1. Overview and Background

(Company) (hereinafter referred to as (Company)) uses Third Parties to provide products or services in support of our business operations. Such outsourced relationships may benefit (Company) by reducing costs, improved performance, staff augmentation, increased business competitiveness, access to specific expertise, and established distribution channels. However, Senior Management and the Board of Directors recognize that (Company’s) reliance on third-party relationships presents many risks that must be identified, assessed, and managed. Failure to manage these risks can expose (Company) to financial loss, litigation, or other damages or may even impair (Company) ability to service existing customer relationships or establish new ones.

2. Statement of Purpose

This policy aims to establish standards and guidance relating to (Company)’s management of its third-party relationships and the associated inherent and residual risks presented by those third-party relationships. These risks are present when (Company) engages with third parties to provide products and services directly to (Company) for the benefit of its internal operations, employees, investors, or customers. Furthermore, the (Company) documents the structure for; identifying, assessing, controlling, monitoring, and reporting on risks related to (Company)’s use of third parties per applicable laws, safe and sound business practices, and related supervisory guidance, particularly that of the Final Interagency Guidance from the Board of Governors, the FDIC, and the OCC. 

3. Policy Statement

Relationships with third parties are fundamental to (Company)’s ability to maintain its operations and offer products and services to its employees, customers, and investors. However, (Company)’s use of third parties does not diminish its responsibility to ensure that the activity is performed safely and soundly and complies with applicable law, has established the (Policy Name) (hereinafter referred to as the policy), to formally define the framework, tools, roles, responsibilities, scope, and components, needed for a fully functioning Third-Party Risk Management program. The framework shall comply with all applicable laws and regulatory guidelines. Accordingly, this policy sets forth the requirements for the effective identification, assessment, and management of these risks.

4 Terms

4.1 Third Party

The term third party broadly covers similar terms such as vendor, supplier, providers, and the like. The term third party relates to any person, independent consultant, or form of a legal entity, including but not limited to: vendors, service providers, suppliers, processors, business partners, marketers, or other third parties, with whom (Company) contracts for purposes of obtaining products or services, or who collaborate with (Company) in providing products and services in the marketplace.

4.2 Third-Party Risk Management and Oversight

Third-Party Risk Management is the formalized process of identifying, assessing, and mitigating risks presented to (Company), its employees, investors, and customers due to the improper supervision or mismanagement of the following: data, operations, compliance, and financial condition concerning those external parties with whom (Company) has a relationship. The term Third-Party Risk Management (hereinafter referred to as TPRM), is also inclusive of all reporting, governance, and oversight activities necessary to ensure the safe and sound engagement with (Company)’s third parties. 

5. Scope

TPRM applies to all business relationships between a third party and (Company) by contract or otherwise.

All (Company) employees, independent contractors, and consultants are subject to this Policy. As are other entities, engaging third parties for the Company's direct or indirect benefit, third parties with whom they contract.

5.1 Third Parties Not in Scope Under This Policy

The following third-party relationships have been excluded from this Policy.

a)    Relationships with Customers
b)    Relationships with Investors
c)    Relationships with Employees
d)    Relationships with public utility providers
e)    Relationships with emergency services such as police or fire departments
f)    Relationships with government agencies, taxing authorities, regulatory bodies, and courts

5.2 Pre Existing Third-Party Relationships

It is the responsibility of (Company) Senior Management and the Board of Directors to ensure compliance with this Policy regarding third-party relationships maintained by (Company). It is possible that certain existing third-party relationships (and contracts) do not comply with all policy aspects. However, (Company) is obligated to renegotiate, to the extent possible, any contract terms and conditions to existing third-party contracts to comply with this policy and the related processes. Renegotiation shall occur at the first potential and reasonable opportunity (i.e., contract negation.) 

6. Third-Party Risk Management Oversight

Senior Management and the Board are ultimately accountable for the TRPM policy, program, and processes' oversight and effectiveness. Senior Management and the Board of Directors ensure that the TPRM program operates according to applicable federal and state laws, rules, regulations, internal policies, and procedures. They achieve this through the following:

6.1 Policy Management and Approval

Senior Management and the Board initially approve and oversee the Third-Party Risk Management and Oversight Policy and annually review and, if necessary, update the Policy. 

6.2 Approval of Critical Third Parties

Senior Management and the Board, or their designated committee, are responsible for the decision to approve the addition or termination of third-party relationships considered critical to (Company). Such approvals are mandatory in advance of final contract execution with any material third party.

6.3 Periodic Review of Critical Third Parties

Senior Management and the Board or their designated committee shall periodically review third parties considered critical to (Company)'s operations. They must consider the related risk assessments monitoring, compliance, business continuity, financial health, and overall performance of those material third parties. 

6.4 Staffing and Resources

Senior Management shall allocate sufficient qualified staff (internal or augmented) to provide the necessary oversight and monitoring of significant third-party relationships. Sufficient resource capacity is maintained to execute essential TPRM processes effectively, especially those requiring specialized expertise. And to ensure all critical and high-risk rated third-party relationships are assessed, monitored, and managed commensurate with the product or service's risk.