On September 11, the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) (collectively, the agencies) issued a joint statement addressing how they will approach risk-based supervision of core service providers that support community banking organizations. The statement does not create new regulatory requirements for community banks or core providers directly, but it signals how the agencies intend to allocate supervisory attention and, notably, puts core providers on notice that certain business practices can draw direct examiner scrutiny and even enforcement exposure.

This is the latest example of a theme we have been tracking all year: federal banking regulators calibrating supervisory expectations to the actual risk presented, rather than imposing one-size-fits-all mandates. For example, as we discussed in our April post on the revised interagency model risk management guidance, the agencies emphasized that oversight intensity should scale with a model’s materiality and complexity.

Why Core Providers Are Different

The statement zeroes in on a specific subset of third parties: “core providers” that furnish the critical systems, applications, and infrastructure underlying a community bank’s essential business lines. The agencies describe these relationships as community banks’ “most material, complex, and highest-risk third-party relationships,” since a core platform’s availability, integrity, and security touch nearly every banking operation.

The agencies also acknowledge a market reality that community banks have raised repeatedly: a small number of large providers dominate the core processing market, which limits community banks’ negotiating leverage. That imbalance, the agencies say, makes it harder for community banks to obtain adequate due diligence information, negotiate workable contract terms, or conduct meaningful ongoing monitoring — exactly the elements a sound third-party risk management program requires.

Three Factors Driving Allocation of Supervisory Resources

The agencies identify three categories of core provider practices they will weigh when deciding how to allocate supervisory resources, including the scope and frequency of examinations, what gets included in examination reports shared with client institutions, and whether a provider gets added to the agencies’ service provider examination program:

1. Transparency. Will the core provider share reasonably relevant, timely due diligence information (SOC reports, audit results, penetration testing, PCI DSS/NIST/ISO assessments)? Do contract terms allow a community bank to benchmark the provider against its competitors? Are service level agreements measurable, monitorable, and enforceable? Is the provider forthcoming about operational issues and security incidents? Are billing practices reconcilable to services actually delivered?
2. Contract features. Do contract terms trap community banks in the relationship even when service is inadequate, through opaque pricing or billing, long “back-billing” windows for retroactive charges, undefined or punitive deconversion fees (especially where the provider itself breached the contract or violated law), or restrictions that block unaffiliated vendors from integrating with the core platform?
3. Technology. Is the provider investing in current technology, managing end-of-life/end-of-support assets responsibly, and maintaining demonstrated operational resilience, or is it accumulating security incidents and outages that community banks have little power to prevent?

Providers that fall short on these fronts should expect more supervisory attention.

Enforcement Exposure

The most consequential piece of the statement may be its enforcement discussion. The agencies reiterate that outsourcing does not reduce a community bank’s own responsibility for safety, soundness, and legal compliance. But they go further, stating they may have a reasonable basis to treat certain core providers as “institution-affiliated parties” (IAPs) under the Federal Deposit Insurance Act, on the theory that these providers “participate[] in the conduct of the affairs” of the institution. The agencies point to the operational reality that many core providers run the most central aspects of a community bank’s banking business and often cannot be easily substituted, and conclude that providers meeting this description could be held directly liable for practices or violations tied to the community bank’s operations, using the agencies’ authority under 12 U.S.C. §§ 1818 and 1867.

This is a meaningful shift in tone, for community banks and especially for core providers. It moves core providers from being purely a vendor risk management concern for the community bank to a potential direct supervisory and enforcement target in their own right.