Regulators Clarify Supervision of Community Banks' Ties to Core Service Providers
The Federal Reserve Board, the FDIC, and the OCC issued a joint statement clarifying how they conduct risk-based supervision of community banking organizations' relationships with core service providers.
In the statement, the agencies said these relationships are essential to the safe and sound operations of community banks. They added that certain core provider business practices and market dynamics may pose obstacles to a bank's ability to identify, assess, and address the attendant risks.
The statement identified three factors the agencies will weigh in supervisory allocation decisions regarding core provider examinations: transparency, contract features, and technology. Transparency covers a provider's willingness to share due diligence information, use of measurable service level agreements, disclosure of security incidents, and billing clarity. Contract features cover provisions that make it difficult for a bank to exit a relationship or add supplemental providers, including opaque pricing, extensive back-billing windows, and unsupported deconversion fees. Technology covers a provider's investment in up-to-date systems, management of end-of-life assets, and operational resilience. The statement follows the OCC's November 2025 request for information on the same topic (see prior coverage).
The agencies said they may bring appropriate actions against core providers, the community bank, or both, under their statutory authorities. Among other bases, they said they may have a reasonable basis to determine that certain core providers qualify as institution-affiliated parties under Federal Deposit Insurance Act Section 3 ("Definitions"), as persons who participate in the conduct of the affairs of an insured depository institution.
The regulators added that bringing actions against a core provider does not eliminate or reduce a community bank's own responsibility for ensuring its activities are consistent with safe and sound banking practices and comply with applicable law, whether or not they are outsourced.