<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Coming to a GSE Near You: Better Third-Party Risk Management via FHFA Guidance

author Michael Berman
2 min read
Oct 10, 2018

After the housing crisis, Fannie Mae, Freddie Mac and the Federal Home Loan Banks were largely focused on credit and market risk. Now with an increasing awareness of cybersecurity, IT security, data, and operational risk, oversight of third-party providers has become increasingly important.

So important, in fact, that the Federal Housing Finance Agency (FHFA) issued new guidance, "Oversight of Third-Party Provider Relationships" for Fannie, Freddie, the FHLBanks, and the Office of Finance (OF).

What Is a Third-Party Relationship?

The FHFA defines a third-party provider relationship as “a business arrangement between a regulated entity and another entity that provides a product or a service.”

It doesn’t apply “when a FHLBank provides products or services to its members or housing associates.”

What Does the Guidance Say?

The guidance is basically a “greatest hits” album of third-party risk management guidance from the agencies, including the Federal Reserve, Office of the Comptroller of the Currency and the FDIC. The agency almost could have cut and pasted it. It features all of your favorites from the third-party risk management life cycle including:

  • Risk assessment
  • Due diligence in third-party provider selection
  • Contract negotiation
  • Ongoing monitoring
  • Termination

It also highlights key elements including:

  • Board and senior management responsibility
  • Policies, procedures and internal standards
  • Reporting

The guidance notes that the degree of risk management, including due diligence, should correspond to the level of risk and the complexity of the relationship. It also says that third-party relationship management should be a part of a regulated entity’s overall enterprise risk management (ERM) program.

The Vast Reach of Third-Party Vendor Management

If I’ve said it before, I’ll say it again. Third-party vendor management touches nearly every area of an institution. Don’t believe me? Look at the list of related FHFA guidance on the subject:

  • Prudential Management and Operations Standards
  • Cloud Computing Risk Management
  • Oversight of Multifamily Seller/Servicer Relationships
  • Information Security Management
  • Internal Audit Governance and Function
  • Data Management and Usage
  • Information Technology Investment Management
  • Oversight of Single-Family Seller/Servicer Relationships
  • Operational Risk Management
  • Model Risk Management
  • Contingency Planning for High-Risk or High-Volume Counterparties

What Does This Mean?

Increased attention on third-party relationships isn’t likely to end anytime soon. Vendor management isn’t a fad. It’s an increasingly important area, one that links guidance on everything from cloud computing, data and information technology to operational risk management, oversight of vendor relationships, and internal audit and governance.

If you’ve been holding off on formalizing your approach to vendor management, this is another sign that you need to get on board.

 

Related: Creating Reliable Risk Assessments

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
OFAC, Cyber Risk & Third-Party Vendors: What You Need to Know
Risk Management

OFAC, Cyber Risk & Third-Party Vendors: What You Need to Know

Nov 8, 2018 2 min read
Inherent Risk
Risk Management

Inherent Risk

Nov 12, 2018 1 min read
Operational Risk - Foreseeing the Unforeseen Costs of Outsourcing
Risk Management

Operational Risk - Foreseeing the Unforeseen Costs of Outsourcing

Dec 10, 2016 2 min read