OCC Issues Bulletin to Banks on Risk Management Guidelines for Third-Party Relationships

The Office of the Comptroller of the Currency (OCC) late last week issued a lengthy bulletin designed to provide “guidance to national banks and federal savings associations (collectively, banks) for assessing and managing risks associated with third-party relationships.”

The OCC said it expects a bank to practice effective risk management regardless of whether the bank performs the activity internally or through a third party. “A bank’s use of third parties does not diminish the responsibility of its board of directors and senior management to ensure that the activity is performed in a safe and sound manner and in compliance with applicable laws,” the bulletin noted.

Highlights of the guidance provided by OCC include:

• A bank should adopt risk management processes commensurate with the level of risk and complexity of its third-party relationships.
• A bank should ensure comprehensive risk management and oversight of third-party relationships involving critical activities.
• An effective risk management process throughout the life cycle of the relationship include
• • plans that outline the bank’s strategy, identify the inherent risks of the activity, and detail how the bank selects, assesses, and oversees the third party.
  • proper due diligence in selecting a third party.
  • written contracts that outline the rights and responsibilities of all parties.
  • ongoing monitoring of the third party’s activities and performance.
  • contingency plans for terminating the relationship in an effective manner.
  • clear roles and responsibilities for overseeing and managing the relationship and risk management process.
  • Documentation and reporting that facilitates oversight, accountability, monitoring, and risk management.
  • Independent reviews that allow bank management to determine that the bank’s process aligns with its strategy and effectively manages risks.

The bulletin drills down on many of those points and provides additional resources for guidance on a wide range of risk management issues. The OCC specifically referenced its July 2013 statement on debt sales and collection relationships for banks seeking ARM guidance.

Editor’s Note: We will be exploring in depth the concept of OCC-directed bank rules in the ARM industry at insideARM.com’s Large Market Participant Summit on January 23-24, 2014 in Washington, D.C. in a session titled “Managing vendor oversight with confidence.”