Thursday, September 29, 2016
Written by

This is part 5 of a Seven Part Guide to reviewing vendor contracts. Part 1 can be found here, and other parts can be found here.

Vendor Notice Requirements

Business -Strategic Changes. There are several categories of events the bank will want to be notified about.  The first involves things like significant strategic business changes, such as mergers, acquisitions, joint ventures, divestitures, or other business activities that could affect the activities involved. In certain instances the bank may want the ability to terminate the contract if the vendor merges with another company or if there is a change in control. Similar to a loan transaction, the bank has “underwritten” the vendor. Bank officers have has met the vendor’s senior management and are comfortable with the general direction of its business. A merger or change of control may change the strategic direction of the vendor and the bank wants to make sure it knows who it is doing business with.

Business Events-Corporate Changes. The contract should address notification to the bank before making significant changes to the contracted activities, including acquisition, subcontracting, off-shoring, management or key personnel changes, or implementing new or revised policies, processes, and information technology. Related provisions in the contract would be sections that without bank consent would prohibit the assignment of the contract; changes in the listed locations of where work is being performed and the use of subcontractors not previously approved by the bank.

Business Events-adverse changes to business operations. This category requires the prompt notification of financial difficulty, catastrophic events, and significant incidents such as information breaches, data loss, service or system interruptions, compliance lapses, enforcement actions, or other regulatory actions. The bank should already have a contingency plan in the event the vendor goes out of business but a timely notification requirement helps to insures that the bank will have adequate time to put the contingency plan into motion.

Business Continuity. The contract should address the issue of what happens if the vendor’s business is affected by natural disasters, human error, or intentional attacks. The contract should define the vendor’s business continuity and disaster recovery capabilities and obligations to enable vendor to continue delivery of the services in the event of a disaster or other service interruption affecting a location from where the services are provided.  Force majeure events should not excuse vendor from performing the business continuity/disaster recovery services. The contract should include the vendor’s disaster recovery plan defining the processes followed by vendor during a disaster including backing up and otherwise protecting programs, data, and equipment, and for maintaining current and sound business resumption and contingency plans. A contract may include provisions—in the event of the third party’s bankruptcy, business failure, or business interruption—that allow the bank to transfer the bank’s accounts or activities to another third party without penalty. Ensure that the contract requires the third party to provide the bank with operating procedures to be carried out in the event business resumption and disaster recovery plans are implemented. Include specific time frames for business resumption and recovery that meet the bank’s requirements, and when appropriate, regulatory requirements. Depending on the critical nature of the serve being provided, the bank may also want to consider stipulating whether and how often the bank and the vendor will jointly practice business resumption and disaster recovery plans.


Tuesday, September 20, 2016
Written by

This is part 4 of a Seven Part Guide to reviewing vendor contracts. Part 1 can be found here, and other parts can be found here.

Services level. Services levels should be defined. For example, are the service to be made available 24/7 365 days a year or are they only needed during normal business hours. When the services involve some type of software or online technology, what is the minimum amount of   “uptime” required? Depending on the services involved, uptime might be 99.9%, for example.  vendors will understandably push back on that figure and might suggest 98%. The right figure need not be either one of those numbers and is dependent on the type of service being provided and its criticality to the bank’s delivery of services to its customers. To the extent there is planned downtime for things such as software updates it should occur during off peak time periods. Service level measures can be used to motivate the third party’s performance, penalize poor performance, or reward outstanding performance. Performance measures should not incentivize undesirable performance, such as encouraging processing volume or speed without regard for accuracy, compliance requirements, or adverse effects on customers. Certain products and services have standards that are common across the industry while others may need to be developed to fit the particular transaction. Service levels should be revisited from time to time during the term of the relationship to provide an opportunity for  them to evolve along with the services being provided.

Banks should consider what type of reporting they want the vendor to provide considering performance against the service level targets and what type of remedies to which the Bank is entitled in the event vendor fails to measure or report on the service levels. Banks should also consider including requiring a root cause analysis for incidents and service level failures. In other words, it is not just sufficient to report a failure, what caused the failure and exactly what needs to be done to remedy it. It can be very frustrating when a vendor’s performance affects customers and the bank is unable to explain to those customers how a problem is being fixed so that it will not reoccur.


Tuesday, September 13, 2016
Written by

This is part 3 of a Seven Part Guide to reviewing vendor contracts. Part 1 can be found here, and other parts can be found here.

Location of where the work to is to be performed

Domestic locations. Where is the vendor actually performing the work? Will they need physical access to the bank premises or equipment?  Will they be on-site during or after business hours? The contract should reference security policies governing access to the bank’s systems, data (including customer data), facilities, and equipment.  The vendor should be obligated to comply with the security policies when accessing such resources. If the work is being done at the vendor’s office, the bank will want approval rights any change in the location. Depending on the type of services being provided, the bank may also want the contractual right to go to the vendor’s offices to view the vendor’s internal security systems.

Subcontractors-generally. An important question for the bank to ask is whether any of the work is being outsourced to a subcontractor. If the vendor is using subcontractors, the bank should consider whether it will want notice of and perhaps approval rights over who is being used. In addition, the contract should make it clear that the bank considers the vendor responsible for the performance of the contract regardless of whether it outsources a portion of the work.  The contract should also make it clear that subcontractors are subject to the same confidentiality and security requirements as the primary vendor. Consideration should be given to adding a contractual provision which requires any subcontractors to verify in writing that they will comply with the privacy requirements.


Thursday, September 8, 2016
Written by

We don’t often post about crimes against banks, especially when they involve clients, but this story out of Kansas City deserves a wider audience.

A 70-year-old man is charged with robbing a Kansas City bank (located just down the street from the police headquarters), after handing a note to a teller indicating that he had a gun and demanding money.  He then proceeded to take the money and a seat in the bank lobby.

When I say he took a seat, I don’t mean he physically removed a chair, but rather that he simply sat down.

His rationale appears to be that he would prefer to live in a jail cell than with his wife, with whom he he’d had an argument.

You can read more about it in the Kansas City Star.

Tuesday, September 6, 2016
Written by

This is part 2 of a Seven Part Guide to reviewing vendor contracts. Part 1 can be found here, and other parts can be found here.


Some contracts will contain several “WHEREAS” clauses at the inception of the document followed by a recitation of various facts about the parties and what they are trying to accomplish by entering into the contract. From a pure legal standpoint, “WHEREAS” clauses are not required but many parties like to include them to properly set the stage for what is to come afterwards. If they are included, the bank needs to review them, particularly those that describe the parties and the services that the vendor will perform. The recitals provide for an introduction to the parties and provide a high level overview of their agreement. It is a bit like looking at a topographical map and following two streams as they wind their way through the mountains before finally coming together. 

If there is a gap between the direction indicated in the recitals and the body of the agreement then there may be legitimate questions about what the true intent of the parties was when they entered into the contract. That becomes significant when a dispute later arises about the work actually being performed as well as the service level of the work. The gap can be created when the vendor uses a version of the contract that was heavily negotiated for a different party but forgets to revert back to its standard form contract when submitting it to the bank. Sometimes it is evidence of lack of sophistication by the vendor who may have simply downloaded the contract off of the internet and uses it without fully understanding the legal implications. Sometimes vendors will respond that they have used a particular form for years and never had a problem. That is confusing luck with carefully draftsmanship.

Nature and scope of the work to be done.

What exactly are the services to be performed? One would expect that the contract will specifically identify the frequency, content, and format of the service, product, or function provided. It is vitally important that the people at the bank, who have the substantive knowledge about the services in question, together with legal counsel, review the scope of services and understand how it relates to other contracts the bank has entered into or strategic initiatives the bank is looking at. A significant factor to keep in mind is whether any fee triggered by an early termination of the contract is of such a size that it becomes a material roadblock to doing a merger or acquisition. There have been instances involving smaller community banks where the termination fee was so large in comparison to the consideration being paid in a planned merger that the deal fell though. Thus, other corporate strategic matters may drive the bank to negotiate a shorter agreement than the vendor normally seeks or to seek out another vendor altogether.


Tuesday, August 30, 2016
Written by


Managing third party vendor relationships has always been an important function in banks. More recently it has become a hot topic for state and federal financial bank regulators. The increasing complexity of what vendors are doing for banks and the related attention to cybersecurity threats all contribute to the greater scrutiny. The 2016 white paper by the OCC, “Supporting Responsible Innovation in the Federal Banking system: An OCC Perspective,” is just one of several guidance documents issued by the federal financial regulators over the past five years that focus to a large extent on third parties providing services and technology to banks. Significantly, some examinations have resulted in the regulators imposing settlements and impose civil money penalties on vendors. Previous to the OCC white paper, the CFPB issued third party guidance in 2012, the FFIEC provided guidance on IT service vendors in 2012 and the OCC and the Federal Reserve issued complementary guidance in 2013 on third party relationships and managing outsourcing risks.

Contractual Requirements

The OCC guidance is generally looked at as the “gold standard” for evaluating issues that need to be addressed in a vendor agreement. That does not mean that every contract a bank signs needs to have every one of those issues addressed or that each one needs to be resolved in favor of the bank. Vendor contracts come in many different shapes and sizes and may affect everything from back office processing, internet delivery systems, use of the “cloud” to the people watering the plants at the branch. vendors will vary from small local operations to multi-national companies. The bargaining power of a bank obviously varies depending on its size. A small community bank is not going to have the same leverage negotiating a vendor contract with a national vendor as a much larger institution. That lack of leverage, however, is somewhat mitigated by the fact that large vendors understand what the regulators are looking for because they hear it from many of their bank customers. That does not mean though that they will always offer it in the first draft of an agreement! Finally, you need to keep in mind that there may be several different ways of approaching a particular issue and drafting the contract language, all of which may be produce an acceptable outcome. As a result, a typical contract may touch on all of the points found in the OCC guidance but the individual contract provisions will fall along a broad spectrum.

The OCC guidance provides a good road map to what state and federal bank regulators (not just the OCC) look for when reviewing a bank’s significant third party contracts. Contracts for significant third party contracts that fail to address the OCC highlighted issues may result in a bank being criticized in an examination report and could be a factor in a CAMELS downgrade of management. Management also needs to be aware that defects in major contracts will come up in due diligence performed in a merger transaction and can affect the viability of a proposed M&A deal. Thus, the “risks” that are being managed are broader than the business risk that occurs because of a non-performance by the vendor and is a good reason why senior management needs to pay close attention to the negotiation of significant vendor contracts.

Vendors should also be examining the guidance and modifying their contracts accordingly because banks are going to be raising the same issues over and over again. Vendor personnel who are on the front lines negotiating contracts need to be aware of the regulatory scrutiny and understand why requests for alterations to the contracts are being made by the bank.


Thursday, July 21, 2016
Written by and

What a difference a week can make! On June 17, 2016, bitcoin was trading at more than $750. Five days later, as polls showed the Brexit vote leaning heavily to “remain,” bitcoin dropped as low as $585. After the vote to leave the European Union became final, the British Pound, the Euro, the Chinese Yuan, and global stocks dropped precipitously. Bitcoin, on the other hand, spiked to more than $676. Could this mean bitcoin is being perceived as a new safe-haven asset?

A Brief Background on Bitcoin Generally

Bitcoin often is described as a “digital currency.” On a more technical level, bitcoin is a digital asset within a peer-to-peer computer network payment system created in 2008 by an anonymous cryptographer going by the pseudonym Satoshi Nakamoto. Because the computer network uses open-source, peer-to-peer software, no truly central authority administers and oversees transactions, and no government controls or backs the digital “currency.” Instead, users or “nodes” on the network verify transactions by solving complex computer algorithms. The verified transactions are then recorded on a public ledger (called the blockchain) for all to see. Because transactions employ lengthy key codes rather than traditional personally-identifiable information, users can trade bitcoin quasi-anonymously.

Because bitcoin lacks government or centralized control, conceptually it is accessible to anyone with an internet connection and eliminates many of the transaction costs associated with traditional currency trading. For the same reasons, however, it can be highly volatile. At the inception of the network in 2009 and through 2012, a single bitcoin was worth mere pennies. In 2013, amid a financial crisis and the seizure of bank accounts in Cyprus, holders of Cypriot accounts began buying massive amounts of bitcoin, which drove the price of bitcoin to more than $260 for the first time. By November 2013, the value of bitcoin peaked at $1,242. The price of bitcoin declined thereafter amid hacking scandals, the insolvency proceeding of Mt. Gox (bitcoin’s then largest exchange), and negative perceptions created by the high-profile criminal case involving the elicit online marketplace known as Silk Road. Despite its volatility over the last seven years, however, bitcoin has endured and shows no signs of disappearing.

Bitcoin as a Safe Haven?

Bitcoin’s sharp rise after the Brexit vote appears to evidence a new confidence in bitcoin as a safe haven. Investment professionals, however, have been extremely reluctant to give bitcoin such status. One recent research note observed that calling bitcoin a safe haven “obfuscates the fact that bitcoin is a high-risk and volatile investment” and ignores that “bitcoin’s correlation to other traditional safe-haven assets has fluctuated significantly.” Instead, bitcoin can be viewed as “something entirely different that does not fit into the normal buckets that investments are typically bracketed into.”


Wednesday, July 20, 2016
Written by

The Federal Reserve Bank of St. Louis just published a short summary of research by economists with the Federal Reserve Bank of Kansas City concluding that compliance costs weigh “quite a bit” more heavily on smaller banks than their larger counterparts in the community banking segment.  Looking specifically at banks under $10 billion in total assets (where additional Dodd-Frank-related burdens are triggered), the study found that the ratio of compliance costs as a percentage of total noninterest expenses were inversely correlated with the size of the bank.  While banks with total assets between $1 and $10 billion in total assets reported total compliance costs averaging 2.9% of their total noninterest expenses, banks between $100 million and $250 million reported total compliance costs averaging 5.9% and banks below $100 million reported average compliance costs of 8.7% of non-interest expenses.

While nominal compliance costs continued to increase as banks increased in size (from about $160 thousand in compliance expense annually for banks under $100 million to $1.8 million annually for banks between $1 and $10 billion), the banks were better able to absorb this expense in the larger banks.  Looked at another way, the marginal cost of maintaining a larger asset base, at least in the context of compliance costs, decreases as the asset base grows.

With over 1,663 commercial banks with total assets of less than $100 million in the United States as of March 31, 2016 (and 3,734 banks with between $100 million and $1 billion), barring significant regulatory relief for the smallest institutions, we believe we will continue to see a natural consolidation of banks.  While we continue to believe there is no minimum size that an institution must be, we also consistently hear from bankers in the industry that they could be more efficient if they are larger… and the research bears them out.

Tuesday, July 12, 2016

In today’s competitive environment, some bank directors may view an acquisition offer from another financial institution as a relief. With directors facing questions of how to gain scale in the face of heightened regulatory scrutiny, increased investor expectations, and general concerns about the future prospects of community banks, a bona fide offer to purchase the bank can change even the most entrenched positions around the board table.

So, how should directors evaluate an offer to sell the bank? A good starting place is to consider the institution’s strategic plan to identify the most meaningful aspects of the offer to the bank’s shareholders. The board can also use the strategic plan to provide a baseline for the institution’s future prospects on an independent basis. With the help of a financial advisor, the board can evaluate the institution’s projected performance should it remain independent and determine what premium to shareholders the purchase offer presents. Not all offers present either the premium or liquidity sought by shareholders, and the board may conclude that continued independent operation will present better opportunities to shareholders.

Once the board has a framework for evaluating the offer, it should consider the financial aspects of the offer. The form of the merger consideration—be it all stock, all cash, or a mix of stock and cash—can dictate the level of due diligence into the business of the buyer that should be conducted by the selling institution.


Thursday, June 30, 2016
Written by

In a blow to banks and the marketplace lending industry, on June 27, 2016, the U.S. Supreme Court denied the petition by Midland Funding to hear the case Midland Funding, LLC v. Madden (No. 15-610).  That case involves a debt-collection firm that bought charged-off credit card debt from a national bank.  The borrower’s legal team argued that a buyer of the debt was subject to New York interest rate caps even though the seller of the debt, a national bank, was exempt from those state law rate caps due to preemption under Section 85 the National Bank Act.  The borrower won on this startling argument and the debt collector appealed to the Supreme Court.  The Office of the Comptroller of the Currency (the regulator for national banks), the U.S. Solicitor General and various stakeholders in the banking and lending industries vigorously argued that the 2nd Circuit’s decision contravened established law.  The fear was that, if preemption strips loans of their usury-exempt status when the loans are sold, then banks’ ability to sell consumer loans, including the common practice of banks originating and quickly selling those loans to investors and marketplace lenders, would be significantly limited, if not curtailed.

The Supreme Court denied the debt collector’s appeal without explanation, which means the 2nd Circuit’s ruling is binding law in that Circuit, which includes New York, Connecticut and Vermont.  However, the 2nd Circuit’s ruling is not the law outside of the 2nd Circuit.