SEPTEMBER 20, Third-Party Risk Management A Strategic Priority in Financial Innovation

Transcription

1 promontory.com INFOCUS SEPTEMBER 20, 2016 BY YOKO OTANI, JULIE WILLIAMS, AND RACHEL ANDERIKA Third-Party Risk Management A Strategic Priority in Financial Innovation Arrangements between banking firms and third parties, particularly financial-technology companies, have grown and deepened in recent years. Banking firms looking to offer innovative services, reach new customers, outsource costs, and react swiftly to market trends have made third parties a key element of their business plans. Yoko Otani Managing Director As relationships between banking firms and third parties increasingly resemble strategic partnerships, regulators have raised their expectations for a banking firm s third-party risk management practices. 1 Regulators expect banking firms to adapt their risk and compliance practices to monitor and control the risks assumed through these relationships with the same rigor that they would apply to an internal group or division. Third-party vendors are, at the same time, finding that successful relationships require them to be knowledgeable about regulatory expectations and to have business models and governance frameworks that address these expectations. Sustained Regulatory Scrutiny of Third-Party Risk Management Julie Williams Managing Director and Director of Domestic Advisory Practice Many banking firms have established comprehensive and rigorous vendor risk management programs, but dynamic changes in the industry are pushing regulators to scrutinize the nature of third-party relationships more closely. Regulators have made it clear that they do not expect innovation to come at the expense of effective risk management and corporate governance, 2 and they have long possessed broad authority to supervise such activities under the Bank Service Company Act. 3 The Office of the Comptroller of the Currency and the Federal Reserve Board released guidance on third-party risk management in 2013 that spelled out expectations for the management of thirdparty relationships throughout their life cycle, including comprehensive due diligence, contract terms, monitoring, contingency planning, and exit strategies. Rachel Anderika Senior Principal 1 See, for instance, Third-Party Relationships: Risk Management Guidance, Office of the Comptroller of the Currency, Oct. 2013; Guidance on Managing Outsourcing Risk, Federal Reserve Board, December 2013; and proposed Examination Guidance for Third-Party Lending, Federal Deposit Insurance Corp., July Supporting Responsible Innovation in the Federal Banking System: An OCC Perspective, Office of the Comptroller of the Currency, March Bank Service Company Act, 12 U.S.C (c).

2 More recently, the banking agencies have discussed the impact of fintech companies on bank supervision. Almost every one of these companies has a bank partner, a supervisory official noted in the Federal Reserve Bank of San Francisco s 2015 annual report. It s equally important that we understand what those partnerships look like and the implications for banks and the consumers that banks serve. 4 Similarly, the OCC has made it clear that third-party risk management remains a key focus in its supervision, particularly as it relates to technology and innovation. Its semiannual risk report released in July warned banking firms about assuming unfamiliar risks in adopting innovative products, services, and processes. 5 Comptroller of the Currency Thomas Curry said in a Sept. 13 speech that responsible innovation would require a regulatory framework that addresses the supervision of fintech firms looking to deepen relationships with banks, and noted the importance of risk management, compliance, and governance. 6 And most recently, the agency said when it released its bank supervision operating plan on Sept. 14 that it would include resources and support for risk-focused examinations of technology service providers that provide critical processing and services to banks. 7 This regulatory emphasis presents a key challenge for banking firms, some of which may not have the requisite in-house expertise or capacity to assess, monitor, and manage such risks. Notably, the Federal Deposit Insurance Corp. s recent proposed guidance for third-party lending reminds examiners to review how the bank assesses the adequacy of the third party s own vendor risk management program (fourth-party risk) and notes that those banking firms engaging in new or significant lending activity through third parties will generally be subject to increased supervisory attention. Updating Practices The key activities in managing third-party relationships through their life cycle have not materially changed. However, the scope and scale of these oversight activities should be reassessed, particularly those that relate to any type of third-party lending or a partnership with a fintech firm Annual Report, Federal Reserve Bank of San Francisco, April Semiannual Risk Perspective, Office of the Comptroller of the Currency, spring Remarks before the Marketplace Lending Policy Summit 2016, Sept. 13, OCC Fiscal Year 2017 Bank Supervision Operating Plan, Sept. 14, Dimensioning Vendor Risk Banking firms can ask some basic questions as an initial step in determining the relative risk of a relationship with a third party or vendor. How visible is the third party to the banking firm s customer? Is the service or product offered in the name of the banking firm? What is the scope and type of the activities undertaken by the third party? Is the third party undertaking a core activity, such as lending? Is the third party a known entity to regulators and customers, and what is its reputation? Does the service or product offered by the third party require the banking firm to make material changes in its governance, risk, operational, or IT processes? PROMONTORY Sightlines InFocus SEPTEMBER 20,

3 Given supervisory interest in these activities, banking firms would benefit from reviewing their thirdparty risk management practices to ensure that they are up to date. Higher-risk activities conducted by third parties merit more rigorous governance than lower-risk activities. Examples of higher-risk activities include those that involve obtaining or storing customer information, raise consumer or anti-money-laundering compliance considerations, involve shared IT systems, or could damage the banking firm s brand or reputation if not performed correctly. Banking firms may want to review their current practices in several disciplines: New-Product Assessment, Risk Identification, and Strategic Planning. Banking firms generally ensure that new or expanded products and services are vetted through a new-product approval process. It is vital that the NPA process evaluate reliance on third parties to ensure that the bank has a comprehensive understanding of the service or product and its associated risks. For relationships of strategic importance, regulators will expect a bank to assess and document potential partnerships in the context of its overall strategic-planning processes. Due Diligence. The most effective third-party risk management occurs before a contract is signed. Regulators therefore expect due diligence in advance of a partnership, with the rigor of the process correlating to the degree of risk that the relationship presents. Given the changing nature and type of third-party relationships, banking firms should plan to refresh their due diligence periodically as well as revisit the criteria and methodologies they use to risk-rate the relationships. The criteria should capture the true nature and risk profile of the relationship to enable assignment of appropriate risk ratings. Expertise and Management Capacity. The bank s team conducting the due diligence and undertaking ongoing monitoring activities should have the requisite technical and subjectmatter expertise to oversee all the activities and risks arising from a relationship. Teams must have a strong command of the laws and regulations that apply to the activities carried out by the third party, and make sure that the company has a robust risk and compliance program to address them on an ongoing basis. Ongoing Monitoring. Oversight should be commensurate with the complexity and criticality of the third-party relationship, as well as with the degree of involvement with the customer to include the receiving, handling, and storing of customer information. Cybersecurity and data privacy continue to be high on the list of key challenges for all companies. The reputational consequences for banking firms due to lapses by third parties are serious, and compel them to keep a close eye on the third party s ability to manage these issues. Contract Structuring. Given the dynamic nature of relationships and business needs, banking firms should seek contract terms that are flexible enough to accommodate evolving expectations of their regulators. Contingency Planning and Exit Strategies. In addition to well-developed disasterrecovery and business-continuity plans, regulators expect banking firms to develop credible exit strategies that satisfy regulatory safety and soundness or compliance standards. As the nature and type of third-party relationships become more strategic, exit strategies are both more vital and more challenging. These considerations should be incorporated into the initial vetting, contract negotiations, decision-making, and strategic-planning processes of the bank. PROMONTORY Sightlines InFocus SEPTEMBER 20,

4 Innovative business strategies present both opportunities and challenges for banking firms and nonbank third parties. Properly constructed, relationships between them produce innovative products and services with risk management practices that meet regulatory expectations, allowing both parties to gain a strategic advantage in a rapidly evolving industry. About the Authors Yoko Otani is a managing director at Promontory and advises clients on risk and compliance matters, with an emphasis on helping them integrate strategic and regulatory objectives. Julie Williams is a managing director at Promontory, and director of its domestic advisory practice. She advises clients on government expectations that shape regulatory and compliance requirements. Rachel Anderika is a senior principal at Promontory, and advises clients on a broad range of regulatory issues, including consumer compliance. PROMONTORY Sightlines InFocus SEPTEMBER 20,

5 Contact Promontory For more information, please call or your usual Promontory contact or: Stacy Coleman Managing Director, Washington, D.C Linda Gallagher Managing Director and Global Head of the Consumer Protection Practice, Washington, D.C Yoko Otani Managing Director, New York Julie Williams Managing Director and Director of Domestic Advisory Practice, Washington, D.C To subscribe to Promontory s publications, please visit promontory.com/subscribe.aspx Follow Promontory on Promontory Financial Group helps companies and governments around the world manage complex risks and meet their greatest regulatory challenges. We are the world s foremost experts in financial risk, regulation, and compliance. Former U.S. Comptroller of the Currency Eugene A. Ludwig founded Promontory in Promontory Financial Group, LLC th Street, NW, Suite 1100, Washington, DC Telephone Fax promontory.com 2016 Promontory Financial Group, LLC. All Rights Reserved. PROMONTORY Sightlines InFocus SEPTEMBER 20,