Vendor Management - Bank Service Company Act

Hi,
I am reading "Bank Service Company Act". I just want confirm if I understand it correctly?

The rules apply to my bank only if Bank has investment in certain service company (under section 3 definition).
If we (Bank) don't have any investment in any bank related service company, we don't need to report anything, right?

OR, we need to report any vendors that perform: check and deposit sorting and posting, computation and posting of interest and other credits and charges, preparation and mailing of checks, statements, notices, and similar items, or any other clerical, bookkeeping, accounting, statistical, or similar functions performed for a depository institution

Appreciate any feedback/comments!

12 U.S. Code § 1861

(b)Definitions

For the purpose of this chapter—

(2)the term “bank service company” means—

(A)any corporation—

(i)which is organized to perform services authorized by this chapter; and

(ii)all of the capital stock of which is owned by 1 or more insured depository institutions; and

(B)any limited liability company—

(i)which is organized to perform services authorized by this chapter; and

(ii)all of the members of which are 1 or more insured depository institutions.

The later... you need to report to your regulator that you have a vendor who is performing services for you that meet the definition of a "Bank Service Company".

Section 7(c)(2) of the Bank Service Company Act states that any FDIC-supervised institution that has services performed by a third party "shall notify such agency of the existence of the service relationship within 30 days after the making of such service contract or the performance of the service, whichever occurs first." As defined in Section 3 of the Act, these services include "check and deposit sorting and posting, computation and posting of interest and other credits and charges, preparation and mailing of checks, statements, notices, and similar items, or any other clerical, bookkeeping, accounting, statistical, or similar functions performed for a depository institution." The agencies have also interpreted the notification requirement to include third parties that provide data processing, Internet banking, and mobile banking services.

At our most recent IT Exam, this topic came up. It appears to me that the FDIC at least is taking a very broad interpretation and really pushing banks to report these vendors. For instance, we mentioned that we'd be implementing a BSA/AML platform in the coming year and they commented to be sure we reported it under the BSC Act.

We mentioned that we were moving some financial spreading software from on-premises servers to Azure Cloud Servers and the insisted that Microsoft would need to be reported as a Service Company.

Anyway, seemed like a hot topic for them.

@fmissle, thank you! Same here. The question was up during IT exam. Seems like it's a hot topic now.

@Alison, Thank you for the comment! We are FRB bank and I will assume the same rule applies.

My plan right now is to just send the notice for anything that they could remotely claim is a BSC under the Act. Then, they'll either tell me to stop or I'll just keep doing it.

It's like what I had 5 or 6 years ago. We have a law in Oregon that we have to notify the state regulator anytime there is a risk of loss or loss to the Bank due to a violation of law. No dollar limit. (ORS 707.735) Generally, we complied by providing SAR information to them.

Well, they gave me a verbal comment at an exam one year. So I started sending them every single loss or loss possibility that was related to a violation of law. After about 2 months, they called and we had a discussion about it and they asked me to stop.

Give them exactly what they think they want, until they realize they don't actually want or need it?