Foreign Vendor Due Diligence: Ensuring Banks Perform Sufficient Due Diligence When Contracting with Foreign Vendors

Transcription

1 ACI s Advanced Legal, Regulatory and Compliance Forum on Cross-Border & Global Payments and Technologies November 19-20, 2015 Foreign Vendor Due Diligence: Ensuring Banks Perform Sufficient Due Diligence When Contracting with Foreign Vendors John Hagy Chief Legal Officer MetaBank Andrew J. Lorentz Partner, Davis Wright Tremaine LLP Tweeting about this conference?

2 Why it matters Innovation proceeding faster outside of banks FinTech dynamics drives increase in outsourcing and partnerships Increasing globalization of products, services, and delivery channels and platforms Failure to anticipate cross-border challenges can lead to missed commercial opportunities and potential supervisory or enforcement action

3 Part 1 Agenda Regulatory guidance on bank oversight of foreign-based service providers

4 (Some) Key Guidance OCC Bulletin : Risk Management Guidance OCC Bulletin : Risk Management Guidance FFIEC IT Examination Handbook (2004): Outsourcing Technology Services FFIEC IT Examination Handbook (2014): Supervision of Technology Service Providers

5 Other (Important) Guidance FRB: Guidance on Managing Outsourcing Risk (2013) FDIC FIL : Guidance for Managing Third-Party Risk CFPB Bulletin : Service Providers

6 OCC Bulletin Third-Party Relationships Touchstone for bank third party oversight programs Risk-based approach expectation is for controls appropriate to risk and complexity of relationship Lifecycle focus: due diligence, contract terms, monitoring, contingency and termination, independent reviews, and senior bank management engagement

7 OCC Bulletin Bank use of Foreign Based Third Party Service Providers Foreign based service provider includes third parties whose servicing operations are located in a foreign country. Does not include a US based subsidiary of a foreign firms It would include US service providers to the extent that actual servicing operations are located in or outsourced to entities domiciled in a foreign country and subject to the laws and jurisdiction of that country

8 OCC Bulletin (cont d) Foreign-based service providers may raise unique strategic, reputation, credit, liquidity, transaction, country or compliance risks that require additional risk management oversight efforts.

9 FFIEC IT Exam Handbook (2004) Outsourcing Technology Services Additional risks with Foreign-Based Third Party Service Providers Country risk Economic, social and political conditions Compliance risk Impact on ability to comply with U.S. law Requirements of foreign data privacy laws or other regulations Export and counterparty restrictions Additional risk management Contract provisions Customer privacy; ownership and confidentiality of records Authority of US. Regulatory authorities to examine foreign service provider and access their information Choice of law

10 FFIEC IT Exam Handbook (2012) Supervision of Technology Service Providers - Foreign- Based TSP Program The Agencies' supervisory approach to cross-border outsourcing emphasizes the responsibility of the serviced financial institution to conduct adequate due diligence, manage risks appropriately, comply with applicable U.S. and foreign laws and regulations, and ensure access to critical information with respect to the services being provided by the FBTSP. If circumstances warrant, the Agencies arrange, through the appropriate foreign regulatory agencies, to obtain information related to the services provided to U.S. regulated financial institutions. If significant risks and concerns warrant on-site supervision of the FBTSP, the Agencies secure approval of their representatives at the Task Force on Supervision (TFOS) before conducting the examination.

11 Regulator perspective OCC Examiner informal summary Bank should closely follow OCC Bulletin (Third-Party Relationships) Manage relationship over entire life cycle Ongoing compliance monitoring of existing service providers is as important as the initial risk assessment and contract provisions Treat third-party services as if they were being offered by an internal division of the bank Often see banks focus on critical activities and operational risk, and neglect compliance and reputational risk E.g., failure to monitor what marketing companies are doing with customer data during and after the contract Expect contract term allowing OCC access but never expect to exercise the right

12 Part 2: Agenda Onboarding - Due Diligence Monitoring and Oversight Foreign Correspondent Banks

13 Foreign Vendor Management Risks Country risk- risk of impact of economic, social, and political conditions or events might adversely affect the bank Compliance risk- use of third party must inhibit its ability to comply with applicable US laws and regulations BSA/AML, Privacy, Due Diligence- onboarding Contract risk- protect privacy of customers confidentiality of bank records and security of its data, oversight by banks regulator Reputation risk- products or services Insurance

14 Foreign Vendors Due Diligence, initial and ongoing Entity information- type, experience, licensing Litigation Regulatory history Purpose of business and products Business Principals Testing the reputation of vendor and key individuals Media analysis Anticipated activity and volumes Data security, disaster recovery, and contingency plans Compliance knowledge FCPA assessment

15 Foreign Vendors Practical effects of cross-border due diligence Prolongs process of coming to terms in deals Increases expense travel, language and cultural barriers F.I. s have idiosyncratic standards and expectations borne of past mistakes so due dili is not always replicable Disrupts the service provider s operation Often may identify issues that require remediation before bank can proceed not just a risk assessment and allocation Mitigate by having clear expectations up front e.g., if service provider never intends to place data center in the United States, and that is a deal breaker recognize that fact early and part ways

16 Foreign Vendors Contracting Language Enforcement of provisions Limitation of liabliity Indemnification Termination Choice of law Regulator access to information Foreign vendor or location of services outside of U.S. must not compromise regulator ability to examine bank s operations Retain copies of all records, policies and procedures, and other important documents (in English)

17 Foreign Vendors Monitoring Risk based Frequency Internal or External Onsite Compliance reviews Data Security reviews Performance reviews Reporting

18 Foreign Correspondent Bank (FCB) Due diligence Correspondent Relationship BSA defines (in relevant part) as an account established for a foreign financial institution to receive deposits from, or to make payments or other disbursements on behalf of, the foreign financial institution, or to handle other financial transactions related to such foreign financial institution FI must establish appropriate, specific, and, where necessary, enhanced due diligence policies, procedures, and controls that are reasonably designed to detect and report instances of money laundering through such accounts

19 FCB Due Diligence Questions to consider Does FFI have physical presence in at least one country If no, don t open the account Is it true that FFI has a physical presence in a country or countries designated as Jurisdictions of Primary Concern or Jurisdictions of Concern in most recent International Narcotics Control strategy Report (US State Department) If yes, do not establish the account Is it true that FFI has offices in country designated as jurisdictions of primary money laundering concern by U.S. Secretary of the Treasury If yes, do not establish the account

20 FCB Due Diligence Questions to consider Are any counties within which the FFI has offices subject to special measures imposed by the U.S. Secretary of the Treasury pursuant to Section 311 of the USA Patriot Act? If yes, do not establish the account Are all banking offices of the FFI in countries with respect to which the Federal Reserve has previously determined that banks in such countries are subject to comprehensive supervision or regulation on a consolidated basis If no, do not establish the account

21 FCB Due Diligence Questions to consider-cdd Determine the identity of all persons who directly or indirectly,(a) own, control or have the power to vote 25% or more of any class of voting securities or other voting interests of the bank; or (b) controls the election of a majority of the directors of the FFI from Foreign Bank Certification Form At current, this information is not necessary if (a) the FFI has a Federal Reserve Form FRV-7 on file that discloses the banks ownership or is publically traded Under current rules information can be collected on the foreign Bank certification Form published through FinCEN. However if CDD proposal by FinCEN is finalized as proposed, may be required to also: Obtain information of each individual owning 25% or more, plus the identity of any single individual with significant control or authority to manage or direct a legal entity CIP each individual

22 FCB Due diligence Questions to consider Does the FFI maintain policies and procedures comparable to the BSA/AML policies and procedures required of US Banks in the US Review policies and procedures if FFI does not have a branch, commercial lending co, or other US presence

23 FCB Due Diligence Information to obtain for any FFI Entity information, licenses, evidence of good standing Determine type of and restrictions of license Financial information annual report Names of principles, ownership, key managers and members of Board of Directors Description of business Determine local market reputation References Intended use of account Source of funds to be deposited

24 Part 3 Agenda Foreign Corrupt Practices Act Foreign KYC/CIP

25 Foreign Corrupt Practices Act Anti-bribery provisions apply to: U.S. persons and businesses U.S. or foreign public companies listed on a U.S. exchange or filing with the SEC ( issuers ) Persons within U.S. territory Accounting provisions apply to: Issuers

26 Anti-Bribery Business Purpose Test Prohibits payments intended to induce or influence a foreign official to use his or her position in order to assist in obtaining or retaining business for or with, or directing business to, any person Foreign official Includes any officer or employee of a foreign government and those acting on the foreign government s behalf Prohibited payments Include payments made through agents, intermediaries or other third parties Exclude bona fide business expenditures and payments lawful under local law

27 Accounting Prevent concealment of bribery by issuers through falsification of books and records Must make and keep complete and accurate books and records reflecting transactions Must devise and maintain internal accounting controls to assure management control, authority and responsibility

28 Foreign transactions Foreign branches of U.S. bank KYC/CIP requirements apply to each bank agent, agency, branch or office within the United States

29 Foreign KYC/CIP Nevertheless, banks are expected to have policies, procedures, and processes in place at all their branches and offices to protect against risks of money laundering and terrorist financing. AML policies, procedures, and processes at the foreign office or branch should comply with local requirements and be consistent with the U.S. bank s standards; however, they may need to be tailored for local or business practices. - FFIEC BSA/AML Examination Manual (2014)

30 Regulator perspective FinCEN informal summary: Acknowledge that KYC/CIP requirements are not applicable to foreign branches of U.S. banks, however, such branches need to have AML policies and procedures in place Expectation is that AML measures be effective to abate AML risk that threatens the banking organization as a whole

31 Questions? Thank You!