OCC Issues New Guidance on Third-Party Risk Management

This regulation was rescinded and replaced with the Interagency Guidance on Third-Party Relationships: Risk Management. Click here to read about this final regulation.

On Mar 5, 2020, the Office of the Comptroller of the Currency (OCC) issued updated guidance on third-party risk management. Within the new guidance they’ve added to the frequently asked questions (FAQs) section that was in Bulletin 2017-21. Bulletin 2020-10 offers little new information other than an update to a question; however, it's still important to discuss what you need to know. For the most part, it’s Bulletin 2017-21 guidance restated. 

OCC Bulletin 2020-10 Highlights

Bulletin 2020-10 rescinds Bulletin 2012-21 and continues to address many topics through FAQs. Per the OCC, addressed in the FAQs are the following 12 topics:

• The terms “third-party relationship” and “business arrangement”
• When cloud computing providers are in a third-party relationship with a bank
• When data aggregators are in a third-party relationship with a bank
• Risk management when the bank has limited negotiating power in contractual arrangements
• Critical activities and how a bank can determine the risks associated with third-party relationships
• Bank management’s responsibilities regarding a third party’s subcontractors
• Reliance on and use of third party-provided reports, certificates of compliance, and independent audits
• Risk management when third party has limited ability to provide the same level of due diligence-related information as larger or more established third parties
• Risk management when using a third-party model or when using a third-party to assist with model risk management
• Use of third-party assessment services in managing third-party relationship risks
• A board’s approval of contracts
• Risk management when obtaining alternative data from a third-party

It’s important to put emphasis on that there is only one slight update to a frequently asked question. It’s question 24 which now reflects current American Institute of Certified Public Accountants (AICPA) Service Organization Control report information. Otherwise, the fundamental principles of third-party risk that have echoed since the OCC issued Bulletin 2013-29 on Oct 30, 2013, and the supplemental bulletins 2017-7 and 2017-21, remain in place.

Your Course of Action

When a new bulletin is issued it's important to review it and, even if it turns out to be quite minor changes such as this one, it's still crucial to be paying attention, just in case. There's danger in ignoring updates to third-party risk guidance. 

For now, remember that sticking to the standard requirements of third-party risk management is always the best course of action. Rigor and discipline around your program are the keys to success. While we always appreciate new bulletins and new clarifications, unless the fundamentals change, my advice to you is to stay the course and keep your program in order.

Dive deeper into learning how the industry is currently managing third-party risk. Download the whitepaper.