. Weak control over technology used in the third-party arrangement may result in threats to security and the integrity of systems and resources. These issues could result in unauthorized transactions or the inability to transact business as expected. Credit risk. Credit risk is the risk that a third party, or any other creditor necessary to the third- party relationship, is unable to meet the terms of the contractual arrangements with the financial institution or to otherwise financially perform as agreed. The basic form of credit risk involves the financial condition of the third party itself. Some contracts provide that the third party ensures some measure of performance related to obligations arising from the relationship, such as loan origination programs. In these circumstances, the financial condition of the third party is a factor in assessing credit risk. Credit risk also arises from the use of third parties that market or originate certain types of loans, solicit and refer customers, conduct underwriting analysis, or set up product programs for the financial institution. Appropriate monitoring of the activity of the third party is necessary to ensure that credit risk is understood and remains