Due Diligence and Ongoing Monitoring

I'm working on onboarding a law firm as a new vendor for our credit union. The product owner has confirmed this vendor will have access to NPI and will be working with our Human Resources department. My question is must the law firm be licensed to work in CA since we are located in CA?  All the documentation I've received reference their NY address only. When I look up their law firm online, it doesn't look like they have any offices in CA. Also, when I look up the name of the attorney, he is only registered in NY as well. 

This message was posted by a user wishing to remain anonymous

Good Morning- I think we need to understand what the services are that you are using the law firm for. For example, to practice law in the state, a firm must use an attorney who has passed the bar in that state. If you are using the firm to act more as a consultant to produce or review disclosures or to review regulatory compliance for the credit union for fair lending reviews for example, they would not have to be licensed, but you would want to ensure they can produce evidence of their ability to provide expertise in that area. 

This message was posted by a user wishing to remain anonymous

Thank you - we are using them as a consultant. Appreciate the feedback