Agencies Clarify Risk-Based Supervision of Core Providers Serving Community Banks

Key Takeaways

• The OCC, Federal Reserve, and FDIC jointly issued a statement clarifying how they will apply risk-based supervision to certain services core providers deliver to community banking organizations.
• The statement outlines factors the agencies will weigh in supervisory and enforcement decisions, including where a core provider causes a bank to engage in unsafe or unsound practices or violations of law.
• Community banks and their compliance teams should reassess core provider oversight and contract practices.

Deep Dive

The OCC, Federal Reserve, and FDIC jointly issued a statement clarifying how they will apply risk-based supervision to certain services core providers deliver to community banking organizations. The statement outlines factors the agencies will weigh in supervisory and enforcement decisions, including where a core provider causes a bank to engage in unsafe or unsound practices or violations of law. Community banks and their compliance teams should reassess core provider oversight and contract practices.

The statement addresses three areas. First, select aspects of how community banks engage with core providers. Second, the extent to which the agencies will consider those aspects when setting the level of supervisory oversight of core provider services. Third, the agencies' supervisory and enforcement authorities where a core provider engages in, or causes a bank to engage in, unsafe or unsound practices or violations of laws or regulations. The third point matters most: it signals that core providers may face direct supervisory and enforcement attention, and that provider-driven deficiencies may not fall solely on the bank. The bulletin does not detail the specific factors, so teams should not assume reduced bank accountability.

The bulletin states no effective date, compliance deadline, or new reporting obligation. As guidance, it does not impose new binding requirements. However, it will likely shape examiner expectations and the intensity of supervision of third-party technology service providers. Banks should expect examiners to refer to it during reviews of third-party risk management, bank-fintech arrangements, and bank information technology.

Recommended actions:
- Obtain and review the full joint statement and map it to the existing third-party risk management framework.
- Inventory core provider relationships and the services in scope.
- Review contract terms, including service levels, termination rights, data access, conversion assistance, and incident notification.
- Document the due diligence, ongoing monitoring, and escalation processes for core provider performance and compliance issues.
- Establish a process to escalate provider-caused violations or unsafe practices to the bank's primary regulator.
- Brief senior management and the board on the statement and the possible change in examiner focus.

Risk implications: The impact is moderate and mainly affects third-party, operational, and compliance risk. Banks that depend heavily on a single core provider, or that have weak contractual leverage, face the most exposure. The statement may also give community banks a clearer basis for raising concerns about provider practices, and it signals that providers could face more direct regulatory scrutiny, which could affect service stability and pricing.

Source: Office of the Comptroller of the Currency