RISK MANAGEMENT—Third-Party Risk Management: A Guide for Community Banks

Community banks engage with third parties to compete in and respond to an evolving financial services landscape. Third-party relationships can offer community banks access to new technologies, risk-management tools, human capital, delivery channels, products, services, and markets. A community bank’s reliance on third parties, however, reduces its direct operational control over activities¹ and may introduce new risks or increase existing risks, including, but not limited to, operational, compliance, financial, and strategic risks.

Due to the varied risks associated with third-party relationships, it is important for community banks to appropriately identify, assess, monitor, and control these risks as well as ensure that activities are performed in a safe and sound manner and in compliance with applicable laws and regulations.² These laws and regulations include, but are not limited to, those designed to protect consumers (such as fair lending laws and prohibitions against unfair, deceptive, or abusive acts or practices) and those addressing financial crimes (such as fraud and money laundering).

Engaging a third party does not diminish or remove a bank’s responsibility to operate in a safe and sound manner and to comply with applicable legal and regulatory requirements, including consumer protection laws and regulations, just as if the bank were to perform the service or activity itself. A community bank may engage an external party to conduct aspects of its third-party risk management. However, the bank cannot abrogate its responsibility to employ effective risk-management practices, including when using a third party to conduct third-party risk management on behalf of the bank.

In June 2023, the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) (collectively, the agencies) issued the Interagency Guidance on Third-Party Relationships: Risk Management (TPRM Guidance).³ The TPRM Guidance includes sound risk-management principles for banking organizations to consider when developing and implementing risk-management practices for all stages in the life cycle of third-party relationships.

This guide is intended to assist community banks when developing and implementing their third-party risk-management practices. This guide is not a substitute for the TPRM Guidance.⁴ Rather, it is intended to be a resource for community banks to consider when managing the risk of third-party relationships. This guide is not a checklist and does not prescribe specific risk-management practices or establish any safe harbors for compliance with laws or regulations. While this guide is intended for use by community banks, other banks may find it useful. Some additional resources that can help support a bank’s development and implementation of its risk-management program are listed in the appendix to this guide. The agencies underscore that supervisory guidance does not have the force and effect of law and does not impose any new requirements on banks.

The guide provides potential considerations, resources, and examples through each stage of the third-party risk-management life cycle and is organized under the following topics:

Excerpts from the TPRM Guidance are also highlighted within boxes in each section.

Not all third-party relationships present the same level of risk, and therefore not all relationships require the same level of oversight. As part of sound risk management, community banks apply more rigorous risk-management practices throughout the third-party relationship life cycle for third parties that support higher-risk activities, including critical activities. A community bank may adjust and update its third-party risk-management practices commensurate with its size, complexity, and risk profile by periodically analyzing the risks associated with each third-party relationship. It is important to involve bank staff with the requisite knowledge and skills in each stage of the risk-management life cycle.

This guide includes considerations illustrating how a community bank may apply risk-management practices in different stages of the third-party relationship life cycle. An important initial step is identifying third-party relationships that support higher-risk activities, including critical activities. In determining whether an activity is higher risk, banks may assess various factors, such as if the third party has access to sensitive data (including customer data), processes transactions, or provides essential technology and business services.

Effective third-party risk management generally follows a continuous life cycle for third-party relationships. The five stages of the life cycle are set forth in figure 1, surrounded by the governance practices of Oversight and Accountability, Independent Reviews, and Documentation and Reporting.

Figure 1. Stages of the risk-management life cycle

Careful planning enables a community bank to consider potential risks in the proposed third-party relationship. In addition, risk assessments are an important component of managing third-party relationships and help a bank evaluate the extent of risk-management resources and practices for effective oversight of the proposed third-party relationship throughout the subsequent stages of the third-party relationship life cycle.

Due diligence is the process by which a community bank assesses, before entering into a third-party relationship, a particular third party’s ability to perform the activity as expected, adhere to the community bank’s policies, comply with all applicable laws and regulations, and conduct the activity in a safe and sound manner. Effective due diligence assists with the selection of capable and reliable third parties to perform activities for, through, or on behalf of the community bank. If the bank cannot obtain desired due diligence information from the third party, the bank may consider alternative information, controls, or monitoring.

Before entering a contractual relationship with a third party, a community bank typically considers contract provisions that meet its business objectives, regulatory obligations, and risk-management policies and procedures. The community bank typically negotiates contract provisions that facilitate effective risk management and oversight, including terms that specify the expectations and obligations of both the community bank and the third party. When a community bank has limited negotiating power, it is important for bank management to understand any resulting limitations and consequent risks. Possible actions that bank management might take in such circumstances include determining whether the contract can still meet the community bank’s needs, whether the contract would result in increased risk to the community bank, and whether residual risks are acceptable.

A community bank’s ongoing monitoring of the third party’s performance enables bank management to determine if the third party is performing as required for the duration of the contract. The bank may also use information from ongoing monitoring to adapt and refine its risk-management practices.

A community bank may choose to end its relationship with a third party for a variety of reasons. A bank typically considers the impact of a potential termination during the planning stage of the life cycle. This consideration may help to mitigate costs and disruptions caused by termination, particularly for higher-risk activities, including critical activities.

Community banks typically consider the following governance practices throughout the third-party relationship life cycle: oversight and accountability, independent reviews, and documentation and reporting.

These resources are not all inclusive, and other sources of information may be available, particularly on specific topics.