Federal banking agency guidance on third-party relationships is deliberately principles-based. It tells institutions that contracts should be commensurate with the level of risk and complexity of the relationship, and lists the areas a contract should address. It does not supply model clauses, thresholds or a checklist that a legal team can tick.
That is a reasonable regulatory design and an awkward operational one. A bank can hold a well-drafted vendor agreement negotiated by capable counsel and still draw a finding, because the question an examiner asks is not whether the contract is sound commercially but whether its provisions are adequate to the risk the relationship carries and whether the institution can demonstrate that it assessed them.
This article sets out the contract areas that examination consistently focuses on, why certain provisions attract more scrutiny than others, and how institutions structure their portfolios so that coverage can be demonstrated rather than asserted.
The contract areas examination focuses on
The areas below appear across interagency guidance and in examination practice. The recurring theme is that each provision should be specific enough to be actionable, since a general commitment to cooperate is difficult to enforce and difficult to evidence. Specificity also determines whether a provision can be reported on, which is what converts a contract term into a control that a risk committee can see.
- Scope, performance and service levels, the nature of the arrangement stated precisely, with measurable performance standards and defined consequences for failure
- Audit and remediation rights, the ability to audit or to receive adequate independent reports, together with the right to require remediation of identified deficiencies
- Information security and confidentiality, controls, incident notification duties with defined windows, and obligations on data return and destruction
- Business continuity and resilience, recovery objectives, testing commitments and the institution's right to receive test results
- Termination and transition, termination rights for cause and for convenience, notice periods, and transition assistance obligations that survive termination
Audit rights attract disproportionate attention because they are where contractual language and operational reality most often diverge. A right to audit that has never been exercised, and that the provider would resist in practice, is weaker evidence than a right to receive a scoped independent assessment on a defined cadence that the institution actually reviews. Examiners tend to be interested in what the institution does with the right, not only that it holds one. The same reasoning explains the attention that business continuity provisions receive. A recovery time objective stated in a contract means little unless the institution receives and reviews the provider's test results, and the right to receive those results is the provision that makes the objective verifiable.
Risk-based expectations mean a low-risk vendor does not need the contractual apparatus of a critical service provider. They also mean that applying a uniform contract template across the whole portfolio is not a defense. The institution has to be able to show why the provisions in a given contract are appropriate to that relationship's risk.
Where portfolios commonly fall short
The gaps that surface in examination are consistent across institutions, and most of them originate in how contracts were accumulated rather than in how any individual agreement was drafted.
- Legacy agreements never reassessed. Contracts signed before a relationship became critical often retain the provisions appropriate to its original, lower risk tier.
- Subcontracting silence. Many agreements permit subcontracting without requiring notification, approval or flow-down of security and audit obligations.
- Thin transition assistance. Termination rights are common, but obligations to assist with an actual migration, including data return format and timetable, are frequently absent.
- Unmeasured service levels. Performance standards stated qualitatively cannot support a remediation demand, and cannot be reported to a risk committee.
- Evidence held outside the contract system. Audit reports, continuity test results and remediation correspondence often sit in email, which makes demonstrating oversight slow and incomplete.
A five-step approach to demonstrable coverage
Step 1, Tier the portfolio by risk
Classify third-party relationships by criticality, data sensitivity and concentration. The tier determines which provisions are expected, and it is the document an examiner will ask for when questioning why a given contract is structured as it is.
Step 2, Extract provisions across the portfolio
Pull the relevant clause-level facts from executed agreements: audit rights and their limits, notification windows, subcontracting terms, continuity commitments, termination and transition provisions, insurance and indemnity. Manual review does not scale past a few hundred agreements.
Step 3, Compare coverage against tier expectations
Build the matrix of expected provisions by tier and report coverage against it. The output is both a remediation backlog and the evidence that the institution has assessed adequacy rather than assumed it.
Step 4, Remediate on the renewal calendar
Sequence amendments by risk tier and contract renewal date. Mid-term amendment requests to well-entrenched providers consume negotiating capital that is better spent at renewal, except where the gap is material to a critical relationship.
Step 5, Track the oversight obligations
Audit report receipt, continuity test results, remediation deadlines and notification duties are recurring obligations. Holding them in a register with owners and dates is what converts contractual rights into demonstrable oversight.
See provision coverage across the third-party portfolio
Aavenir extracts audit, security, continuity and termination provisions from executed vendor agreements and reports coverage against your risk tiering.
Why the evidence problem is bigger than the drafting problem
Institutions frequently respond to a finding by improving their contract template. That addresses new agreements and does nothing for the several thousand already executed, which is where examination scope actually sits. The harder and more useful work, and the substance of third-party risk contract automation, is establishing what the existing portfolio says, tier by tier, and being able to produce that answer on request with the underlying documents attached. Institutions that can do this tend to find that the remediation list is shorter than feared and that the ability to produce it quickly is itself persuasive evidence of a functioning program. Those that cannot spend examination cycles assembling answers manually, which reads as a control weakness regardless of what the contracts actually contain. There is a second, quieter cost to the manual approach. When establishing what a contract says takes days, the risk function stops asking, and provision gaps that would have been caught during a routine relationship review instead surface during an examination.
Expected provision depth by relationship tier
The table below reflects how institutions commonly structure provision expectations across tiers. The specific thresholds are an institutional judgment, but the principle that expectations scale with risk is consistent across supervisory guidance.
| Provision | Critical relationship | Non-critical relationship |
|---|---|---|
| Audit rights | Direct audit plus independent reports on cadence | Independent report on request may suffice |
| Service levels | Quantitative targets with credits and remediation | Qualitative standards may be adequate |
| Incident notification | Defined short window, with assistance duties | Prompt notification with reasonable assistance |
| Subcontracting | Prior approval and full flow-down | Notification and security flow-down |
| Transition assistance | Defined period, format and cost basis | Reasonable cooperation on exit |
Supervisory guidance on third-party contracts is not asking institutions to include a fixed set of clauses. It is asking them to know what their contracts say, to have decided that those provisions fit the risk, and to be able to show both. Institutions that approach it this way generally find their template work becomes easier as a side effect, because the coverage analysis shows which provisions are routinely negotiated away and which hold, and the template can be rebuilt around what the portfolio actually achieves rather than what it aspires to. That is a portfolio analysis and evidence problem more than a drafting one, and it is why institutions with clause-level visibility across their executed agreements, and examination evidence they can produce on request, generally have shorter examinations than those with an excellent template and a document store.
For related guidance, see Vendor contract controls for OCC and FFIEC exam readiness, The bank’s guide to DORA ICT third-party contract terms and Bank fintech partnership agreements, the control questions.
