Introduction
A financial institution can outsource a service. It cannot outsource responsibility for customer impact, resilience, information security, or regulatory accountability. Shared responsibility is not shared accountability: if customers suffer, you own the outcome even when a vendor caused the trigger.
FFIEC third-party risk management is not a checklist or a certification. It is a body of examination expectations built from FFIEC handbooks, agency guidance, and your institution's own risk assessment.
This guide clarifies the FFIEC's role, identifies the guidance that matters, walks through the lifecycle, shows what evidence to keep, and explains how boards and management can prepare for an exam.
Key Takeaways
- Examiners use FFIEC materials to judge how institutions manage technology, provider, and operational risk.
- A risk-based lifecycle covers planning, diligence, contracting, monitoring, and termination.
- Criticality attaches to the activity and its potential impact, not the vendor's name or size.
- Boards and senior management stay accountable for oversight, documentation, and escalation.
What FFIEC Third-Party Risk Management Means
What is the FFIEC, and what role does it play?
The Federal Financial Institutions Examination Council prescribes uniform principles, standards, and report forms for federal examinations. It does not regulate institutions itself. Its members are the Federal Reserve, FDIC, NCUA, OCC, and CFPB, and the chair of the State Liaison Committee also sits on the Council.
Agencies examine institutions, not the FFIEC. Which agency examines you depends on charter:
- National banks and federal savings associations: OCC
- State member banks: Federal Reserve
- State nonmember banks: FDIC
- Federal credit unions: NCUA (state-chartered, federally insured credit unions involve NCUA and state authorities)
Handbooks guide examinations. They are not statutes or regulations. The 2023 interagency guidance says plainly that supervisory guidance "does not have the force and effect of law." Cite the applicable rule separately from handbook procedures.
Who does the framework affect?
Expectations reach banks, credit unions, and other supervised institutions, but source documents differ. Check your charter, regulator, institution type, and business model before assuming anything applies.
Credit unions need particular care. The June 2023 bank guidance was issued by the Federal Reserve, FDIC, and OCC, not NCUA. NCUA's active baseline is Letter 07-CU-13 and Supervisory Letter 07-01.
NCUA joined the 2026 proposal, which is only a proposal. Credit unions should reconcile FFIEC handbook principles with current NCUA guidance rather than apply bank documents identically.
What counts as a third party, a critical activity, and a risk-based approach?
The guidance reads "business arrangement" broadly, as a synonym for third-party relationship. That covers:
- Technology providers
- Cloud and managed-service providers
- Fintech partners
- Vendors handling sensitive data
- Anyone supporting customer-facing or operationally significant functions
Critical activities are those that could expose the institution to significant risk if the third party fails, that carry significant customer impact, or that significantly affect financial condition or operations. Note the unit: the activity. A "critical vendor" label is a shortcut. One provider can run a critical activity and a trivial one.
In practice, a simple board test works: which vendor outage would stop revenue within 24 hours, and what is the workaround?
What responsibilities remain with the institution?
Outsourcing does not diminish responsibility for safe and sound operation and legal compliance. The board holds ultimate oversight, risk appetite, and policy. Management implements the program and reports to the board or a designated committee.
Management should be able to say who owns each relationship and who decides during an incident. Tyson Martin's governance approach comes down to four things:
- Plain-English reporting
- Clear decision rights
- Escalation thresholds that hold in real incidents
- Execution leadership can inspect without slowing the business
The FFIEC-Aligned Third-Party Risk Lifecycle
The 2023 interagency guidance describes five stages and asks institutions to tailor oversight to risk. It superseded SR 13-19, FIL-44-2008, and OCC Bulletins 2013-29 and 2020-10.
Planning and risk assessment
Decide whether outsourcing is appropriate before picking a provider. Weigh:
- Purpose and expected benefits
- Inherent risks and customer impact
- Data exposure and resilience needs
- Legal obligations
- Dependence on subcontractors or shared infrastructure
Then tier the relationship. Tiering sets the depth of diligence, contract protections, monitoring frequency, approval level, and documentation. A practical model:
- Tier 1: production access, sensitive-data storage, critical operations, or compliance impact
- Tier 2: limited sensitive-data access or meaningful dependencies
- Tier 3: no sensitive data, easy replacement, and minimal access
No universal scoring formula is prescribed.
Due diligence and selection
Evaluate the provider across these areas, then close any gaps you find. Do not rely only on the provider's representations:
- Financial condition and insurance
- Experience, staffing, and governance
- Information security, privacy, and resilience
- Incident management and compliance history
- Subcontractor use
Questionnaires do not equal safety. When a SOC report arrives, ask:
- Which systems, processes, and locations are in scope?
- Is it Type 1 (a point in time) or Type 2 (a period), and how current is the period?
- What exceptions were found, and how did management respond?
- Are subservice organizations carved out?
- Which complementary user entity controls must you implement?
SOC 1 addresses controls relevant to financial reporting, not general cybersecurity. SOC 2 covers security, availability, processing integrity, confidentiality, and privacy as scoped.
Contract negotiation
Review these provisions:
- Services, performance standards, and service levels
- Security, confidentiality, data ownership and location
- Incident notification, stated in hours rather than "reasonable time"
- Regulatory cooperation, audit and examination rights, remediation
- Insurance, subcontracting, business continuity
- Data return or destruction, dispute resolution, termination assistance
Standard provider paper often needs amendments, especially for critical activities, sensitive data, foreign providers, and concentration risk.
Ongoing monitoring
Monitoring should cover performance reviews, control evidence, security updates, financial health, incidents, complaints, audit findings, regulatory changes, and subcontractor or technology changes.
Match intensity to risk. A common cadence for Tier 1 is at least annually, and sooner when risk changes.
Build an escalation model for missed service levels, control deficiencies, security events, financial deterioration, repeated exceptions, and emerging concentration. Every escalation should produce an owner, deadline, decision, and evidence of remediation.
For out-of-tolerance vendors, name the path (accept, reduce, transfer, or replace) and who may approve each.
Termination and exit
Plan for expiration, provider failure, material breach, strategic change, discontinued service, or bringing the work in-house. Cover:
- Transition to another provider or internal replacement
- Customer communications and continuity of critical services
- Access removal, data return or destruction, and records retention
Start exit planning during planning and contracting. Update it as dependencies, data flows, and subcontractors change.
How to Build and Operate an FFIEC-Aligned Program
Maintain a complete inventory and defensible criticality model
The guidance calls for a current inventory that clearly identifies higher-risk relationships, including critical activities and, as appropriate, subcontractors. A living inventory is not a procurement export. Record:
- Provider, service, and business owner
- Data accessed, systems connected, hosting region
- Subcontractors, contract and renewal dates
- Risk tier and critical-activity rationale
- Regulatory relevance, open issues, and exit strategy
A single inventory can be built in about a week, even from messy data. Document why each relationship is low, moderate, high, or critical, and revisit the rating after an incident, acquisition, product launch, or scope change.
Create an evidence trail from onboarding through offboarding
Map each relationship to:
- Diligence records and approvals
- Contract and control assessments
- Monitoring results, incidents, and remediation decisions
- Independent reviews and termination evidence
Apply one test: can an examiner trace a risk from identification to owner, control, monitoring activity, exception, escalation, decision, and closure without informal emails or undocumented knowledge? If not, the evidence trail has a hole.
Manage resilience, concentration, and subcontractor risk
A financially stable primary vendor can still hide concentration risk: one provider, one cloud, one region, or a shared subcontractor. Treasury's cloud report notes the market is "concentrated around a small number of CSPs", so one incident could hit many institutions at once.
Cover:
- Contingency plans and recovery expectations
- Alternate providers and data portability
- Recovery testing
- Subcontractor transparency through notification, consent, and audit terms
- Ability to keep critical services running if a provider disappears
Recent events show distinct failure modes: a vendor's MOVEit breach exposing client data, the July 2024 CrowdStrike update outages, and the Synapse bankruptcy cutting off customer access. Treat them as different causes, not one story.
Establish governance, reporting, and independent review
Board reporting should focus on:
- Risk trends and critical relationships
- Overdue assessments and material incidents
- Unresolved findings and concentration exposure
- Policy exceptions and decisions needed
A strong report fits one to two pages: an executive snapshot, three to five top risks with business impact and options, and an appendix if needed.
Independent reviews test whether the program is staffed, consistently applied, risk-based, documented, and effective. Separate management's operating role from independent challenge where practical.
Use NIST and other frameworks as implementation aids
Useful current resources:
- NIST CSF 2.0 (February 2024), including the GV.SC supply chain function
- SP 800-161 Rev. 1 on cybersecurity supply chain risk management
- SP 800-53 Rev. 5, with its SR control family
- SP 800-55 Vol. 1 for selecting measures
These help define controls, evidence, and assessment questions. They complement FFIEC and agency expectations but never replace institution-specific obligations.
Build a crosswalk mapping NIST practices to FFIEC expectations, internal policy, contracts, and evidence owners. Note the FFIEC Cybersecurity Assessment Tool sunset on August 31, 2025. The FFIEC points to CSF 2.0 and CISA's cross-sector goals as alternatives.
How to Prepare for an FFIEC-Focused Examination
Assemble an examination-ready evidence package
Organize:
- Approved policy and governance minutes
- Current inventory and risk-tiering methodology
- Due-diligence files and contracts
- Monitoring records, issue and remediation logs
- Incident records and business continuity evidence
- Independent reviews and board reporting
- Exit plans
Each document should show current ownership, review date, decision history, exceptions, and the risk it addresses. Time-bound exceptions need an expiry date and a named owner, and should stay visible until closed.
Know your incident clocks too. Banks must notify their regulator no later than 36 hours after determining a notification incident occurred. Credit unions must notify NCUA within 72 hours of a reasonable belief that a reportable incident occurred, and a third-party notice can start that clock. Do not conflate them.
Identify common program weaknesses before examiners do
Public supervisory reports point to recurring gaps:
- Incomplete inventories and inconsistent criticality ratings
- Stale due diligence
- Contracts without audit or incident provisions
- Untracked subcontractors
- Weak monitoring and undocumented exceptions
- Unclear ownership and untested exit plans
OCC's Fall 2024 risk perspective flagged third-party security deficiencies and change-management weaknesses. These are qualitative findings, not prevalence benchmarks.
Run a gap assessment against current FFIEC handbook materials, applicable agency guidance, internal policy, and your actual evidence, not a generic vendor-management checklist.
Turn findings into an executable 90-day plan
Organize remediation into these workstreams:
- Immediate containment of open critical exposures
- Ownership and governance, including one accountable executive
- Evidence cleanup
- Critical-provider reviews
- Contract remediation
- Monitoring improvements
- Resilience testing
- Board reporting
Assign each an owner, decision rights, deadline, and measurable outcome. By day 90, Tier 1 vendors should have verified basic controls, standard security terms, and offboarding steps.
Tyson Martin works with boards and executive teams as a board advisor or interim CISO when they need third-party risk findings translated into clear decisions, credible reporting, and a 90-day plan with owners and dates. The work is advisory and validation, not hands-on security operations.
Frequently Asked Questions
Who does the FFIEC apply to?
FFIEC materials support supervision of covered institutions through member agencies. Precise requirements depend on your charter, regulator, and business activities.
What are the FFIEC guidelines?
They are the IT Examination Handbook booklets (Information Security, Management, Business Continuity Management, Architecture, Infrastructure, and Operations, and others), read alongside agency guidance and the 2023 interagency guidance. Verify current editions on the official site.
What is third-party risk management?
It is identifying, assessing, contracting for, monitoring, escalating, and terminating risks from external providers, while keeping institutional accountability for the outsourced activity.
What are the NIST frameworks for third-party risk management?
Most relevant are CSF 2.0, SP 800-161 Rev. 1, and SP 800-53 Rev. 5. They support control design and assessment but complement, not replace, FFIEC expectations.
What is a bank UBPR?
The Uniform Bank Performance Report is an analytical tool for supervision, examination, and management, built from Call Report data. It measures financial performance and condition, not vendor risk.
