VENDOR10
Third-Party Risk Management, Compliance Standards
After frequently citing third-party relationships and outsourcing as worrisome risks, the banking agencies have now finalized guidance first proposed in 2021 to govern them. The new standards are what the agencies describe as principles-based guidance on life-cycle management of third-party relationships, but the sum total of the steps banks are to take and the scale of relationships covered at banks of all sizes may result in a significant reduction of reliance on third parties for strategic services and/or “partnerships” akin to those with fintech companies common to smaller national banks. Conversely, nonbanks now at greater legal and reputational risk may reduce their exposure to banks or even cease providing services to some or all regulated companies.