US Agencies are extending, from September 17, 2021 to October 18, 2021, the comment period on the proposed guidance for the risk management of third-party relationships, including the relationships with financial technology entities. These US Agencies are the Board of Governors of the Federal Reserve System (FED), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC). The comment period is being extended to allow interested persons more time to analyze the issues and prepare their comments. The proposed guidance is aimed to help banks identify and address the risks associated with third-party relationships and responds to industry feedback requesting alignment among the agencies with respect to third-party risk management guidance.
The proposed guidance considers the level of risk, complexity, and size of the banking organization and the nature of the third-party relationship. It describes third-party relationships as business arrangements between a banking organization and another entity, by contract or otherwise. The proposed guidance emphasizes that a banking organization’s use of third parties does not diminish its responsibility to perform an activity in a safe and sound manner and in compliance with applicable laws and regulations. The proposed guidance also discusses supervisory reviews of third-party relationships and is intended for all third-party relationships; it is especially important for relationships that a banking organization relies on to a significant extent, relationships that entail greater risk and complexity, and relationships that involve critical activities as described in the proposed guidance. The proposed guidance describes the third-party risk management life cycle and identifies principles applicable to each stage of the life cycle, including:
- Developing a plan that outlines the banking organization’s strategy, identifies the inherent risks of the activity with the third party, and details how the banking organization will identify, assess, select, and oversee the third party
- Performing proper due diligence in selecting a third party
- Negotiating written contracts that articulate the rights and responsibilities of all parties
- Having the board of directors and management oversee the banking organization’s risk management processes, maintaining documentation and reporting for oversight accountability, and engaging in independent reviews
- Conducting ongoing monitoring of the third party’s activities and performance
- Developing contingency plans for terminating the relationship in an effective manner
Comment Due Date: October 18, 2021
Keywords: Americas, US, Banking, Fintech, Third-Party Service Providers, Regtech, Guidance, Cloud Computing, Third-Party Risk, US Agencies
The Board of Governors of the Federal Reserve System (FED) published the final rule that amends Regulation I to reduce the quarterly reporting burden for member banks by automating the application process for adjusting their subscriptions to the Federal Reserve Bank capital stock, except in the context of mergers.
The European Banking Authority (EBA) published its assessment of risks through the quarterly Risk Dashboard and the results of the Autumn edition of the Risk Assessment Questionnaire (RAQ).
The Malta Financial Services Authority (MFSA) updated the guidelines on supervisory reporting requirements under the reporting framework 3.0.
The Hong Kong Monetary Authority (HKMA) published a circular, along with the reporting form and instructions, for self-assessment, by authorized institutions, of compliance with the Code of Banking Practice 2021.
The Financial Conduct Authority (FCA) decided to register European DataWarehouse Ltd and SecRep Limited as securitization repositories under the UK Securitization Regulation, with effect from January 17, 2022.
The European Commission (EC) published the Delegated Regulation 2022/25, which supplements the Investment Firms Regulation (IFR or Regulation 2019/2033) with respect to the regulatory technical standards specifying the methods for measuring the K-factors referred to in Article 15 of the IFR.
The Bank of International Settlements (BIS) published a paper that assesses the ways in which platform-based business models can affect financial inclusion, competition, financial stability and consumer protection.
The Central Bank of Egypt (CBE) published a circular with instructions on emergency liquidity assistance to banks that are unable to meet their liquidity requirements.
The European Supervisory Authorities (ESAs) published the list of identified financial conglomerates for 2021.
The Australian Prudential Regulation Authority (APRA) updated the list of authorized deposit-taking institutions, granting license to Barclays Bank PLC and Crédit Agricole Corporate and Investment Bank to operate as foreign authorized deposit-taking institutions under the Banking Act 1959.