Question 1

What is third-party risk management (TPRM) under US banking regulations?

Accepted Answer

TPRM under US banking regulations is the structured process of managing risks from vendors, service providers, and partners as defined by the OCC/FDIC/Federal Reserve Interagency Guidance on Third-Party Relationships (June 2023). It covers the full vendor lifecycle from planning and due diligence through ongoing monitoring and termination. Banks retain full regulatory responsibility for all activities performed by third parties on their behalf.

Question 2

Does BSA/AML responsibility transfer to a vendor under US law?

Accepted Answer

No. Under FinCEN's BSA framework, a bank that engages a vendor to perform BSA/AML functions — such as transaction monitoring, SAR filing support, or CIP processing — remains fully responsible for BSA/AML compliance. Any violation by the vendor is treated as a violation by the bank. Banks must assess vendor BSA/AML controls during due diligence and conduct periodic testing.

Question 3

What does the OCC interagency guidance require for high-risk vendor contracts?

Accepted Answer

For high-risk vendors, contracts must include: SLAs with measurable performance standards, regulatory examination access rights, bank audit rights, data security and confidentiality obligations, GLBA-compliant incident notification timelines (30 days to primary regulator), termination provisions allowing exit for regulatory non-compliance, and sub-outsourcing controls.

Question 4

How does NY DFS Part 500 affect vendor risk management?

Accepted Answer

NY DFS Part 500 (Cybersecurity Requirements for Financial Services Companies) requires covered entities to ensure third-party service providers that access their systems or non-public information maintain minimum cybersecurity standards. This includes annual due diligence, contractual protections, and third-party policy monitoring. Violations can result in NY DFS enforcement actions and civil money penalties.

Question 5

What are the consequences of TPRM programme failures for US banks?

Accepted Answer

Consequences include OCC Matters Requiring Attention (MRAs) and Matters Requiring Immediate Attention (MRIAs), formal agreements or consent orders, civil money penalties (which can reach millions of dollars), FinCEN enforcement actions for BSA-related TPRM failures, reputational damage, and in serious cases, restrictions on new business activities until remediation is complete.

Question 6

What is the difference between a compliance risk assessment and a BSA/AML risk assessment?

Accepted Answer

A compliance risk assessment is the general term for any structured evaluation of an institution's exposure to regulatory breach and its consequences. A BSA/AML risk assessment is the specific type of compliance risk assessment required by FinCEN regulations and evaluated through the FFIEC BSA/AML Examination Manual. The BSA/AML risk assessment must cover the institution's products and services, customer base, geographies, and delivery channels — scoring each for money laundering, terrorist financing, and sanctions risk. It sits above the Customer Risk Assessment (CRA), which applies the institution's risk methodology to individual customer relationships. A comprehensive compliance risk program addresses both, along with other regulatory obligations such as OFAC screening, consumer protection, and data security.

Question 7

How often should a BSA/AML compliance risk assessment be reviewed?

Accepted Answer

Federal examiners expect the BSA/AML risk assessment to be reviewed formally at least once per year, with the review documented and approved by the designated BSA officer and the board or a board committee. In practice, a review should also be triggered by any of the following: launch of a new product or service, entry into a new geography or customer segment, a significant internal incident (fraud, regulatory breach, SAR filing trend anomaly), a material change in the regulatory framework, or a new FinCEN advisory or OFAC designation affecting the institution's risk profile. Annual review is a minimum, not a target — mature compliance functions embed continuous monitoring so that the formal annual review confirms a position already well understood by management.

Question 8

What happens if the board treats compliance risk management as a checkbox exercise?

Accepted Answer

The consequences of board-level disengagement from compliance risk management are both regulatory and personal. Under the OCC's Individual Accountability Policy and FinCEN's enforcement framework, BSA officers and senior executives can face individual enforcement actions — including civil money penalties and prohibition orders — when systemic compliance failures are linked to governance deficiencies at the management level. The DOJ's Guidance on Corporate Compliance Programs makes explicit that prosecutors assess whether senior leadership was genuinely engaged in compliance oversight or merely signed documents prepared by the compliance team. Beyond individual exposure, institutions whose boards treat compliance as a checkbox are more likely to have under-resourced compliance functions, delayed remediation of identified gaps, and cultures of non-escalation — all of which compound regulatory exposure over time.

Question 9

What are the consequences of an inadequate compliance risk assessment in the US?

Accepted Answer

The consequences operate at three levels. First, regulatory: FinCEN can impose civil money penalties up to $1 million per day per violation for willful or negligent BSA violations, and the OCC can issue consent orders, formal agreements, and civil money penalties against institutions whose BSA/AML programs — including their risk assessments — are found to be inadequate. OFAC civil money penalties can reach $250,000 per violation or twice the transaction amount. Second, criminal: individuals and institutions can face criminal prosecution for BSA violations, with penalties of up to 10 years' imprisonment and $500,000 in fines per violation for individuals. Third, reputational: regulatory enforcement actions, consent orders, and public penalty orders cause direct harm to correspondent banking relationships, investor confidence, and the institution's ability to operate in certain markets or product lines.

Question 10

Does a community bank need a formal compliance risk assessment?

Accepted Answer

Yes. The BSA and FinCEN regulations apply to all covered financial institutions regardless of size. OCC Bulletin 2025-37, issued November 24, 2025, updated BSA/AML examination procedures specifically for community banks — now defined as institutions with assets up to $30 billion — confirming that these institutions are expected to maintain risk-based BSA/AML programs commensurate with their actual risk profiles. The proportionality principle means that a community bank's risk assessment will be less complex than that of a global bank, but it must still be documented, risk-based, and current. The OCC has taken enforcement action against community banks as well as large institutions. Regulators have made clear that asset size reduces the complexity of the required framework, not the obligation to have one.

Compliance

Third-Party Risk Management (TPRM): Complete US Guide 2026

Compliance Risk Assessment: A Practical Guide for US Financial Institutions

Governance Risk Management Compliance (GRC): US Guide 2026

How to Build a Document Compliance Program from Scratch

Document Compliance Guide for Businesses in 2026

Vendor Compliance Certificate Verification: US Guide 2026

KYC: The Complete Guide for US Businesses in 2026

Right to Work Check: US Employer Compliance Guide (I-9 & E-Verify)

Due diligence explained: complete checklist for US businesses

Anti-Money Laundering: Complete US AML Compliance Guide

AMLD6 Beneficial Ownership Verification Requirements

eIDAS 2.0: The EU Digital Identity Wallet

GDPR and Document Management: Practical Compliance Guide

MiCA 2026: Crypto KYC and Identity Rules

France E-Invoicing 2026: Compliance Guide

KYB: Business Document Verification Guide

AMLD6 Compliance: What Changes in 2026-2027

DORA 2026: Document Verification for Finance

Equipment Leasing: Document Compliance in 2026

GDPR and Identity Documents: Compliance Guide

KYC 2026: New Document Verification Requirements in Europe