Upload
others
View
3
Download
0
Embed Size (px)
Citation preview
A M A N D A J . S M I T H , E S Q U I R E
M E S S I C K & L A U E R , P C
Managing Credit Union Vendor Due Diligence and Third Party
Relationships
Overview
Discussion Points
Importance of performing due diligence and managing third party relationships
How to implement a vendor management program
Guidelines for performing due diligence
Importance of Performing Due Diligence and Managing Vendors
Why is it Important?
NCUA and state regulators expect it
Credit unions cannot contract away regulatory liability
Certain risks cannot be eliminated; however, with proper due diligence and vendor management they can be significantly mitigated
Regulator’s Expectations
NCUA Letters
07-CU-13 Evaluating Third Party Relationships
Supervisory Letter 07-01
10-CU-15 Indirect Lending and Appropriate Due Diligence
08-CU-19 Third Party Relationships: Mortgage Brokers and Correspondents
08-CU-09 Evaluating Third Party Relationships Questionnaire
01-CU-20 Due Diligence Over Third Party Service Providers
Regulatory Liability
From a compliance standpoint, the credit union is liable to its members and its regulators for the actions or inactions of the vendors with whom it does business
Vendor compliance errors are costly both monetarily and to your reputation
Even though the vendor may offer a turn key product the credit union must actively manage the program
Example – Regulation Z
§1026.5 Open Ended Credit General Disclosure Requirements
“The creditor shall make the disclosures required by this subpart clearly and conspicuously.”
“The creditor shall make the disclosures required by this subpart in writing, in a form that the consumer may keep.”
“The creditor shall furnish account-opening disclosures required by §1026.6 before the first transaction is made under the plan.”
Regulation Z – continued
Creditor means: A person who regularly extends consumer credit that is subject to a finance charge or
is payable by written agreement in more than four installments (not including a down payment), and to whom the obligation is initially payable, either on the face of the note or contract, or by agreement when there is no note or contract.
Under certain circumstances, a person that honors a credit card. Any card issuer that extends either open-end credit or credit that is not subject to a
finance charge and is not payable by written agreement in more than four installments.
With limited exception, any card issuer that extends closed-end credit that is subject to a finance charge or is payable by written agreement in more than four installments.
A person who regularly extends consumer credit only if it extended credit (other than credit subject to the requirements of §1026.32) more than 25 times (or more than 5 times for transactions secured by a dwelling) in the preceding calendar year. If a person did not meet these numerical standards in the preceding calendar year, the numerical standards shall be applied to the current calendar year. A person regularly extends consumer credit if, in any 12-month period, the person originates more than one credit extension that is subject to the requirements of §1026.32 or one or more such credit extensions through a mortgage broker.
Regulation Z - continued
Credit union discovers, by way of examination, that due to a programming error, its vendor had disclosed an understated APR on its credit card product for one year
Administrative sanction – reimburse the difference between the disclosed APR and the APR charged to the members
Class action lawsuit – potential for punitive damages
But it’s the vendor’s fault????
Indemnification, limitation of liability, and more litigation
Example - Unfair, Deceptive, or Abusive Acts or Practices (UDAAP)
An act or practice is unfair when:
(1) It causes or is likely to cause substantial injury to consumers;
(2) The injury is not reasonably avoidable by consumers; and
(3) The injury is not outweighed by countervailing benefits to consumers or to competition.
UDAAP – continued
A representation, omission, act or practice is deceptive when:
(1) It misleads or is likely to mislead the consumer;
(2) The consumers interpretation of it is reasonable under the circumstances; and
(3) It is material.
UDAAP - continued
An abusive act or practice:
(1) Materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service; or
(2) Takes unreasonable advantage of: • A lack of understanding on the part of the consumer of the
material risks, costs, or conditions of the product or service;
• The inability of the consumer to protect its interests in selecting or using a consumer financial product or service; or
• The reasonable reliance by the consumer on a covered person to act in the interests of the consumer.
UDAAP and Vendors
CFPB’s Enforcement Action Against Capital One
Finding – Call center vendors were deceptive when selling Capital One’s credit card add on products
Penalty – Must return approximately $140 million to an estimated 2 million customers and pay a $25 million civil penalty
In addition to the refunds and $35 million penalty assessed by the OCC
CFPB has an expectation that every institution under its supervision and their service providers will comply with UDAAP
Mitigating Regulatory Risk
Bring compliance and vendor management together
Review the vendor’s process for compliance at the onset of the relationship
Designate a person in the credit union to manage the vendor relationship
Make sure proper contractual protections are in place: representations to comply with all applicable laws
indemnification
eliminate limitations on liability when possible
Review vendor performance quarterly
Have access to member complaints
Implementing a Vendor Management Program and Performing Due Diligence
Evaluating Your Need for Vendors
Planning and Risk Assessment
Does outsourcing fit with the credit union’s strategy and risk tolerance?
Due Diligence
Is the proposed vendor a credible and effective provider?
Risk Measurement, Monitoring, and Control
How does the credit union monitor the relationship and manage the risk?
Planning and Risk Assessment
Planning
Does the vendor fit with the credit union’s mission and philosophy? Document how the relationship works with the credit union’s
strategic plan
Would the credit union be better served by an in-house solution? Must evaluate the credit union’s strengths and weaknesses
CUSO v non-CUSO provider
Financial projections Outline the range of expected and possible financial outcomes
Should project a ROI when considering expected revenues, direct costs, and indirect costs
Rate the Criticality of the Vendor
Highly Critical: Essential to daily function of core services or safety and soundness issue if not functioning
Critical: Essential to a core service but alternative means of delivery exist or it is an ancillary service
Non-Critical: Does not affect core service if not functioning
Criticality
The more critical the vendor or service the more thorough the planning, due diligence, and monitoring must be
Exception, renewing a longstanding relationship requires less analysis than a new relationship; however, it still must be monitored in the same manner
Risk Assessment
Credit
Interest Rate
Liquidity
Transaction
Compliance
Strategic
Reputation
Risk Assessment
Expectations for Outsourced Functions
Staff Expertise
Criticality
Risk-Reward or Cost-Benefit Relationship
Insurance
Impact on Membership
Exit Strategy
NCUA Third Party Relationships Questionnaire
Does the credit union maintain a list of the third party company(ies) or firm(s) which they use for outsourced services?
Does the credit union maintain a description of the services provided by the third party company(ies) or firm(s)?
Did the credit union consider more than one (1) third party before entering into a relationship?
Does the third party relationship(s) compliment the credit union’s overall mission and philosophy?
Has the credit union performed and documented a cost-benefit financial analysis to determine they are receiving sufficient reward for the risk associated with the proposed relationship?
Do the financial projections align with the credit union’s overall strategic plan and ALM framework?
Due Diligence
Due Diligence Review Minimums
Should take into account the critical nature of the service, the level of expertise exhibited by the vendor, staffing changes, economic and regulatory changes, and risk mitigation strategies associated with the vendor oversight. (NCUA Letter to Credit Unions 07-CU-13)
Goal of Due Diligence
Complete the due diligence necessary to ensure the risks undertaken in a vendor relationship are acceptable in relation to their risk profile and safety and soundness requirements
Less complex risk profiles and vendor arrangements typically require less analysis and documentation
If the credit union has a longstanding relationship with the vendor, less analysis is required to renew the relationship
Due Diligence Considerations
Background Check
Business Model
Cash Flows
Financial and Operational Control Review
Contract Issues and Legal Review
Accounting
Background Check
Vendor’s experience providing the proposed service or program
Experience of vendor’s key employees
Obtain references of existing and past clients
Claims and lawsuits
Verify licenses
Other sources of information
Business Model
Longevity and adaptability of business model
If the business and marketing plans are available they should be reviewed
Credit union officials should be able to explain the vendor’s business model
Verify sources of income and check for any conflicts of interest
Cash Flows
Credit union should be able to explain how the cash flows between the member, vendor, and credit union
Credit union should independently verify the source of these cash flows
Financial and Operational Control Review
Review Vendor’s financial ability to meet the proposed commitments
Financial statements – outstanding commitments, capital strength, liquidity, and operating results
If available, review SAS 70. May be necessary to obtain an independent review
Review annually
Contract Issues and Legal Review
Letter 07-CU-13 advises credit unions to seek qualified external legal counsel to review vendor agreements
Letter from OGC (08-0417) states that in house counsel can perform the review if qualified
Contracts should be negotiated
Put it in writing
Obtain legal opinions, when necessary
Vendor Contracts
Vendor agreements should address: Scope of arrangement, services offered, and activities authorized; Responsibilities of all parties (including subcontractor oversight); Service level agreement addressing performance standard and measures; Performance reports and frequency of reporting; Penalties for lack of performance; Ownership, control, maintenance, and access to financial and operating records; Ownership of servicing rights; Audit rights and requirements (including responsibility for payment); Data security and member confidentiality (including testing and audit); Business resumption or contingency planning; Insurance; Member complaints and member service; Compliance with regulatory requirements; Dispute resolution; and Default, termination and escape clauses.
Accounting
Credit union must have adequate accounting infrastructure to track, identify, and classify transactions in accordance with GAAP
It may be necessary to utilize an independent accountant
NCUA Third Party Relationships Questionnaire
Did the credit union request referral from the prospective third party clients to determine their satisfaction and experience with the proposed arrangement?
Does the credit union understand the vendor’s sources of income and expense and have they considered any conflicts of interest that may exist between the third party and the credit union?
Does the credit union’s analysis of the financial statement of the third party and its closely related affiliates provide reasonable assurance that the third party has the ability to fulfill the contractual commitments proposed?
Did the credit union ensure the third party is compliant with state and federal laws and regulations and is contractually bound to comply with applicable laws?
NCUA Third Party Relationships Questionnaire
Does the credit union have an adequate accounting infrastructure to appropriately track, identify, and classify transactions in accordance with GAAP?
Are reports prepared on a monthly basis adequately reflecting the amount of activity with the third party and providing sufficient information to properly monitor the activities?
Are informative summary reports provided to senior management or the board of directors?
Risk Measurement, Monitoring, and Control of Third Party Relationships
Risk Measurement, Monitoring, and Control of Third Party Relationships
The credit union must establish ongoing expectations and compare the vendor’s performance to these expectations
The credit union must be certain that all parties to the arrangement are fulfilling their responsibilities
Credit union must develop policies and procedures, be able to measure and monitor the risks, and implement ongoing controls over vendor relationships
Inventory Your Vendors
What services are being provided and by whom?
How long have the services been provided by the vendor?
Who are the contacts for the vendor and the credit union?
Gather the vendor agreements.
What are the performance issues, if any?
Does the credit union have any due diligence on the vendor?
Who are the key subcontractors that the vendors are depending on and does the credit union have any due diligence on them?
Policies and Procedures
Outline expectations and limit risks from vendor relationships
Outline staff responsibilities and authorities for vendor oversight
Define the content and frequency of reporting to credit union management
Establish program limitations to pace the introduction of services to limit risk exposure as programs are working out initial issues
Risk Measurement and Monitoring
Credit unions must measure the vendor’s performance and periodically verify the accuracy of the information coming from the vendor
Outsourcing the process or function does not outsource the safety and soundness concern regarding the process or function
Control Systems and Reporting
On-going risk assessment
Must make sure the vendor is safeguarding member assets, producing reliable reports, and following the terms of the agreement
Credit union should designate staff to monitor vendor relationships, including understanding reports received from the vendor
Implement QC procedures to review the vendor’s performance periodically
Staff should report to credit union officials regarding vendor performance
Take Aways
Know your vendors – Do your due diligence!
Review and negotiate your vendor agreements
Manage your vendors – Appoint a person within the credit union to manage the vendor(s) and report to credit union officials
Review vendor performance quarterly
Review vendor due diligence annually and when renewing the contract
A M A N D A J . S M I T H , E S Q U I R E
M E S S I C K & L A U E R , P C
A S M I T H @ C U S O L A W . C O M
6 1 0 - 8 9 1 - 9 0 0 0
Thank you! Questions?