OCC Releases Guidance on Third-Party Relationships


On October 30, the OCC issued updated risk management guidance for national banks and federal savings associations related to third-party relationships. The banks should:

  • Develop a plan that outlines the bank’s strategy, identifies the inherent risks of the activity and details how the bank will select, assess and oversee the third party;
  • Perform proper due diligence to identify risks and select a third-party provider;
  • Negotiate written contracts that clearly outline the rights and responsibilities of all parties;
  • Conduct ongoing monitoring of the third party’s activities and performance;
  • Execute a plan to terminate the relationship in a manner that allows the bank to transition the activities to another third party, bring the activities in-house or discontinue the activities;
  • Provide for clear responsibilities for overseeing and managing third-party relationships and the risk management process;
  • Maintain proper documentation and reporting to encourage oversight, accountability, monitoring and risk management; and
  • Independently review the risk management process to enable management to assess that the bank’s process aligns with its strategy and effectively manages risks from third-party relationships.

The guidance rescinds OCC Bulletin 2001-47, “Third-Party Relationships: Risk Management Principles,” and OCC Advisory Letter 2000-9, “Third-Party Risk.” Release. Guidance.


DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Orrick - Structured Finance Group | Attorney Advertising

Written by:


Orrick - Structured Finance Group on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.