I just want to add the guidance doesn't state there is no expectation to perform due diligence on third parties subcontractors. You should evaluate the risk to your organization, and apply mitigation as appropriate. For Gene's organization that mitigation is done through SOC 2 reports, CUEC or in event of reseller, full due diligence. I have been questioned by our regulators related to certain 4th parties and how we came to our decisions to either do added due diligence or not. So ensure you evaluate the risk to your organization and ensure that it's within your organizations risk appetite through appropriate committee or executive socialization.
As the guidance clarifies, relationships with a third party, including a third party's use of subcontractors, should be evaluated based on the risk the relationship poses to the banking organization, which may include assessing whether a third party's use of subcontractors may heighten or raise additional risk to the banking organization and applying mitigating factors, as appropriate. The agencies have also made streamlining changes to improve clarity and promote flexibility, including by removing use of the term ''critical subcontractor.''
Note: Above quote was taken from the Interagency publication under F. Subcontractors.
Veralyn Hensley
SVP, Director of Vendor Management
Mechanics Bank
Original Message:
Sent: 3/7/2024 4:13:00 PM
From: Gene Fox
Subject: RE: 4th Party Vendors as it relates to Customer designated vendors
The new Interagency Guidance (FDIC, OCC, Fed) issued in June 23 clarifies that they do not expect us to perform due diligence around our third-party's subcontractors, but expect us to have a very good understanding of what oversight is performed by the third-party over its use of subcontractors. With that said, we do ask what subcontractors are used in support of the Bank and what do they do. We will not only ask for their oversight activities, but will ask:
· Do you have contracts with your subcontractors that require at least the same level of confidentiality/privacy/etc. that you have with us? We put that into our contracts with the third-parties.
· Also from a contracting perspective, we look at what they have in place at the time of execution and then add that any new subcontractors added to the mix that will somehow support the Bank must be approved by us in writing beforehand (doesn't always fly but we try J).
· If the subcontractor is doing data hosting (AWS, Azure, Google, et al) we will ask for the SOC 2 reports and our third-party's evaluation of the CUECs.
· Sam if the subcontractor is an independent data site or provides the infrastructure support.
· For the subcontractors, we will run whatever risk monitoring reports we can to evaluate their business health and cyber risks.
· The EXCEPTION to this is if our third-party is a reseller that does not rep or warrant what they are selling, then we will put that product through as much due-diligence as we can.
Gene Fox
VP, Third-Party Risk Management Officer
-------------------------------------------
Original Message:
Sent: 3/7/2024 3:28:00 PM
From: Anonymous Member
Subject: RE: 4th Party Vendors as it relates to Customer designated vendors
This message was posted by a user wishing to remain anonymous
I agree that your org has a responsibility to do due diligence where it is allowing any party (whether a third party or a fourth party) access to its core service which in turn potentially opens up the data of multiple bank clients. I would think that you would want to do due diligence to ensure the integrity of your system if nothing else. Bank partners will likely want to do their own due diligence as well; accordingly, the integration should be disclosed to all current and potential bank partners so that they can meet their regulatory obligations and do not find themselves with an unknown access point to their customer data. When we evaluate potential partners, we want to know that they have their own robust third party risk programs and it sounds like this is a large third (or fourth depending on contracts) party risk for your org (and potentially for your bank partners as well).
Original Message:
Sent: 03-07-2024 02:13 PM
From: Anonymous Member
Subject: 4th Party Vendors as it relates to Customer designated vendors
This message was posted by a user wishing to remain anonymous
Thanks for your feedback. I still think it is murky on this issue of responsibility of due diligence as it relates to 3rd party regulations. We have a responsibility to all our customers and protecting their data. When Bank A asks often times tell us to use Service Provider A for this function and that requires that Service Provider A to integrate into us it opens us and our other customers to vulnerabilities b/c now that Service Provider A has an access point to our core services that provides multiple Banks our core service. Who is performing or should be performing the DD on Service Provider A. I feel we should be just as responsible in getting that information as the Bank having the direct relationship b/c we have a responsibility to our other customer Banks that are on our core. In some situations multiple banks use this Service Provider A for same services requiring a level of integration into each data point for each Bank.
This is likely a very complex question and might not be fully illustrated for understanding by text. But I do appreciate the feedback.
Original Message:
Sent: 03-07-2024 03:05 AM
From: Hannah MacDonald
Subject: 4th Party Vendors as it relates to Customer designated vendors
It depends on the contractual nexus and I would be explicitly clear in what services you are providing vs that of the supplier in your contract
If you are the supplier to the bank = 3rd party
Any service provider you rely on to provide the service and you own/maintain/contract with= 4th party
e.g. fintech (3rd party), Amazon Web Services (4th party)
In the last example where you say we pay the 4th party and bill the customer, if you have the contract with the 4th party and the customer has no direct connection with said supplier - you own, maintain and are responsible for that relationship
If your company disappeared oversight, the bank would lose access to all services, yours and the 4th party you have referred to
If the bank has a direct contractual relationship with the supplier and you merely operate that service for them, they would still be a 3rd party, as would you. Your contract would state you are responsible for operating that service, but it would not be a 4th party in this scenario
Hope that helps
--
Hannah MacDonald Supplier Operations Lead
--
This email is confidential and protected by copyright, and might contain privileged information. The same goes for any attachments.
If we've sent it to you by mistake (sorry), please don't copy it or show it to anyone. You also shouldn't use it to make a decision, and you shouldn't rely on the contents. Let the sender know as soon as you can, and then delete the email. Thank you!
Monzo Bank Limited is a company registered in England and Wales (No. 09446231) registered at Broadwalk House, 5 Appold St, London, EC2A 2AG. Monzo Bank Ltd is authorised by the Prudential Regulation Authority (PRA) and regulated by the Financial Conduct Authority and the PRA. Our Financial Services Register number is 730427.
Original Message:
Sent: 3/6/2024 1:29:00 PM
From: Anonymous Member
Subject: 4th Party Vendors as it relates to Customer designated vendors
This message was posted by a user wishing to remain anonymous
We are a Fintech company providing core banking services. Vendor Risk Mgmt. is very new to the organization and there is an ongoing use of what I would define as 4th party vendors but in a different perspective. Our banks often have relationships with other service providers that require extracts of data, API integration etc. in order for them to perform functions on behalf of the bank. Of course, we have all the bank's data so we have to have an indirect relationship with the 4th party to ensure information is passed back and forth according to the need. There is an inherent risk as they often times have access to our network which service other banks that might not utilize their services. How do you handle the delicate relationships when the Bank (customer) has the direct contract with them. Sometimes, we pay that 4th party and then bill our customer.
I would love to hear input on this and how others might handle. Thank you in advance for your insight.