On May 1, First Republic Bank became the latest regional bank to fail, following Silicon Valley Bank and Signature Bank, which collapsed less than two months ago.
The decline had been brewing for First Republic since Silicon Valley Bank and Signature Bank were seized in March. Those two failures triggered a search for other lenders in trouble, and First Republic was soon identified as vulnerable to significant deposit outflow risk. However, the true death spiral began when the bank announced last Monday that it had lost $100 billion in deposits in just three months.
The stock value of First Republic plummeted so much following the announcement that the New York Stock Exchange halted trading several dozen times during the week. By mid last week, it had become obvious that government intervention was needed. Over the weekend, the FDIC seized the bank, and JPMorgan Chase bought all of its deposits and most of its assets through an auction. On Monday, May 1, First Republic's 84 branches opened as JPMorgan Chase.
Unlike the Silicon Valley Bank and Signature Bank, the FDIC has only agreed to protect First Republic's depositors up to the FDIC-insured limit of 250,000 dollars per institution, and investors are facing a total loss. There is no shortage of news media coverage on the First Republic Bank's and others' failures and how they affect the broader economy and banking system.
Still, the question every TPRM practitioner should be asking right now is, "What does this mean for third-party risk management (TPRM)?"
It's no small secret that banking partners are often overlooked for TPRM due diligence. After all, those institutions are regulated, and surely the regulators are keeping watch, right? This common misconception often leads to a false sense of security because regulations in and of themselves do not prevent banks (or any other type of vendor) from failing. It’s for this reason that regulators issue guidance instructing organizations on identifying, assessing, managing, and monitoring third-party risks. And banks and other financial institutions must be covered by your organization's third-party risk management practices. In most instances, banks should be considered critical vendors, not just for your organization, but also for your vendors.
For starters insight into your vendor’s banking relationships and understanding their operational resiliency is important. Suppose your organization or one of its vendors suffers the loss of a key financial partner. The impacts on your organization or its customers can be devastating. Many organizations have lost deposits over the $250,000 limit, possibly creating a serious financial shortfall. If your vendor is in this situation, they may be forced to take out loans to make payroll, fund basic operations, or reduce staff or services to compensate for the loss. In addition, if your vendor relies on a specific bank or financial institution for capital and funding, this resource is lost when that institution fails. This could mean business disruptions or delays; in a worst-case scenario, it could be the straw that breaks the camel's back, forcing your vendor to go out of business.
The recent bank failures should illustrate how quickly risks can shift and change. Even though effective third-party risk management won’t prevent the next bank failure, it could give your organization an advantage by highlighting operational risks directly related to your or your vendor's banking relationships. Early issue detection and regular risk monitoring can help your organization take control over risks vs. being surprised by them.