MANAGING THIRDPARTY RISK New York Region Regulatory Conference

  • Slides: 18
Download presentation
MANAGING THIRD-PARTY RISK New York Region Regulatory Conference Call March 3, 2011 1

MANAGING THIRD-PARTY RISK New York Region Regulatory Conference Call March 3, 2011 1

Introduction n n n Dan Frye, Acting Regional Director Guidance on Managing Third Party

Introduction n n n Dan Frye, Acting Regional Director Guidance on Managing Third Party Risk June 6, 2008 (FIL-44 -2008) Guidance on Payment Processor Relationships November 7, 2008 (FIL-127 -2008) Power. Point E-Mail: NYCalls@fdic. gov Presenters n n Sherry Antonellis, Senior Review Examiner - Compliance Colleen Marano, Supervisory Examiner - Risk 2

Agenda I. II. Background Potential Risks Arising from Third-Party Relationships III. Risk Management Process

Agenda I. II. Background Potential Risks Arising from Third-Party Relationships III. Risk Management Process IV. Bank Services Company Act V. FDIC Supervision of Third-Party Relationships VI. Questions VII. Closing Remarks 3

I. Background n Third-Party Relationships Defined n Common Third-Party Relationships 4

I. Background n Third-Party Relationships Defined n Common Third-Party Relationships 4

Third Party Defined Definition – “third party” is broadly defined to include all entities

Third Party Defined Definition – “third party” is broadly defined to include all entities that have entered into a business relationship with the financial institution, regardless if the third party is a bank or a nonbank, affiliated or not affiliated, regulated or non-regulated, domestic or foreign. 5

Common Third Party Relationships n n n Parties that perform functions on a bank’s

Common Third Party Relationships n n n Parties that perform functions on a bank’s behalf. Parties that provide access to products and services outside of the bank. Parties that market processes and activities for which the bank has particular capacities and competencies. Parties that use the bank’s charter or legal powers. Parties that perform monitoring or audit functions for the bank. 6

II. Potential Risks Arising From Third Party Relationships Strategic n Reputation n Transaction n

II. Potential Risks Arising From Third Party Relationships Strategic n Reputation n Transaction n Operational n Credit n Liquidity n Compliance n Legal n 7

III. Risk Management Process Four Elements of Risk Management A. Risk Assessment B. Due

III. Risk Management Process Four Elements of Risk Management A. Risk Assessment B. Due Diligence C. Contracting D. Oversight 8

A. Risk Assessment n Strategic Fit n Cost/Benefit n Dollars and Risk/Reward n Management

A. Risk Assessment n Strategic Fit n Cost/Benefit n Dollars and Risk/Reward n Management Capability n Long-Term vs. Short-Term Key: Adequately assess, measure, control, and monitor risk associated with the relationship. 9

B. Due Diligence n Process should include qualitative and quantitative review to determine if

B. Due Diligence n Process should include qualitative and quantitative review to determine if the relationship achieves strategic and financial goals n Scope and Depth should be directly related to the importance and magnitude of the relationship 10

C. Contract Structuring and Review n Scope n Cost/Compensation n Performance Standards n Reports

C. Contract Structuring and Review n Scope n Cost/Compensation n Performance Standards n Reports n Audit n Confidentiality & Security 11

C. Contract Structuring and Review n n n Customer Complaints Business Resumption & Contingency

C. Contract Structuring and Review n n n Customer Complaints Business Resumption & Contingency Plans Default & Termination Ownership and License Indemnification Limits on Liability 12

D. Oversight n Management needs to monitor third party and the activity – Bottom

D. Oversight n Management needs to monitor third party and the activity – Bottom line - Is the relationship working as planned? n Third Party’s financial condition n Adequacy and adherence to policies relating to internal controls and security issues n Compliance with laws and regulations n Response to bank’s requests n Report the results of monitoring to the Board. 13

IV. Bank Services Company Act Primary Federal Regulator Notification n Third Party Relationships involving:

IV. Bank Services Company Act Primary Federal Regulator Notification n Third Party Relationships involving: n Check or deposit item processing n Core processing n Preparation and mailing of checks, statements, notices, etc. n Any other clerical, bookkeeping, accounting, statistical, or similar functions n 14

V. FDIC Supervision of Third-Party Relationships n Board and Management Responsibility n When things

V. FDIC Supervision of Third-Party Relationships n Board and Management Responsibility n When things go wrong…. . n Examination Procedures n Report of Examination Treatment n Corrective Action 15

VI. Questions and Answers Thank you! 16

VI. Questions and Answers Thank you! 16

Resources n n n FIL-44 -2008 Guidance for Managing Third-Party Risk FIL-127 -2008 Guidance

Resources n n n FIL-44 -2008 Guidance for Managing Third-Party Risk FIL-127 -2008 Guidance on Payment Processor Relationships FFIEC IT Handbooks n n n Outsourcing Technology Services Supervision of Technology Service Providers FIL-105 -2007 Revised IT Officer’s Questionnaire FIL-52 -2006 Foreign-Based Third-Party Service Providers FIL-27 -2005 Guidance on Response Programs FIL-121 -2004 Computer Software Due Diligence FIL-23 -2002 Country Risk Management FIL-68 -2001 501(b) Examination Guidance FIL-50 -2001 Bank Technology Bulletin: Technology Outsourcing Information Documents FIL-22 -2001 Security Standards for Customer Information FIL-81 -2000 Risk Management of Technology Outsourcing FIL-49 -1999 Bank Service Company Act 17

For further questions related to the material presented in this Regulatory Conference Call, you

For further questions related to the material presented in this Regulatory Conference Call, you may contact via e-mail: Compliance Questions Sherry Antonellis Santonellis@fdic. gov Risk Management Questions Colleen Marano Comarano@fdic. gov Information Technology Questions Stephanie Williams Stewilliams@fdic. gov 18

MANAGING THIRDPARTY RISK New York Region Regulatory ConferenceMANAGING THIRDPARTY RISK New York Region Regulatory Conference
New York Gl Krisztina New York New YorkNew York Gl Krisztina New York New York
Welcome to New York New York New YorkWelcome to New York New York New York
NEW YORK New York l New York oftenNEW YORK New York l New York often
ThirdParty Attacks MATTHEW COOK ThirdParty Attacks A broadThirdParty Attacks MATTHEW COOK ThirdParty Attacks A broad
Northeast Region Southeast Region Midwest Region Southwest RegionNortheast Region Southeast Region Midwest Region Southwest Region
Region st Region sr Region vest Region midtRegion st Region sr Region vest Region midt
New York City New York City Location NewNew York City New York City Location New
New England Region Middle Region Southern Region ColoniesNew England Region Middle Region Southern Region Colonies
REGULATORY PORTAL REGULATORY PORTAL The North American regulatoryREGULATORY PORTAL REGULATORY PORTAL The North American regulatory
REGULATORY PORTAL REGULATORY PORTAL The North American regulatoryREGULATORY PORTAL REGULATORY PORTAL The North American regulatory
New York Blue Climate Science SUMMARY New YorkNew York Blue Climate Science SUMMARY New York
New York Manhattan the centre of New YorkNew York Manhattan the centre of New York
New York Big Apple New York l lNew York Big Apple New York l l
New York SCHOOLS NAME TRIP TO NEW YORKNew York SCHOOLS NAME TRIP TO NEW YORK
The New York State Education Department New YorkThe New York State Education Department New York
NEW YORK FOTOS DE EPOCA NEW YORK ANEW YORK FOTOS DE EPOCA NEW YORK A