There are two separate and distinct notices. One is the "required service provider" notice. This is placed on or with the GFE and tells the applicant the name, address, cost, and relationship of the service provider. The relationship can be that the service provider is a customer of the bank or that the provider is one that the bank regularly uses.
The other notice is the Affiliated Business Arrangement disclosure -- formerly the controlled business arrangement. That notice is provided before making a customer referral to an affiliated business such as the mortgage company. The notice is supposed to be given before making the referral.
In the example, the AfBA notice would be given by the bank to the customer who is asking about a mortgage loan and is referred to the related mortgage company.
Unless the bank or the mortage company has an ownership or control relationship with the flood cert company, there would NOT be an AfBA notice given, but there would be a required service provider notice as a part of the GFE.
It is also worth noting that the lender may not require the applicant to use an affiliated business unless it relates to the safety and soundness of the underwriting process (credit reports, appraisals, and attorneys.)
Isn't RESPA fun?