1. Overview and Background

(Company) (hereinafter referred to as (Company)) uses Third Parties to provide products or services in support of our business operations. Such outsourced relationships may benefit (Company) by reducing costs, improved performance, staff augmentation, increased business competitiveness, access to specific expertise, and established distribution channels. However, Senior Management and the Board of Directors recognize that (Company’s) reliance on third-party relationships presents many risks that must be identified, assessed, and managed. Failure to manage these risks can expose (Company) to financial loss, litigation, or other damages or may even impair (Company) ability to service existing customer relationships or establish new ones.

2. Statement of Purpose

This policy aims to establish standards and guidance relating to (Company)’s management of its third-party relationships and the associated inherent and residual risks presented by those third-party relationships. These risks are present when (Company) engages with third parties to provide products and services directly to (Company) for the benefit of its internal operations, employees, investors, or customers. Furthermore, the (Company) documents the structure for; identifying, assessing, controlling, monitoring, and reporting on risks related to (Company)’s use of third parties per applicable laws, safe and sound business practices, and related supervisory guidance, particularly that of the Final Interagency Guidance from the Board of Governors, the FDIC, and the OCC. 

3. Policy Statement

Relationships with third parties are fundamental to (Company)’s ability to maintain its operations and offer products and services to its employees, customers, and investors. However, (Company)’s use of third parties does not diminish its responsibility to ensure that the activity is performed safely and soundly and complies with applicable law, has established the (Policy Name) (hereinafter referred to as the policy), to formally define the framework, tools, roles, responsibilities, scope, and components, needed for a fully functioning Third-Party Risk Management program. The framework shall comply with all applicable laws and regulatory guidelines. Accordingly, this policy sets forth the requirements for the effective identification, assessment, and management of these risks.

4 Terms

4.1 Third Party

The term third party broadly covers similar terms such as vendor, supplier, providers, and the like. The term third party relates to any person, independent consultant, or form of a legal entity, including but not limited to: vendors, service providers, suppliers, processors, business partners, marketers, or other third parties, with whom (Company) contracts for purposes of obtaining products or services, or who collaborate with (Company) in providing products and services in the marketplace.

4.2 Third-Party Risk Management and Oversight

Third-Party Risk Management is the formalized process of identifying, assessing, and mitigating risks presented to (Company), its employees, investors, and customers due to the improper supervision or mismanagement of the following: data, operations, compliance, and financial condition concerning those external parties with whom (Company) has a relationship. The term Third-Party Risk Management (hereinafter referred to as TPRM), is also inclusive of all reporting, governance, and oversight activities necessary to ensure the safe and sound engagement with (Company)’s third parties. 

5. Scope

TPRM applies to all business relationships between a third party and (Company) by contract or otherwise.

All (Company) employees, independent contractors, and consultants are subject to this Policy. As are other entities, engaging third parties for the Company's direct or indirect benefit, third parties with whom they contract.

5.1 Third Parties Not in Scope Under This Policy

The following third-party relationships have been excluded from this Policy.

a)    Relationships with Customers
b)    Relationships with Investors
c)    Relationships with Employees
d)    Relationships with public utility providers
e)    Relationships with emergency services such as police or fire departments
f)    Relationships with government agencies, taxing authorities, regulatory bodies, and courts

5.2 Pre Existing Third-Party Relationships

It is the responsibility of (Company) Senior Management and the Board of Directors to ensure compliance with this Policy regarding third-party relationships maintained by (Company). It is possible that certain existing third-party relationships (and contracts) do not comply with all policy aspects. However, (Company) is obligated to renegotiate, to the extent possible, any contract terms and conditions to existing third-party contracts to comply with this policy and the related processes. Renegotiation shall occur at the first potential and reasonable opportunity (i.e., contract negation.) 

6. Third-Party Risk Management Oversight

Senior Management and the Board are ultimately accountable for the TRPM policy, program, and processes' oversight and effectiveness. Senior Management and the Board of Directors ensure that the TPRM program operates according to applicable federal and state laws, rules, regulations, internal policies, and procedures. They achieve this through the following:

6.1 Policy Management and Approval

Senior Management and the Board initially approve and oversee the Third-Party Risk Management and Oversight Policy and annually review and, if necessary, update the Policy. 

6.2 Approval of Critical Third Parties

Senior Management and the Board, or their designated committee, are responsible for the decision to approve the addition or termination of third-party relationships considered critical to (Company). Such approvals are mandatory in advance of final contract execution with any material third party.

6.3 Periodic Review of Critical Third Parties

Senior Management and the Board or their designated committee shall periodically review third parties considered critical to (Company)'s operations. They must consider the related risk assessments monitoring, compliance, business continuity, financial health, and overall performance of those material third parties. 

6.4 Staffing and Resources

Senior Management shall allocate sufficient qualified staff (internal or augmented) to provide the necessary oversight and monitoring of significant third-party relationships. Sufficient resource capacity is maintained to execute essential TPRM processes effectively, especially those requiring specialized expertise. And to ensure all critical and high-risk rated third-party relationships are assessed, monitored, and managed commensurate with the product or service's risk.

6. Approach to Third-Party Risk Management

(Company) adheres to the principles of the TPRM Lifecycle to effectively identify, assess, manage, and monitor risks throughout a third-party relationship. This approach is considered a best practice and enables robust TPRM. A strong foundation of governance supports this lifecycle. 

(Company) aims to develop, implement, and maintain effective TPRM processes and governance structures that reflect best practices and regulatory requirements. Application of the lifecycle applies to all third-party activities and relationships, but the extent and scope required for any third-party depends on various factors. (Company)'s risk identification and management processes consider the nature of the third-party relationship, the complexity and magnitude of the activity provided, and the risks associated with the third-party relationship. Risk identification, assessment, and monitoring are appropriately scaled and commensurate with the risk.

7. Third-Party Risk Governance 

The success and sustainability of (Company)’s TPRM program is dependent on effective governance. Effective governance involves key elements such as accountability, oversight, documentation, reporting, and independent reviews. 

a)    Accountability is necessary for ensuring all parties involved in the TPRM program take responsibility for their actions. It is critical to have clear roles and responsibilities defined for everyone involved to avoid confusion and ensure each person is accountable for their designated tasks.
b)    Oversight is required so all activities are carried out in accordance with the established policies and procedures, and complies with all requirements, rules, and regulatory expectations. 
c)    Documentation is necessary for ensuring all activities are documented and recorded accurately. This documentation can be used to track progress, identify gaps, and demonstrate compliance with regulatory requirements.
d)    Reporting is essential for providing relevant information to stakeholders, including Senior Management, Board members, and regulators. This information can be used to make informed decisions and ensure the program is meeting its objectives.
e)    Independent reviews are necessary to ensure the program is operating effectively and efficiently. An independent review provides an objective assessment of the program's strengths and weaknesses, identifies areas for improvement, and helps ensure the program is aligned with best practices and regulatory requirements. 

7.1 Oversight

Senior Management and the Board are ultimately accountable for the TPRM policy, program, and processes oversight and effectiveness. Senior Management and the Board of Directors ensure the TPRM program operates according to applicable federal and state laws, rules, regulations, internal policies, and procedures. They achieve this through the following:

7.1.1 Policy Management and Approval

Senior Management and the Board initially approve and oversee the Third-Party Risk Management and Oversight Policy and annually review and, if necessary, update the Policy. 

7.1.2 Approval of Critical Third Parties 

Senior Management and the Board, or their designated committee, are responsible for the decision to approve the addition or termination of third-party relationships considered critical to (Company). Such approvals are mandatory in advance of final contract execution with any material third party.

7.1.3 Periodic Review of Critical Third Parties

Senior Management and the Board or their designated committee shall periodically review third parties considered critical to (Company)'s operations. They must consider the related risk assessments monitoring, compliance, business continuity, financial health, and overall performance of those material third parties. 

7.1.4 Staffing and Resources

Senior Management shall allocate sufficiently qualified staff (internal or augmented) to provide the necessary oversight and monitoring of significant third-party relationships. Sufficient resource capacity is maintained to execute essential TPRM processes effectively, especially those requiring specialized expertise. And to ensure all Critical and High-Risk rated third-party relationships are assessed, monitored, and managed commensurate with the product or service's risk.

7.2 Accountability: Roles and Responsibilities

7.2.1 The Board of Directors

The Board of Directors is accountable for ensuring the effectiveness, safety, and soundness of TPRM, executed through the following activities:

a)    Confirming that risks related to third-party relationships are managed in a manner consistent with (Company)’s strategic goals and risk appetite
b)    Approving the policies that govern TPRM
c)    Approving, or delegating to, an appropriate committee reporting to the Board, approval of contracts with third parties that involve critical activities
d)    Reviewing the results of Management's ongoing monitoring of third-party relationships involving critical activities
e)    Confirming Management takes appropriate actions to remedy significant deterioration in performance or address changing risks or material issues identified through ongoing monitoring
f)    Reviewing results of periodic independent reviews of the TPRM process

7.2.2 Senior Management

Senior Management is accountable for executing and implementing TPRM strategies and policies across the organization. Management is also responsible for ensuring organizational structures, management, and staffing (level and expertise) are in place to properly manage third-party risk and comply with all legal and regulatory requirements. Furthermore, Senior Management is accountable for the following:

a)    Developing and implementing (Company)’s TPRM process
b)    Confirming (Company) has an appropriate system of internal controls and regularly tests the controls to manage risks associated with third-party relationships
c)    Confirming (Company)’s compliance management system is appropriate to the nature, size, complexity, and scope of its third-party business arrangements
d)    Confirming appropriate due diligence and ongoing monitoring are conducted on third parties
e)    Presenting results to the Board when making recommendations to use third parties that involve critical activities
f)    Escalating significant issues to the Board
g)    Reviewing and approving contracts with third parties
h)    Confirming third parties comply with (Company)’s policies and reporting requirements