Regulatory Requirements and Industry Standards for Third-Party Risk Flashcards

The OCC Bulletin 2013-29 (and its 2020 FAQ update) primarily governs third-party risk management for:

Answer: National banks and federal savings associations supervised by the Office of the Comptroller of the Currency

OCC Bulletin 2013-29 is the primary third-party risk management guidance for national banks and federal savings associations (OCC-regulated institutions). It establishes a risk management lifecycle — planning, due diligence, contract negotiation, ongoing monitoring, termination — and is a foundational regulatory reference in U.S. financial services TPRM.

Under GDPR, when a company in the EU transfers personal data to a third-party vendor located outside the EU, which mechanism is commonly used to ensure adequate data protection?

Answer: Standard Contractual Clauses (SCCs) approved by the European Commission

Standard Contractual Clauses (SCCs) — pre-approved contract terms issued by the European Commission — are one of the primary legal mechanisms for transferring personal data from the EU to third parties in countries that lack an adequacy decision. They impose GDPR-equivalent obligations on the recipient vendor. Self-certifications and purchase orders do not satisfy this legal transfer requirement.

The EU's Digital Operational Resilience Act (DORA), which became effective in January 2025, specifically requires financial entities to:

Answer: Manage ICT third-party risk, including contractual requirements for critical ICT providers and oversight of cloud vendors

DORA mandates that EU financial entities manage information and communications technology (ICT) third-party risk systematically. It requires specific contractual provisions with ICT vendors, concentration risk assessments for critical ICT providers, incident reporting obligations, and participation in the oversight framework for designated Critical ICT Third-Party Providers (CTPPs).

The Shared Assessments Standardized Information Gathering (SIG) questionnaire is designed to:

Answer: Provide a common, comprehensive tool for assessing vendor information security and privacy controls across multiple domains

The SIG is a standardized questionnaire maintained by Shared Assessments (the body that administers the CTPRP credential) that covers 19+ control areas including cybersecurity, privacy, BC/DR, and physical security. It is designed to reduce duplicative assessment efforts for vendors by providing a common framework, but it does not replace regulatory assessments, provide certification, or serve as a legal contract.

Under the FFIEC IT Examination Handbook guidance on third-party relationships, which of the following is considered a 'critical activity' requiring enhanced oversight?

Answer: Core banking system processing outsourced to a third-party service provider

The FFIEC guidance defines 'critical activities' as those significant to the financial institution's financial condition, operations, or customer data. Core banking system processing — which handles transactions, accounts, and sensitive financial data — is the archetypal example. Janitorial, printing, and catering services do not involve critical financial operations or sensitive data.

When a vendor holds a SOC 2 Type II report, which party is responsible for reviewing the 'complementary user entity controls' (CUECs) listed in the report?

Answer: The client organization relying on the vendor, to confirm those controls are implemented on its own side

CUECs are controls that the vendor's SOC 2 auditor has identified as necessary at the client (user entity) side to achieve the stated control objectives. The vendor's SOC 2 does not test these — the client organization must verify it has implemented them. A third-party risk professional reviewing a SOC 2 must read the CUECs and confirm the organization's side of the control equation is in place.