What’s the OCC Banking Regulatory Outlook for 2022?

Other areas of OCC interest

Other areas that the OCC is focusing on chime with the conversations we have with our customers and industry practitioners. Third-party risk and the potential for concentration risk continue to resonate with regulators. We already have the Interagency guidance on third-party risk, which is currently out for consultation. In it, the OCC, Federal Reserve, and the FDIC are pooling their thinking about how best to tackle third-party risk. In the UK, banking regulators are also looking to enhance their supply chain resilience for the UK’s financial services sector.

The specific guidance offered by the OCC – which will likely echo the guidance of the FDIC and Federal Reserve – will focus on ensuring that banks have proper oversight of their significant third-party relationships, including their partnerships. Banks will need to demonstrate which relationships are critical to a bank’s operations and identify where there are concentration risks that fall outside a bank’s risk tolerances.

Banks also need to assess the cyber risk profile of their third-party supply chain and ensure that their critical suppliers have measures in place that protect themselves and their customers, the banks.

New challenges for US banks

This presents an array of challenges for US banks. Clearly, banks recognize the value of third-party relationships and partnerships, as they help them deliver services faster and more efficiently than if they tried to provide them in-house themselves.

The issue is that there are few purely third-party relationships in a hyper-networked world. Instead, there are an array of third, fourth, and fifth-party relationships that need to be managed too. These deeper relationships can easily hide the concentration risk that regulators are understandably worried about.

For example, there are many SaaS-based services provided to banks by numerous vendors, many of which are underpinned by a small number of huge Cloud Computing service providers. This concentration could expose banks to technical, operational, or commercial issues that can swiftly impact a bank’s ability to deliver its services to its customers and compromise confidence in the wider banking sector.

So how can banks best address these issues? Third-party Risk Management (TPRM) solutions are not necessarily new. Still, their significance is taking on a level of importance as regulators in the US and further afield recognize the risk banks can be exposed to and are raising their expectations of how it is managed.