Covered services requiring reporting under BSCA include: check and deposit sorting/posting, computation/posting of interest, preparation/mailing checks/statements, other clerical, book keeping, accounting, statistical or similar functions, data processing, internet banking or mobile banking services.
We added a check in our new vendor onboarding process and will recommend to a relationship owner that notification be provided if we think the services fall within the above however, compliance owns the ultimate responsibility for the reporting.
Since Third Party Risk is reviewing all new relationships, we felt like although we don't own the responsibility for the reporting that we can provide an important control to help mitigate the compliance risk.
I am interested to hear how others are managing this one. We have found its a little like hot potato, no one wants to own the responsibility. Our regulators have been OK with our process, no recommendations.
------------------------------
Shelly Chase
VP Operational Risk
------------------------------
Original Message:
Sent: 02-22-2023 11:07 AM
From: Jeremy Pelkey
Subject: Bank Service Company Act -
Hello,
I am curious how other institutions measure third party services and if they need to be reported to the FDIC. Does anyone have a best practice that has proved to be consistent and aligned with the requirement?