On October 30, 2013, the Office of the Comptroller of the Currency (OCC) issued new guidance on risks presented by third-party relationships, entitled “Third-Party Relationships: Risk Management Guidance” (“2013 Bulletin”). In the 2013 Bulletin, the OCC expresses its concern that the quality of bank risk management practices has not kept pace with the complexity of third-party relationships. According to the OCC, banks are expected to engage in “more comprehensive and rigorous oversight and management” of third-party relationships, particularly where the third party is involved with “critical activities.”

The 2013 Bulletin rescinds earlier OCC guidance issued in 2001, entitled “Third-Party Relationships: Risk Management Principles” (“2001 Bulletin”). Notably, the 2013 Bulletin provides considerably more detail than the 2001 Bulletin on the OCC’s expectations for bank contractual relationships with, and oversight responsibilities for, third parties. The OCC’s new third-party guidance is a strong signal of the increased regulatory scrutiny that banks will encounter in their use of third parties as service providers.