The board of directors and senior management are responsible for managing activities conducted through third-party relationships, and identifying and controlling the risks arising from such relationships, to the same extent as if the activity were handled within the institution. Financial Institutions are expected to have clearly defined systems of risk management controls built into the management system including controls over activities conducted by affiliates and third-parties. The more significant the third-party service relationship (i.e. performs critical functions, material impact on revenues, large number of consumers, etc.), the more important it is that the institution conduct regular reviews of the adequacy of its oversight and controls over third-party relationships. Examiners will evaluate all applicable third-party relationships as though the activities were performed by the institution itself.
Want to learn how TRUPOINT Partners can help reduce your CRA compliance risk?
Appropriately managed third-party relationships can enhance competitiveness, provide diversification, and strengthen the safety and soundness of the institution. However, third-party relationships also present risks if not properly managed. Specifically, failure to manage these risks can expose an institution to supervisory action, financial loss, litigation, and reputational damage. Risks from third-parties include compliance risk (i.e. violation of laws or regulations), reputation risk (i.e. negative public opinion), operational risk (i.e. inadequate or failed internal processes), transaction risk (i.e. problems with product or service delivery), and credit risk (i.e. unable to meet contractual relationships). To that end, the decision about whether to use a third party should be fully analyzed by management. In addition, a comprehensive risk management process, which includes management of any third-party relationships, will enable management to ensure that the third-party is operating in a manner consistent with federal and state laws, rules and regulations (including those to protect consumers).
In the past couple of weeks, there has been a lot of industry buzz about third-party relationships. In particular, there has been a large amount of discussion regarding Automobile Dealers. The American Banker reported that the Consumer Financial Protection Bureau (CFPB) is preparing to “crack down” on interest rate markups (typically 2.0 to 2.5 percentage points) that automobile dealers add onto the cost of car loans. In February, Bloomberg reported that the CFPB told “at least four banks that it may sue them over vehicle loans and interest-rate markups by auto dealers that appear discriminatory…”
Regardless of the type of third-party relationship (i.e. mortgage brokers, auto dealers, credit card providers, debt collection, loss mitigation, disclosure preparation software, audit functions, etc.), there are four common elements to an effective third-party risk compliance management process for all significant relationships:
1. Conduct a Regular Risk Assessment – Assess risks and options for controlling third-party relationships.
3. Review Contract Structuring – Ensure that the specific expectations and obligations of both the institution and the third-party are outlined in a written contract (which defines the structure)
4. Review Oversight Process – Reviewing the operational and financial performance of third-party activities on an ongoing basis to ensure they meet the terms of the contractual agreement
Read also: Compliance: Cost Saver or Cost Center
Bottom Line: A financial institution’s use of third-parties can be a powerful and effective way to achieve its strategic goals. With that said, the regulators expect financial institutions to oversee third-party relationships as they would any other division of their own institution. Therefore, financial institutions should regularly review its third-party service providers and assess risks and evaluate internal policies and procedures to ensure compliance.
TRUPOINT Partners can help your institution conduct a comprehensive compliance management risk assessment. If you are working with third-parties in the lending process, we can also help you compare and analyze your lending data to determine if there is any disparate impact risk.
A complementary risk review with one of our senior consultants can give you a head start in analyzing and understanding your risk.