Third-Party Risk Management Guidance, Regulations & Standards

Jurisdiction: Global

This international treaty regulates the movement of hazardous waste between countries and aims to minimize its generation and ensure its environmentally sound management.

Read the Convention  

Jurisdiction: Canada

CEPA is a federal law that aims to prevent pollution, protect the environment, and manage toxic substances. It addresses various aspects such as air and water pollution, hazardous substances, and waste management.

Read the Act  

Jurisdiction: Canada

This legislation sets out the process for conducting environmental assessments of major projects to identify potential environmental impacts and determine appropriate mitigation measures.

Read the Act  

The Clean Air Act of 1963 as defined in U.S. Code Title 42, Chapter 85, Subchapter I, Part A, § 7412 and § 7420 designates what is a hazardous air pollutant, how to dispose of it and what are the penalties for non-compliance with the Environmental Protection Agency’s (EPA) Standards.

Read the Act

Jurisdiction: United States

The CWA regulates water pollution from point and non-point sources. It includes provisions for permitting, standards, and enforcement.

Read the Act  

Jurisdiction: Europe

Directive 2011/92/EU defines the environmental impact assessment (EIA) process which ensures that projects likely to have significant effects on the environment are made subject to an assessment, prior to their authorisation.

Read the Directive

Jurisdiction: Singapore

The EPMA is Singapore’s main environmental legislation. It covers a range of environmental concerns such as pollution control, waste management, and the conservation of nature and biodiversity.

Read the Act

Jurisdiction: Europe

This cap-and-trade system sets a limit on greenhouse gas emissions from various industries in the European Union and allows companies to trade emission allowances.

Read the Directive  

Jurisdiction: United Kingdom

The Environmental Protection Act (EPA) in the United Kingdom is a significant piece of legislation that addresses various environmental concerns.

Read the Act

ISO 14001:2015 sets out the criteria for an environmental management system applicable to any industry.

Visit the standard

Jurisdiction: United States

This law requires federal agencies to consider the environmental impact of their actions and involve the public in decision-making through environmental assessments and impact statements.

Read the Act  

Jurisdiction: United States

This standard requires employers to provide information about hazardous chemicals in the workplace and ensure proper labeling, training, and access to safety data sheets.

Read the Standard  

Jurisdiction: United States

The RCRA regulates hazardous waste from generation to disposal. It includes provisions for permitting, standards, and enforcement.

Read the Act  

Jurisdiction: Europe

The SFDR is a European regulation that requires companies to disclose their environmental impact.

Read the Act  

Jurisdiction: Global

The TCFD is a voluntary framework that companies can use to disclose their climate-related risks and opportunities.

Read the Recommendations

Jurisdiction: United States

The TSCA regulates the manufacture, use, and disposal of toxic substances. It includes provisions for testing, labeling, and reporting.

Read the Act

Jurisdiction: Japan

The primary objective of the law is to protect the environment, by recognizing it as our essential life-support system to be passed on to future generations.

Read the Law  

Jurisdiction: Global

This international treaty aims to stabilize greenhouse gas concentrations in the atmosphere and mitigate climate change through voluntary country commitments, including the Paris Agreement.

Read the Convention   

Jurisdiction: Europe

The Water Framework Directive 2000/60/EC is an EU directive which commits European Union member states to achieve good qualitative and quantitative status of all water bodies

Read the Directive  

Enterprises are required to conduct a risk analysis to identify any human rights and environment-related risks or violations of a human rights-related or environment-related obligation.

Read the Act

Highlights

Jurisdiction: Global

This standard provides guidance on how businesses and organizations can operate in a socially responsible way, including respect for human rights. It emphasizes the importance of due diligence, which includes understanding the social impacts of an organization’s activities and business relationships.

Read the Guidance  

Jurisdiction: Europe

On February 23, the European Commission released a draft regulation on human rights and environmental due diligence. The draft regulation requires large EU companies, and some non-European companies doing significant business in Europe, to assess their actual and potential human rights and environmental impacts throughout their operations and down their supply chains.

Read the Directive

Jurisdiction: Global

The GRI Standards provide a framework for sustainability reporting, which includes reporting on human rights issues. They include several standards specifically related to human rights, including GRI 412: Human Rights Assessment, which encourages organizations to identify and assess the human rights impacts of their operations and supply chains.

Read the Standards

Jurisdiction: Global

The OECD Guidelines include a chapter on human rights which stipulates that enterprises should respect human rights, which means they should avoid infringing on the human rights of others and should address adverse human rights impacts with which they are involved. This includes the human rights impacts associated with their business relationships, such as suppliers and other partners.

Read the Guidelines  

The California Transparency in Supply Chains Act of 2010 requires companies subject to the law to disclose information regarding their efforts to eradicate human trafficking and slavery within their supply chains on their website or, if a company does not have a website, through written disclosures.

Read the Act

Title VII of the Civil Rights Act of 1964 (Pub. L. 88-352) & The Civil Rights Act of 1991 (Pub. L. 102-166) prohibits an employer with fifteen or more employees from discriminating on the basis of race, national origin, gender, or religion. Companies will want to ensure that their third parties are in compliance with this regulation.

Read the Act

The Modern Slavery Act of 2015 gives UK law enforcement the tools to fight slavery, ensure perpetrators receive suitably severe punishment and protect victims of these crimes. Companies subject to the law are expected to explain the steps the organization has taken during the previous financial year to ensure that slavery and human trafficking are not taking place in any of its supply chains and in any part of its own business.

Read the Act

Jurisdiction: Global

The UNGPs were endorsed by the UN Human Rights Council in 2011. They provide a global standard for preventing and addressing the risk of adverse human rights impacts linked to business activities. The Principles provide a roadmap for businesses to “know and show” that they respect human rights in their own operations and through their business relationships, which includes their supply chains.

Read the Act  

Jurisdiction: Global

Adopted by the United Nations General Assembly in 1948, the UDHR sets out the fundamental human rights and freedoms to which all individuals are entitled, regardless of nationality, race, religion, gender, or other status. It serves as a foundation for subsequent human rights instruments.

Read the Act

Wages and the Fair Labor Standards Act (FLSA) and the Equal Pay Act (EPA) of 1963 (Pub. L. 88-38) establishes minimum wage, overtime pay, record keeping, and youth employment standards. Companies will want to ensure that their third parties are in compliance with this regulation.

Read the Act

“Outsourcing has the potential to transfer risk, management and compliance to third-parties who may not be regulated, and who may operate offshore.”

“Regulated entities can mitigate these risks by taking steps (as discussed in the principles) to: draw up comprehensive and clear outsourcing policies, establish effective risk management programmes, require contingency planning by the outsourcing firm, negotiate appropriate outsourcing contracts, and analyse the financial and infrastructure resources of the service provider.”

Read the full guidance

The document emphasizes that banks should have a comprehensive understanding of the operational risks associated with outsourcing arrangements and ensure that effective risk management policies and practices are in place to manage the risk in outsourcing activities.

“While recourse to entities such as, but not limited to third-party service providers can help manage costs, provide expertise, expand product offerings, and improve services, it also introduces risks that management should address. The board of directors and senior management are responsible for understanding the operational risks associated with outsourcing arrangements and ensuring that effective risk management policies and practices are in place to manage the risk in outsourcing activities.”

Read the full guidance

Source Regulation

In 2014, the CBRC issued Guidelines on Internal Control of Commercial Banks, which included a provision for outsourcing controls.

“Commercial banks should establish and improve an outsourcing management system with defined organizational framework and responsibility and conduct a full risk assessment on outsourcing business at least once a year. Functions that involve development strategy, risk management, internal auditing and other core competence shall not to be outsourced.”

The document discusses the importance of monitoring third-party ICT service providers to ensure the digital resilience of financial entities. It emphasizes the need for harmonized contractual elements and the use of standard contractual clauses for cloud computing services.

“Critical ICT third-party service providers should be subject to a Union Oversight Framework to promote convergence and efficiency in relation to supervisory approaches to ICT third-party risk to the financial sector, strengthen the digital operational resilience of financial entities which rely on critical ICT third-party service providers for the performance of operational functions, and thus to contribute to preserving the Union’s financial system stability, the integrity of the single market for financial services.”

Read the full guidance

Source Regulation

Main Highlights

In early 2019, The European Banking Authority (EBA) published its revised Guidelines on outsourcing arrangements setting out specific provisions for the governance frameworks of all financial institutions within the scope of the EBA’s mandate with regard to their outsourcing arrangements and related supervisory expectations and processes.

“Each financial institution’s management body remains responsible for that institution and all of its activities, at all times; to this end, the management body should ensure that sufficient resources are available to appropriately support and ensure the performance of those responsibilities, including overseeing all risks and managing the outsourcing arrangements. Outsourcing must not lead to a situation in which an institution becomes an ‘empty shell’ that lacks the substance to remain authorised.”

Read the full guidance

The guidelines provide a comprehensive framework for financial institutions to manage information and communication technology (ICT) and security risks. They cover various aspects of technology risk management, including the management of third-party services, system availability, system recoverability, cyber security operations, and IT project management.

“Financial institutions should test their BCPs periodically. In particular, they should ensure that the BCPs of their critical business functions, supporting processes, information assets and their interdependencies (including those provided by third parties, where applicable) are tested at least annually, in accordance with paragraph 89.”

Read the full guidance

Source Regulation

Main Highlights

The FDIC issued a clarification in 2014 regarding its supervisory approach to institutions establishing account relationships with third-party payment processors (TPPPs). The FDIC stated that as part of its regular safety and soundness examination activities, it reviews and assesses the extent to which institutions having account relationships with TPPPs follow the outstanding guidance.

“The focus of the FDIC’s supervisory approach to institutions establishing account relationships with TPPPs is to ensure institutions have adequate procedures for conducting due diligence, underwriting, and ongoing monitoring of these relationships. When an institution is following the outstanding guidance, it will not be criticized for establishing and maintaining relationships with TPPPs. It is the FDIC’s policy that insured institutions that properly manage customer relationships are neither prohibited nor discouraged from providing services to any customer operating in compliance with applicable law.”

Read the full guidance

Source Regulation

Financial institutions should establish and maintain effective vendor and third-party management programs because of the increasing reliance on nonbank providers. Financial institutions must understand the complex nature of arrangements with outside parties and ensure adequate due diligence for the engagement of the relationships and ongoing monitoring.

Read the full guidance

Source Regulation

On June 6, 2023, the Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System (FRB), and the Office of the Comptroller of the Currency (OCC) issued final guidance on managing risks associated with third-party relationships. The guidance provides principles that support a risk-based approach to third-party risk management for all stages in the life cycle of third-party relationships.

“Responsibilities to ensure that activities are performed in a safe and sound manner and in compliance with applicable laws and regulations, including but not limited to those designed to protect consumers (such as fair lending laws and prohibitions against unfair, deceptive or abusive acts or practices) and those addressing financial crimes.” (Page 1)

“Regardless of a banking organization’s approach, a key element is to ensure that the banking organization’s risk management processes for third-party relationships are commensurate with the level of risk and complexity of its third-party relationships.” (Page 7)

Read the full guidance

Source Regulation

The Federal Deposit Insurance Corporation (FDIC) issued a revised guidance in 2012, addressing potential risks associated with relationships with third-party entities that process payments for telemarketers, online businesses, and other merchants. The guidance emphasizes that these relationships can pose increased risk to institutions and require careful due diligence and monitoring.

“Financial institutions should ensure that their contractual agreements with payment processors provide them with access to necessary information in a timely manner. These agreements should also protect financial institutions by providing for immediate account closure, contract termination, or similar action, as well as establishing adequate reserve requirements to cover anticipated charge backs.”

Read the full guidance

Source Regulation

On April 7, 2014, the FDIC re-issued three documents related to technology outsourcing as an informational resource for community banks. These documents provide insights on how to select service providers, draft contract terms, and oversee multiple service providers when outsourcing for technology products and services.

“Fintech partnerships can enhance a bank’s capacity to serve its customers, improve operational efficiencies, and keep pace with technological innovation. However, these partnerships also present unique challenges and risks, particularly for community banks.”

“Clear definitions of accountability are important to ensure that both the bank and the service provider understand their roles and responsibilities for each service level requirement. Incentives and penalties can play a key role in establishing accountability.”

Read the full guidance

Source Regulation 1

Source Regulation 2

Source Regulation 3

This section of the Federal Financial Institutions Examinations Council’s (FFIEC) IT Examination Handbook focuses specifically on the business continuity risks created by the use of third parties. In particular, the document says that financial services firms must be responsible for the business continuity risks posed by their third-parties. The document also addressed cyber-resilience issues.

“Many financial institutions depend on third-party service providers to perform or support critical operations. These financial institutions should recognize that using such providers does not relieve the financial institution of its responsibility to ensure that outsourced activities are conducted in a safe and sound manner. The responsibility for properly overseeing outsourced relationships lies with the financial institution’s board of directors and senior management. An effective third-party management program should provide the framework for management to identify, measure, monitor, and mitigate the risks associated with outsourcing.”

Read Appendix J in full

The Outsourcing Technology Services Booklet provides guidance for financial institutions on outsourcing technology services to third-party service providers. It covers topics such as board and management responsibilities, risk management, risk assessment, service provider selection, contract issues, ongoing monitoring, business continuity planning, information security, and outsourcing to foreign service providers. The booklet includes examination procedures, laws, regulations, and guidance, as well as appendices on foreign-based third-party service providers and managed security service providers.

“When outsourcing to a subsidiary or affiliate is considered, management must assure that the components outlined above evidence an arms-length transaction. An arrangement between a financial institution and an affiliate or subsidiary should be on terms that are substantially the same, or at least as favorable to the institution, as those prevailing at the time for comparable transactions with a non-affiliated third party.” (Page 11)

Read the full guidance

Source Regulation

Published in July 2014, this document provides a list of questions for financial services firms to consider when evaluating or engaging with third parties for technology services which are critical to firms’ operations. The questions cover the decision to use an outsource provider, the selection of a provider, and ongoing maintenance of the relationship with the provider, among other issues.

Read the guidance

A survey, released in November 2018, of 296 firms by the FCA highlighted key areas of regulatory development going forward. Firms acknowledged challenges in managing their third parties. For example, third-party issues, such as an IT failure at an important supplier, accounted for 15% of the operational incidents reported to the FCA — this was the second highest root cause. As well, only 66% of large firms and 59% of smaller firms understood their third-parties’ response and recovery plans.

Read the paper

Published in July 2018 after a consultation period, the guidance includes a list of areas that UK-based financial services firms should consider when engaging with third-parties to provide IT services. The FCA wants firms to consider international standards, legal and regulatory obligations, risk management, the oversight of the service provider, data security, access to the third-party’s premises, business continuity, and other issues.

Read the guidance

SYSC 8.1 Outsourcing sets out requirements for firms to manage the risks associated with outsourcing activities, including those involving third-party service providers.

“Outsourcing of important operational functions must not impair materially the quality of a firm’s internal control and the ability of the FCA to monitor the firm’s compliance with all obligations under the regulatory system.”

Read the full guidance

Source Regulation

SYSC 13.9 Outsourcing is a regulatory requirement under the FCA rules, which aims to ensure effective risk management when firms outsource operational activities to third-party service providers.

“Outsourcing may affect a firm’s exposure to operational risk through significant changes to, and reduced control over, people, processes and systems used in outsourced activities.”

Read the full guidance

Source Regulation

The advisory emphasizes that while third-party payment processors can enhance services and make transactions more cost-effective, they can also make the payment system vulnerable to money laundering, identity theft, fraud schemes, and illicit transactions. Therefore, financial institutions must exercise proper due diligence before entering into a relationship and set up controls to monitor performance.

“There are potential risks associated with relationships with third-party entities, in particular foreign-located payment processors that process payments for telemarketers, online businesses, and other merchants. These relationships can pose increased risk to institutions and may require careful due diligence and monitoring.”

Read the full guidance

Source Regulation

The Act outlines the responsibilities and obligations of the government and its entities when entering into contracts or agreements with third parties. It also provides guidelines for the management and disbursement of public funds, including the procurement of goods and services from third parties.

“A department may enter into a contract for the provision of any work, the rendering of any service or the supply of any articles, materials or equipment that are required for the management, administration, operation or program delivery of the department.”

Source Regulation

Main Hightlights

The guidelines emphasize the need for financial institutions to conduct thorough risk assessments of their third-party service providers, ensure these providers have robust business continuity plans in place, and regularly test and review these plans. They also recommend including specific business continuity-related provisions in contracts with third-party service providers. These measures aim to mitigate the risk of service disruptions from third-party providers and ensure a coordinated response to any potential crises.

“The FI should also put in place plans and procedures to address any unforeseen disruption, failure or termination of third-party arrangements to minimize the impact of such adverse events on the continuity of its critical business services.”

Read the full guidance

Source Regulation

Issued in 2016, the Outsourcing Guidelines provide expanded guidance to the industry on prudent risk management practices for outsourcing, including cloud services.

Read the full guidance

The guidelines provide a comprehensive framework for financial institutions (FIs) to manage technology risks. They cover various aspects of technology risk management, including the management of third-party services, system availability, system recoverability, cyber security operations, and IT project management.

“A well-defined vetting process should be implemented for assessing third parties’ suitability in connecting to the FI via APIs, as well as governing third party API access. The vetting criteria should take into account factors such as the third party’s nature of business, cyber security posture, industry reputation and track record.”

Read the full guidance

Source Regulation

The purpose of this notice is to provide guidelines for banks when outsourcing any operational function to a service provider, particularly when the outsourced function will be performed by the service provider outside Singapore and involves the disclosure of customer information. Banks in Singapore that rely on the exception provided in paragraph 3 of Part II of the Third Schedule of the Banking Act are required to comply with the conditions set out in the Appendix to this Notice.

“In all outsourcing arrangements involving the disclosure of customer information to the service provider, banks shall ensure that the confidentiality of customer information is protected. In selecting a service provider, except when the service provider is the Head Office or the parent bank, banks are to take appropriate due diligence measures, including the assessment of the track record, reputation, financial soundness of the service provider and its ability to safeguard the confidentiality of information entrusted to it.”

Read the full guidance

Source Regulation

The Supervisory Letter provides guidance to credit unions on managing third-party relationships. The letter emphasizes that while third-party relationships can enhance services provided to members and make programs more cost-effective, they can also result in financial stresses due to unanticipated costs, legal disputes, and asset losses. Therefore, credit unions must exercise proper due diligence before entering into a relationship and set up controls to monitor performance.

“Credit union officials are responsible for planning, directing, and controlling the credit union’s affairs. To fulfill these duties, the officials should require a due diligence review prior to entering into any arrangement with a third party.”

Read the full guidance

The letter from the National Credit Union Administration (NCUA) provides clarity about the existing authority of federally insured credit unions (FICUs) to establish relationships with third-party providers that offer digital asset services to their members, provided certain conditions are met.

“A FICU’s relationship with third parties offering these services and related technologies will be evaluated by the NCUA in the same manner as all other third-party relationships. This includes a FICU exercising sound judgment and conducting the necessary due diligence, risk assessment, and planning when choosing to introduce or bring together an outside vendor with its members. FICUs should establish effective risk measurement, monitoring, and control practices for such third-party arrangements.”

Read the full guidance

The Supervisory Letter provides guidance to credit unions on managing third-party relationships. The letter emphasizes that third-party relationships, when properly managed and controlled, can offer a wide range of benefits to credit unions and their members, including expertise, economies of scale, and access to new members. However, these relationships also present potential risks that credit unions must carefully consider and manage.

“Credit unions outsourcing functions without the appropriate level of due diligence and oversight may be taking on undue risk. Ultimately, credit unions are responsible for safeguarding member assets and ensuring sound operations irrespective of whether or not a third party is involved.”

Read the full guidance

This state-level set of regulations focusing on cyber risk and cybersecurity became effective in 2017. Among other requirements, it asks covered financial services firms to perform risk assessments and due diligence on third-parties’ cybersecurity practices.

Read the full guidance

The bulletin provides guidance to national banks on managing the risks that may arise from their outsourcing relationships with foreign-based third-party service providers. It also addresses the need for a national bank to establish relationships with foreign-based third-party service providers in a way that does not diminish the ability of the OCC to access, in a timely manner, data or information needed to effectively supervise the bank’s operations.

“As with domestic outsourcing arrangements, the board of directors and senior management are responsible for understanding the risks associated with the bank’s outsourcing relationships with foreign-based service providers and ensuring that effective risk management practices are in place.”

“Specifically, before a national bank contracts for the services of a foreign-based service provider, it should properly assess the associated risks and exercise appropriate due diligence, including careful consideration of contract matters and choice of law and forum provisions. Additionally, the bank should have in place sufficient risk management policies, performance monitoring and oversight processes, expertise, and access to critical information to enable it to properly oversee the risks of the outsourcing relationship, including country and compliance risks.”

Read the full guidance

Source Regulation

In 2017, the OCC issued Bulletin 2017-7 which provides detail into the procedures that may be used during examinations of a bank’s risk management of third-party relationships.

“These procedures are designed to help examiners:

• tailor the examination of each bank commensurate with the level of risk and complexity of the bank’s third-party relationships.
• assess the quantity of the bank’s risk associated with its third-party relationships.
• assess the quality of the bank’s risk management of third-party relationships involving critical activities.
• determine whether there is an effective risk management process throughout the life cycle of the third-party relationship.”

Read the full guidance

In 2021, the OCC issued Bulletin 2021-40 which provides information relating to six common areas of due diligence discussed in existing supervisory guidance. This guide was published by the OCC, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporation (collectively, the agencies) to provide community banks with information that may be relevant when conducting due diligence on financial technology companies.

The guide is designed for community banks. Although the guide discusses community bank relationships with fintech companies, the content may be useful for banks of any size and for other types of third-party relationships.

“Engaging a third party does not diminish a bank’s responsibility to operate in a safe and sound manner and to comply with applicable legal and regulatory requirements, including federal consumer protection laws and regulations, just as if the bank were to perform the service or activity itself.”

“During due diligence, a community bank collects and analyzes information to determine whether third-party relationships would support its strategic and financial goals and whether the relationship can be implemented in a safe and sound manner, consistent with applicable legal and regulatory requirements.”

Read the full guidance

Source Regulation

In 2023, the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency collectively issued a regulatory guidance document that provides a comprehensive framework for banking organizations to manage their third-party relationships.

The document provides a framework for assessing and managing risks associated with third-party relationships. This includes identifying, assessing, and mitigating known and emerging threats and vulnerabilities. Banking organizations with limited resources for security often depend on support from third parties or on security tools provided by third parties to assess information security risks

“Bank management should conduct in-depth due diligence and ongoing monitoring of each of the bank’s third-party service providers that support critical activities.”

“The board of directors and management are responsible for overseeing the banking organization’s risk management processes, maintaining documentation and reporting for oversight accountability, and engaging in independent reviews.”

Read the full guidance

Source Regulation

In 2023, the OCC released comprehensive and specific instructions regarding the management of Third-party Risk Management. This new guidance supersedes all previous instructions. The bulletin aims to assist banks, including national banks and federal savings associations, in evaluating and controlling the risks involved in their partnerships with external entities. A third-party relationship refers to any formal or informal business agreement between a bank and another organization.

“Regardless of a banking organization’s approach, applying a sound methodology to designate which activities and third-party relationships receive more comprehensive oversight is key for effective risk management. It is important for each banking organization to assess risks presented by each of its third-party relationships and tailor its risk management processes accordingly.” (Page 9)

“With respect to commenters focused on steps to limit the burdens of due diligence, including collaboration with other banking organizations and engaging with third parties that specialize in conducting due diligence, the agencies note that such collaborative efforts could be beneficial and reduce burden, especially for community banking organizations, and have made certain clarifying revisions to the guidance in that regard. However, use of any collaborative efforts does not abrogate the responsibility of banking organizations to manage third-party relationships in a safe and sound manner and consistent with applicable laws and regulations (including antitrust laws). It is important for the banking organization to evaluate the conclusions from such collaborative efforts.” (Page 17)

Read the full guidance

Source Regulation

The document titled “Recommendations for the next phase of open banking in the UK” by the Joint Regulatory Oversight Committee provides a roadmap for the future of open banking in the UK, with a focus on improving the ecosystem for third-party providers (TPPs).

“We understand that some firms may be passing on Faster Payments payment statuses to TPPs. We ask all ASPSPs to consider whether the correct processes are in place to provide TPPs with relevant Faster Payments payment status information as soon as it has been received and until a final status for the payment has been reached by end of Q3 2023. This would considerably enhance TPPs’ visibility.”

Read the full guidance

Source Regulation

The document acknowledges that cybersecurity incidents involving third-party service provider vulnerabilities are becoming more frequent. The proposed rules require companies to disclose whether they have policies and procedures to oversee and identify the cybersecurity risks associated with their use of third-party service providers. This includes providers that have access to or have information about the company’s customer and employee data.

“The proposed amendments are intended to better inform investors about cybersecurity incidents and the cybersecurity risk management, strategy, and governance of registrants of all types and sizes which are subject to the Exchange Act reporting requirements.”

Read the full guidance

Source Regulation

Main Highlights

The Bulletin emphasizes that the Consumer Financial Protection Bureau (CFPB) expects supervised banks and nonbanks to manage their relationships with service providers in a way that ensures compliance with Federal consumer financial law.

“The mere fact that a supervised bank or nonbank enters into a business relationship with a service provider does not absolve the supervised bank or nonbank of responsibility for complying with Federal consumer financial law to avoid consumer harm. A service provider that is unfamiliar with the legal requirements applicable to the products or services being offered, or that does not make efforts to implement those requirements carefully and effectively, or that exhibits weak internal controls, can harm consumers and create potential liabilities for both the service provider and the entity with which it has a business relationship. Depending on the circumstances, legal responsibility may lie with the supervised bank or nonbank as well as with the supervised service provider.” (Page 2)

Read the full guidance

Source Regulation

The bulletin provides guidance to covered persons and service providers about the potential for violations of sections 1031 and 1036 of the Dodd-Frank Wall Street Reform and Consumer Protection Act’s prohibition on engaging in unfair, deceptive, or abusive acts or practices (UDAAPs) when assessing phone pay fees.

“Lack of employee monitoring or service provider oversight may lead to misrepresentations or failure to disclose available options and fees. A number of entities have policies and procedures in place requiring phone representatives to disclose all available phone pay options and fees to consumers, including requiring the use of detailed phone scripts. But deviations from call scripts may potentially cause phone representatives to misrepresent the available phone payment options and fees resulting in a consumer being charged a higher fee than otherwise would have been applicable. Entities can reduce the risk of misrepresentations through adequate monitoring.”

Read the full guidance

Source Regulation

“The CFPB recognizes that the use of service providers is often an appropriate business decision for supervised banks and nonbanks. Supervised banks and nonbanks may outsource certain functions to service providers due to resource constraints, use service providers to develop and market additional products or services, or rely on expertise from service providers that would not otherwise be available without significant investment.”

Source Regulation

Issued on August 27, 2021, “SR 21-15 / CA 21-11: Guide for Community Banking Organizations Conducting Due Diligence on Financial Technology Companies” is a resource developed by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency. This guide is intended for banking organizations with $10 billion or less in consolidated assets supervised by the Federal Reserve.

“Understanding a fintech company’s qualifications and strategic direction will help a community bank assess the fintech company’s ability to meet the community bank’s expectations and support a community bank’s objectives.”

“A community bank may evaluate a fintech company’s ability to continue operations through a disruption. Depending on the activity, a community bank may look to the fintech company’s processes to identify, respond to, and protect itself and customers from threats and potential failures, as well as recover and learn from disruptive events.”

Read the full guidance

Source Regulation

This guidance issued by the Federal Reserve in 2023 emphasizes that the scope and degree of due diligence should be commensurate with the level of risk and complexity of the third-party relationship.

“A banking organization’s use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house.”

“For certain relationships, clearly defined performance measures can assist a banking organization in evaluating the performance of a third party. In particular, a service-level agreement between the banking organization and the third party can help specify the measures surrounding the expectations and responsibilities for both parties.”

Read the full guidance

Source Regulation

FACTA is an amendment to the Fair Credit Reporting Act that is intended to help consumers avoid identity theft. Accuracy, privacy, limits on information sharing, and new consumer rights to disclosure are included in the legislation. The Red Flags Rule requires many businesses and organizations to implement a written Identity Theft Prevention Program designed to detect the warning signs – or red flags – of identity theft in their day-to-day operations.

Read the Act

The PCI Security Standards Council is a global forum for the ongoing development, enhancement, storage, dissemination, and implementation of security standards for account data protection.

The PCI DSS is a set of requirements for enhancing security of payment customer account data. It was developed to help facilitate global adoption of consistent data security measures. PCI DSS includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures. The guidance states that third-party service providers are responsible for demonstrating their PCI DSS through an annual assessment or multiple on-demand assessments.

Read the standard

The GLB Act includes provisions to protect consumers’ personal financial information held by financial institutions. There are three principal parts to the privacy requirements: the Financial Privacy Rule, the Safeguards Rule, and pretexting provisions.

Read the Act

HIPAA was enacted in 1996 to improve the efficiency and effectiveness of the health care system. It requires the adoption of national standards for electronic health care transactions and code sets, as well as unique health identifiers for providers, health insurance plans, and employers. The law also incorporates provisions for guarding the security and privacy of personal health information.

Read the Act

This rule, issued in 2013 makes business associates of covered entities directly liable for compliance with certain parts of the HIPAA Privacy and Security Rules’ requirements.

“Organizations and similar organizations, as well as personal health record vendors that provide services to covered entities, shall be treated as business associates; requiring HIPAA covered entities and business associates to provide for notification of breaches of ‘‘unsecured protected health information’’;

“…it is the business associate that must obtain the required satisfactory assurances from the subcontractor to protect the security of electronic protected health information…”

Read the rule

(b)(1) Standard: Business associate contracts and other arrangements. “A covered entity, in accordance with §164.306, may permit a business associate to  create, receive, maintain, or transmit electronic protected health information on the covered entity’s behalf only if the covered entity obtains satisfactory
assurances, in accordance with §164.314(a) that the business associate will appropriately safeguard the information.”

Read the rule

Part of the American Recovery and Reinvestment Act of 2009, the HITECH Act modifies HIPAA by adding new requirements concerning privacy and security for patient health information. It widens the scope of privacy and security protections available under HIPAA, increases the potential legal liability for non-compliance and provides for more enforcement

Read the Act

This policy covers third-party bodily injury or property damage caused by the vendor’s negligence or activities during the course of business.

Read the Act

This primary legislation regulates financial services, including insurance, in the UK. It establishes the regulatory framework for insurance companies, intermediaries, and other financial institutions.

Read the Act

The NAIC is a standard-setting and regulatory support organization consisting of the top insurance regulators from the 50 states, District of Columbia, and five U.S. territories. The NAIC formally adopted the model law in October 2017.

“(1) A Licensee shall exercise due diligence in selecting its Third-Party Service Provider; and
(2) A Licensee shall require a Third-Party Service Provider to implement appropriate administrative,
technical, and physical measures to protect and secure the Information Systems and Nonpublic
Information that are accessible to, or held by, the Third-Party Service Provider.“

Read the model

This Act addresses the utilization of Third Party Administrators by insurance companies, and is thus indirectly related to vendor risk.

Read the Act  

This Act addresses the utilization of Third Party Administrators by insurance companies, and is thus indirectly related to vendor risk.

Read the Act  

The Solvency II Directive is a comprehensive framework for insurance regulation in the EU. It sets out prudential requirements and risk management standards for insurance companies operating within the EU. The directive aims to ensure the financial stability and soundness of insurance undertakings.

Read the Directive

This federal legislation governs the incorporation, organization, and conduct of insurance companies in Canada. It sets out various regulatory requirements and provisions related to the insurance industry.

Read the Act