FFIEC Vendor Management Requirements: What Examiners Check

The institution is accountable, not just the vendor

Under FFIEC guidance, a bank or credit union cannot outsource its regulatory responsibility along with the function itself. If a core processor, cloud provider, or fintech partner fails — operationally or on security — the examiner's questions go to the institution's own oversight process, not just the vendor's contract terms. That's the single most important thing to understand walking into an exam: the vendor relationship is evaluated as an extension of the institution's own risk management, not a separate category.

The guidance examiners work from

There is no single "FFIEC vendor management rule." Examiners draw on a small set of documents, and knowing which one applies tells you what evidence to have ready:

• Interagency Guidance on Third-Party Relationships: Risk Management (June 2023). Issued by the Federal Reserve, FDIC and OCC, it replaced each agency's earlier vendor guidance and organizes oversight around the full relationship life cycle: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination.
• FFIEC IT Examination Handbook, Outsourcing Technology Services booklet. The examiner's procedures for technology service providers specifically.
• Appendix J, "Strengthening the Resilience of Outsourced Technology Services" (Business Continuity Management booklet). Covers third-party capacity, testing with service providers, cyber resilience, and the institution's ability to recover if a provider cannot.
• NCUA supervisory guidance for credit unions, which follows the same principles even though NCUA's direct authority over vendors is narrower than the banking agencies'.

What examiners actually check

Due diligence before the contract was signed

Examiners look for documented evidence that the institution assessed a vendor's financial condition, security posture, business continuity capability, and legal/regulatory standing before onboarding — not just a sales conversation and a signature. If the file shows no pre-contract risk assessment, that's a finding regardless of how the vendor has actually performed since.

Risk-tiering proportional to criticality

Not every vendor needs the same scrutiny. Examiners expect institutions to classify vendors by criticality — a core banking platform and an office-supplies vendor don't belong in the same review cycle — and apply oversight intensity accordingly.

Contract provisions, specifically

Examiners look for specific clauses: defined performance standards, the institution's right to audit, data security and breach-notification obligations, subcontracting/fourth-party disclosure, and clear termination and data-return terms. A contract that's silent on these is treated as a gap, even if the relationship has been trouble-free.

Ongoing monitoring, not a one-time review

Annual or periodic reassessment — financial health checks, SOC 2 or equivalent report review, incident history — is expected for critical vendors. A due-diligence file that hasn't been touched since onboarding is a common exam finding.

Board and senior management oversight

Examiners expect evidence that vendor risk is reported at a governance level appropriate to its materiality — critical vendor relationships should appear in board or senior-management risk reporting, not live only in a procurement folder.

Contingency and exit planning

What happens if the vendor fails, is acquired, or has to be replaced quickly? Examiners look for a documented contingency plan for critical relationships, not an assumption that switching would be straightforward if it ever came to that. For technology providers, Appendix J sharpens this: expect questions about whether recovery plans were tested with the provider, not just written.

FFIEC vendor due diligence checklist

For a critical vendor, the due-diligence file should show that the institution looked at each of these before signing, and refreshed them at renewal:

• Strategy and fit: why this vendor, and how the service supports the institution's own plans
• Legal and regulatory compliance, including any enforcement actions or litigation
• Financial condition, using audited statements where available
• Business experience and the qualifications of key personnel
• Information security program and independent assurance (SOC 2 Type II or equivalent)
• Operational resilience: business continuity, disaster recovery and test results
• Incident management and how quickly the vendor will notify you
• Reliance on subcontractors and other fourth parties
• Insurance coverage appropriate to the service

Scale the depth of each item to the vendor's criticality tier; a non-critical vendor may need only a few of these.

Where institutions most often fall short

In practice, the gap is rarely the absence of a vendor management policy — most institutions have one. It's inconsistent execution: pre-contract diligence that isn't repeated on renewal, criticality tiers that were set once and never revisited as usage grew, and contract files missing the specific clauses examiners look for. A structured, independent review of vendor contracts and oversight documentation before an exam — not during one — is the most reliable way to close those gaps. This is the kind of review MALA runs as part of a technology reality assessment, at zero upfront cost, for institutions that want an outside set of eyes on vendor risk before an examiner provides one.

Related reading: HIPAA and vendor risk for healthcare IT leaders · a practical third-party risk framework · technology advisory for banks and credit unions

About the author: Eric Anderson is the Founder and President of MALA Technology Advisors. After two decades working with organizations ranging from early-stage startups to Fortune 500 enterprises, he saw the same pattern repeat: significant technology decisions being made without independent, vendor-neutral expertise at the table. He founded MALA to close that gap, and now leads its advisory practice across cybersecurity, cloud, AI infrastructure, and technology procurement.