Bank regulators put core-provider contracts on the exam agenda of the banks that signed them

The instrument here is a bank examination. The agencies say the core services sector is highly concentrated and that community banks have few providers to choose from ^[10]. The remedy they propose for that concentration is risk-based examinations of the arrangements ^[11]. An examiner reads a contract the bank signed and had little power to rewrite. The guidance itself is addressed to the banks. It "is intended to assist banks and credit unions to better align and tailor their third-party risk management practices to the risks of individual third-party relationships," the agencies said in a joint statement ^[18].

The providers get a document of their own, of a kind. Neither account says what authority those supervisory and enforcement decisions would rest on, or what a core provider would actually face. A dollar figure appears nowhere in either one ^[21].

The proposed guidance takes a principles-based approach and, as with all supervisory guidance, is non-binding, according to the OCC's release ^[5]. Pressure therefore arrives at the next exam, in an examiner's judgement about transparency, contract structure and technology components ^[3]. The proposal also asks for closer oversight of servicers' technology investments and capabilities ^[12]. When the text is final the agencies plan to rescind the existing third-party risk management guidance and replace it ^[7].

The lighter track is the part that changes procurement. A community bank comparing its incumbent core provider's own digital product against a third-party fintech partnership now has a supervisory reason to prefer the incumbent. That sits awkwardly beside Federal Reserve Gov. Lisa Cook's statement that a principles-based and risk-focused approach "may be helpful towards promoting these goals," "especially for enabling innovation and competition for vendor services" ^[17].

Fed Gov. Michael Barr objected that the traditional-bank guidelines were drafted more specifically than the broader third-party guidance ^[15]. "Experience suggests that many banks with complex business models are especially in need of guidance that better addresses their particular third-party risk management issues, which is not addressed in these proposals," he said ^[16].

The two accounts also differ on who issued the community-bank companion. American Banker describes a joint proposal from the agencies covering traditional community banks and their third-party service providers ^[13]. The OCC release says the Federal Reserve Board separately requested comment on a guide for Fed-supervised community banks ^[14]. Three documents landed that day, or four, depending on which account is right ^[20].

The counter-thesis is straightforward, and it is cheap. Examiner attention is free leverage for a small bank at renewal: a compliance officer who can cite supervisory expectations on transparency and on the ability to negotiate terms ^[4] has an argument he did not have last week. Making it costs nothing. That reading holds only while the leverage stays with the buyer. If the agencies open a supervisory action against a core provider itself under the factors in that separate statement ^[8], the pressure has found the party with the market power, and the argument above is wrong.