The OCC came out with new guidance on January 24, 2017 - they published the supplemental examination guide for third party risk management, titled OCC Bulletin 2017-7. So, if you’re at a credit union, or even a bank regulated by another prudential regulator, you’re saying to yourself, “Wow, glad I’m not at an OCC institution.” Well, you’d be well advised to take note.
OCC Will Still Affect You
Here’s a piece of advice – the regulators follow one another for best practices and ideas just like your financial institution watches its peers. Truly, they do. We all keep up with best practices and common pitfalls – so why wouldn’t you expect the regulatory authorities to do so?
How do I know?
Here's a few examples from personal experience:
1. In most of my presentations, I end with an appendix of relevant third party guidance that includes many of the different regulators – I first saw the slides, which I’ve updated numerous times over the years, in an FDIC presentation.
2. When the guidance that is generally considered the gold standard for third party risk management came out – OCC Bulletin 2013-29 – it generated a lot of buzz among my regulator friends at the FDIC.
3. At the ABA Risk Management Conference in San Diego in the summer of 2016, I saw the well known “lifecycle” diagram from Bulletin 2013-29 in two different presentations, yet neither of the people who put that slide up were from an OCC regulated institution or the OCC.
4. OCC Bulletin 2017-7 has generated a lot of buzz in the industry. That's because...effectively, it takes the requirements laid out in OCC Bulletin 2013-29 and codifies them into supplemental examination procedures. These procedures will help everyone.
Listening to ALL Regulators Will Save You
Keeping tabs on the best ideas is always a good move – if you know your program is good enough to pass the most stringent guidance, you know your institution will be safe. And, bonus - you’ll be surpassing your examiners’ expectations ...hopefully. It'll create some strategic advantages for you.