New OCC guidance calls for comprehensive third-party risk management and oversight

November 2013
  • Print-friendly version
New OCC guidance calls for comprehensive third-party risk management and oversight

At a glance

This brief newsletter highlights the key changes reflected in Bulletin 2013-29, and the recommended actions for our clients to take now.

On October 30, 2013, the Office of the Comptroller of the Currency (OCC) released new guidance (Bulletin 2013-29) for regulated entities to assess and manage risks associated with their third-party relationships. This new guidance replaces the previous bulletin on this subject area, OCC Bulletin 2001-47, which has been in place for more than a decade.

The new bulletin emphasizes the risk management life cycle to include planning, due diligence, ongoing monitoring, contracting, termination, and the need throughout the life cycle for appropriate levels of oversight, documentation, reporting, and independent reviews.

While the principles have remained consistent with the previous bulletin, there is an extensive expansion across all components within the third party risk management process.