This is part 4 of a Seven Part Guide to reviewing vendor contracts.
Services level. Services levels should be defined. For example, are the service to be made available 24/7 365 days a year or are they only needed during normal business hours. When the services involve some type of software or online technology, what is the minimum amount of “uptime” required? Depending on the services involved, uptime might be 99.9%, for example. vendors will understandably push back on that figure and might suggest 98%. The right figure need not be either one of those numbers and is dependent on the type of service being provided and its criticality to the bank’s delivery of services to its customers. To the extent there is planned downtime for things such as software updates it should occur during off peak time periods. Service level measures can be used to motivate the third party’s performance, penalize poor performance, or reward outstanding performance. Performance measures should not incentivize undesirable performance, such as encouraging processing volume or speed without regard for accuracy, compliance requirements, or adverse effects on customers. Certain products and services have standards that are common across the industry while others may need to be developed to fit the particular transaction. Service levels should be revisited from time to time during the term of the relationship to provide an opportunity for them to evolve along with the services being provided.
Banks should consider what type of reporting they want the vendor to provide considering performance against the service level targets and what type of remedies to which the Bank is entitled in the event vendor fails to measure or report on the service levels. Banks should also consider including requiring a root cause analysis for incidents and service level failures. In other words, it is not just sufficient to report a failure, what caused the failure and exactly what needs to be done to remedy it. It can be very frustrating when a vendor’s performance affects customers and the bank is unable to explain to those customers how a problem is being fixed so that it will not reoccur.
One option to consider when addressing service levels is whether the service level requirement is an “all or nothing” target or whether it is merely one factor in determining whether the bank is entitled to credits against its normal monthly billing for the services. For example, if the service level on average for any given month is at 95%, perhaps the bank receives a credit against fees owed. If the service level falls below 95% then the contract may provide that such an event constitutes a material breach allowing the bank to terminate the contract.
Vendor reports. The vendor should provide and retain timely, accurate, and comprehensive information such as records and reports that allow bank management to monitor performance, service levels, and risks. Thought should be given to how long the vendor is required to maintain the records. That will play into audit requirements. The reports should include performance reports, control audits, financial statements, security reports, BSA/AML and Office of Foreign Asset Control (OFAC) compliance responsibilities and reports for monitoring potential suspicious activity, reports for monitoring customer complaint activity, and business resumption testing reports.
One element of reporting concerns how quickly the vendor determines that a problem has occurred. Depending on the services being provided, one may expect that the vendor will have in place automatic monitoring of services. The detection of a defect should then in turn trigger a report to the bank together with a proposed temporary fix/workaround and a resolution of such failure in accordance with agreed upon timeframes.
Breach and Termination.
Non-Material Defaults: What happens if the vendor is unable to meet its obligations under the contract? In some instances this may simply be a monetary issue and treated by an adjustment of fees. Certain non-material defaults may simply trigger a notice and a right to cure as well as a minor adjustment on fees. Failure to cure the defect or provide a temporary fix might elevate the matter to a more material breach.
Automatic Termination Events. In certain instances, however, a bank may wish to have the absolute right to terminate the contract with the vendor. For example, a bank should be able to terminate a contract in whole or in part if the vendor has breached the confidentiality or data privacy provisions, or if the service level failures are of a significant magnitude or because of the vendor’s intentional refusal to perform the services. Likewise, (i) the vendor’s failure to remediate significant deficiencies within a specified period of time after receipt of notice; (ii) or material weaknesses in the vendors Service Organization Controls Report (“SOC”); (iii) the vendor’s bankruptcy, (iv) a change of control without the bank’s consent; (v) extended force majeure events, and (v) bank regulatory directives to terminate, should give the bank the right to immediately terminate the contract without incurring substantial penalties. Consideration should be given to how much notice is necessary and the time frame to allow for the orderly movement of the services to another third party vendor. Upon termination the vendor should be obligated to return or destroy the bank’s data and other resources.
Termination for Convenience. Another typical provision is “termination for convenience.” This simply means that the bank has decided for various business reasons that it no longer wishes to be party to the contract with this particular vendor. The bank needs to be aware, however that a termination for convenience usually will trigger some type of payment obligation on the part of the bike to the vendor. In some instances the vendor may require a pro rata portion of the unpaid fees for the life of the contract in order to allow for the termination. These fees can be significant and banks should review the exact terms of such provision very carefully prior to signing the contract. As part of the services, the contract should define the vendor’s obligations to facilitate the orderly, uninterrupted transfer and transition of the services back to Bank or to another service vendor, including the continued provision of the services for a reasonable period of time to allow the transition to occur. The obligation to provide this termination/expiration assistance should apply regardless of which party terminates the contract, unless the vendor is terminating due to Bank’s payment default.
Termination Assistance. Depending on the type of contract involved, the bank may need substantial cooperation and assistance from the exiting vendor to move the work being provided to either a new vendor or into the back office of the bank itself. The contract should clearly assign all costs and obligations associated with transition and termination so that the parties understand this allocation at the inception of the relationship. Upon the termination the contract should provide for the timely return or destruction of the bank’s data and other resources and ensure the contract provides for ongoing monitoring of the third party after the contract terms are satisfied as necessary.
Dispute resolution. It is not unusual for the bank and the vendor to get into disagreements about whether the vendor is performing under the contract. While a formal mediation or arbitration process is always something that is available, a more practical approach is to establish a more informal process where each side designates relationship managers who are required to meet within a specified time period, say seven days after the notice of the dispute, to try and reach an agreement about the nature of the deficiency and the corrective action to be taken. If they are unable to reach an agreement they then prepare a written reports to senior management and management attempts to resolve the matter. The typical provision includes a statement that the parties will seek to resolve the problem in good faith for a specified period of time. The dispute only goes to mediation, arbitration or litigation if all of the informal processes fail.
Foreign Based Vendors. It is important when negotiating a contract with a foreign vendor that the contract include choice-of-law covenants and jurisdictional covenants that provide for adjudication of all disputes between the parties under the laws of a single, specific jurisdiction. You should understand, however, that such contracts and covenants may be subject to the interpretation of foreign courts relying on local laws. Foreign courts and laws may differ substantially from U.S. courts and laws in the application and enforcement of choice-of-law covenants, requirements on banks, protection of privacy of customer information, and the types of information that the vendor or foreign governmental entities will provide upon request.
Choice of Law. If at all possible the bank is going to want the choice of law provision concerning what law applies to the interpretation and enforcement of the contract to specify the state in which the bank is located. Large national vendors will generally do the same and will seek to choose the state where they are located. Does it really make that much difference? In some instances it might. Some states recognize different legal causes of action against a party and thus legal exposure may differ depending on the jurisdiction whose laws are being applied. It may very well be that the commercial law in both states are similar enough that is does not really make a big deal but you should certainly be asking the question if the vendor has sufficient leverage to cause the choice of law to be another state than where the bank is located.
Some states, such as New York, have adopted laws that essentially encourage parties to a contract, even ones that have no physical ties to New York, to choose the law of that state for the interpretation of the contract. Whether a particular court will honor the choice of law provision can be complicated issue that revolves around public policy concerns and conflicts of law provisions.
Jurisdiction or Forum. Jurisdiction is sometimes confused with choice of law but it is a separate issue. Jurisdiction addresses the question of where a dispute will be heard. For example, a typical provision might say that a dispute will be heard in the state or federal courts located in a particular city or state. A bank will generally seek to litigate contract disputes in its home state for several reasons. The first is cost. The bank generally already has local counsel that it can reach out to handle litigation. If the matter is going to be litigated in another state by lawyers who do not have a current relationship with the bank then expectations are that the costs will be greater. Out of state litigation also increases travel expenses and introduce other inefficiencies. Finally, parties can be worried about what is commonly referred to as “home cooking” where the perception is that a local judge and jury might be inclined to protect the local party.
[View source.]
