What provisions should a sponsor bank consider in its contract with a fintech or other third party?

A sponsor bank should consider contract provisions that support effective risk management and oversight and that set out what both the bank and the third party must do. The interagency third-party risk guidance treats these as factors to weigh, and the bank may tailor the detail to the risk and complexity of the relationship.

What the guidance says:

• If negotiations are difficult, including when the bank has limited negotiating power, the bank should understand the resulting limitations and consequent risks. It may check whether the contract still meets its needs, whether it adds risk, and whether residual risks are acceptable. If the contract is unacceptable, it may consider other third parties or doing the activity in-house, and it may gain an advantage by negotiating as a group with other organizations.
• Depending on risk and complexity, typical factors include: nature and scope of the arrangement; performance measures; responsibilities for providing, receiving and retaining information; the right to audit and require remediation; responsibility for compliance with applicable laws; costs and compensation; ownership and license; confidentiality and integrity; operational resilience and business continuity; indemnification and limits on liability; insurance; dispute resolution; customer complaints; subcontracting; foreign-based third parties; default and termination; and regulatory supervision.
• The bank remains responsible for conducting its activities in compliance with applicable laws, and using a third party does not abrogate that.

In practice:

• Data and regulators: address the bank's timely access to its data, how data and documentation may be shared with regulators, and notice to the bank of compliance lapses, enforcement actions, regulatory proceedings, or significant changes such as use of subcontractors.
• Breaches: specify when and how the third party will disclose security breaches or unauthorized intrusions in a timely manner.
• Continuity and exit: address continuation of the activity if the third party's operations are disrupted, and consider transfer of accounts, data or activities to another provider without penalty on bankruptcy, failure or interruption. Provide for timely return or destruction of the bank's data, and termination without penalty if formally directed by its primary federal banking regulator.
• Complaints: say who responds to customer complaints and inquiries, and what information or prompt notice the bank receives.
• Supervision: state that the third party's performance of activities for the bank is subject to regulatory examination and oversight, including retention of and access to relevant documentation (guidance, Regulatory Supervision).
• Audit: consider periodic, independent audits of the third party and relevant subcontractors, consistent with risk.

Escalation and review:

• For higher-risk activities, including critical activities, the board should be aware of the contract and may approve it or delegate approval. Legal counsel review may also be warranted.
• Review executed contracts periodically, and consider renegotiating if new risks are identified.

For AML and sanctions program duties, check separately how the contract allocates them.

Sources

1. Federal Register document 2023-12340: https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management

This answer is general information, not legal advice. Forteris is not a law firm.