Due Diligence and Ongoing Monitoring

This message was posted by a user wishing to remain anonymous

Recently we had an external auditor, write up a finding in regard to Escrow and Title companies Due Diligence.  They said that because of Regulatory guidance from 2023, we should include any business arrangement between a banking organization and another entity, by contract or otherwise in our inventory of vendors to review.

Up to this point our vendor management has not included the escrow and title companies in our "in scope vendors".

So, my question is whether we should, and if yes, what type of review should we conduct on an ongoing basis, especially since it could be several months or even years in between when a particular escrow or title company is going to be used. Should we review their financials, SOC report (if any), BCP, employment practices, etc.? And also, should this be done by vendor management or business units?

Any input would be greatly appreciated.

-------------------------------------------

Since the ridiculous expansion in the 2023 guidance ("any business arrangement", which places Subway in scope for bringing lunch to a meeting), we (FDIC examined) have an ever-growing section in the TPRM policy & Standard governance documentation that explains why certain classes of third party are NOT in the TPRM inventory.   Here is the section related to Title Companies.

• 
  Title Companies. The customer and the seller (if applicable) select the title provider. As a lender, we are required to provide a list of available providers in the area, as part of TRID. The disclosure indicates this is not an endorsement of or recommendation of the Title provider. Therefore the bank has no business arrangement with each and every title company used in transactions.

------------------------------
Greg Schmeisser
Dir. Corp. Contracts & Procurement
First Merchants bank
------------------------------

This message was posted by a user wishing to remain anonymous

You can decide who to include and exclude from the vetting process and then spell it out in your policy. The issue might be that you haven't specifically addressed these types of vendors? 

Our loan policy states that appraisers are to be hired through an Appraisal Management Companies (AMCs) as one of the key functions of an AMC is to ensure appraisers meet licensing and regulatory requirements. Therefore, our AMC is an approved vendor, but any appraiser not engaged through an AMC would have to go through the TPRM process. We also specifically exempt title companies because we consider them a facilitator. But even then, we get a copy of their license and run OFAC.

This message was posted by a user wishing to remain anonymous

Hello, 

Our third-party business partners like title companies are included in our vendor management due diligence and reviewed on an annual basis.  Our vendor management team determines the due diligence required and the business unit initiates the review process and works with vendor management in completing the assessment based on our internal process and risk appetite.   It would be up to your organizations process if a SOC report is required based on the due diligence and risk associated with the vendor.   

This message was posted by a user wishing to remain anonymous

Hello, 

We include our third parties like title companies is our vendor management due diligence.  Based on our risk category and due diligence questions we will determine at what level and if a SOC is required.   The business line owns the relationship and submits the information to our vendor management team, and it is reviewed on an annual basis (business line & vendor mgmt)  to make sure none of the previous answers to the due diligence questions have changed and that the level of risk remains the same.   I hope this helps. 

This message was posted by a user wishing to remain anonymous

You can take a risk-based approach and make the decision to scope Title companies out of your program and document your rationale. We have been on the fence about scoping them out and are still tracking them, but they are low risk and the most important due diligence we obtain is errors of omission insurance and completing an OFAC check. 

This message was posted by a user wishing to remain anonymous

Did you not recognize the title companies at all within your program?  Maybe that was the issue that was trying to be addressed?

We were trying at one point to maintain a file for each title company that we had used in the past.  In the recent years, we found that A LOT (like most all of them) would not respond to annual requests for due diligence documentation when we asked (because it might have been years since the last contact).  The larger ones would provide SOC, insurance, etc., while the smaller ones would not.  Most of the independent ones in our footprint have been getting absorbed by larger title companies, so it was making it a little easier; however, we still did have a gap of obtaining updated/current documentation.

I took my issue to both our internal TPRM Committee as well as Board and presented a solution that was adopted.  What we ended up doing was creating one main file titled "Title Companies" and documented all title companies that have been used to current day.  The list includes name, address, contact information as well as fees.  Within the file, we have notated that title companies are not true vendors of the Bank as they are pre-determined on the buy/sell agreement:  The Bank is bound to use whatever title company is listed.  Title companies do, at the time of transaction, provide a privacy policy and disclosure notification to the transactors.  We periodically update the list and keep all prior lists to show history.

This message was posted by a user wishing to remain anonymous

We include Escrow and Title Companies in our "in scope vendors".  For ongoing due diligence we typically collect insurance only.