Introduction to OCC Bulletin 2017-43
The Office of the Comptroller of the Currency (OCC) issued Bulletin 2017-43 to provide guidance on third-party risk management for national banks and federal savings associations. This bulletin outlines the principles and expectations for managing risks associated with third-party relationships.
The bulletin emphasizes the importance of a robust risk management framework to identify, assess, and mitigate potential risks. It also highlights the need for banks to establish clear policies and procedures for managing third-party relationships.
Key Components of a Third-Party Risk Management Framework
A effective third-party risk management framework should include several key components, such as risk assessment, due diligence, and ongoing monitoring. Banks should also establish clear policies and procedures for managing third-party relationships, including contract management and termination procedures.
The framework should also include procedures for identifying and assessing potential risks, such as reputational risk, operational risk, and compliance risk. Banks should also consider the potential risks associated with third-party relationships, such as data breaches and cybersecurity threats.
Risk Assessment and Due Diligence
Risk assessment and due diligence are critical components of a third-party risk management framework. Banks should conduct thorough risk assessments to identify potential risks associated with third-party relationships, including the risk of data breaches and cybersecurity threats.
Due diligence should also be conducted to assess the third-party vendor's financial condition, business reputation, and compliance with regulatory requirements. Banks should also consider the vendor's experience and expertise in providing the specific service or product.
Ongoing Monitoring and Termination Procedures
Ongoing monitoring is essential to ensure that third-party vendors are complying with the terms of the contract and regulatory requirements. Banks should establish procedures for regularly reviewing and assessing the performance of third-party vendors.
Termination procedures should also be established to ensure that contracts can be terminated quickly and efficiently in the event of a breach or other material failure. Banks should also consider the potential risks associated with terminating a contract, such as reputational risk and operational disruption.
Regulatory Compliance and Examination
Banks should ensure that their third-party risk management framework is compliant with regulatory requirements, including the OCC's guidelines and expectations. The framework should also be subject to regular examination and review to ensure that it is effective in managing risks.
The OCC may examine a bank's third-party risk management framework as part of its regular examination process. Banks should be prepared to demonstrate the effectiveness of their framework and provide documentation to support their risk management practices.
Frequently Asked Questions
What is the purpose of OCC Bulletin 2017-43?
The purpose of OCC Bulletin 2017-43 is to provide guidance on third-party risk management for national banks and federal savings associations.
What are the key components of a third-party risk management framework?
The key components of a third-party risk management framework include risk assessment, due diligence, and ongoing monitoring.
How often should banks review and assess their third-party vendors?
Banks should regularly review and assess their third-party vendors to ensure that they are complying with the terms of the contract and regulatory requirements.
What are the potential risks associated with third-party relationships?
The potential risks associated with third-party relationships include reputational risk, operational risk, and compliance risk.
Can a bank terminate a contract with a third-party vendor at any time?
A bank can terminate a contract with a third-party vendor, but it should have established procedures for doing so in a way that minimizes potential risks and disruptions.
How does the OCC examine a bank's third-party risk management framework?
The OCC may examine a bank's third-party risk management framework as part of its regular examination process to ensure that it is effective in managing risks.