Many firms are not currently including these relationships as vendors. However, that is about to change as the proposed interagency guidance requires all third parties to be in scope. (Link to new guidance) https://www.federalreserve.gov/newsevents/pressreleases/files/bcreg20210713a1.pdf
Although the guidance is not effective yet, it is an excellent time to review and expand your current scope to include your dealers. The ID Theft Red Flag Statement should be a requirement for each dealer, and yes, complaints monitoring is essential. Without knowing how many dealers you are working with, it is hard to estimate what kind of work effort will be necessary to make this happen. The good news is that you can get started now, so when the guidance becomes effective, you will have a head start complying with the new expectations.
I hope that information is helpful as you prepare for the new guidance. Still, I would like to hear what other members are currently doing with their dealers.
While auto dealers are not explicitly mentioned in the guidance, the section on Scope does contain the following:
As noted above, a third-party relationship is "any business arrangement between a banking organization and another entity, by contract or otherwise." There is more that can be found in the Q&A section "A bank's relationships with vendors or entities to which banksoutsource bank functions, or activities do not represent the only types of business arrangements. Since the publication of OCC Bulletin 2013-29, business arrangements have expanded and become more varied and, in some cases, more complex."
The only exclusions the guidance mentions are customers.
I hope that helps.