US Bank Examiners Put Core-Provider Contracts on the Supervision Map

US bank regulators have told examiners to consider core providers' billing, contract terms and technology when deciding the nature, extent and frequency of supervisory work. The Federal Reserve distributed the policy as SR 26-7 on 5 October, following a joint statement issued by the Fed, Federal Deposit Insurance Corporation and Office of the Comptroller of the Currency on 11 September.

The move puts commercial conduct inside the machinery that allocates examinations. It does not cap fees, cancel contracts or establish that community banks have gained bargaining power. The first test is whether the agencies change which providers they examine, what they ask for and what they disclose to client banks.

The scope follows the function

The joint statement defines a core provider by what it operates, not by a product label. The category covers third parties supplying critical applications or infrastructure for transaction processing, account management, payments, customer relationship management, compliance and reporting, online banking or another material function.

That breadth matters. A company need not run the deposit ledger to fall within the frame if its systems support an essential banking function.

The supervised bank population still follows agency jurisdiction. The OCC covers national banks and federal savings associations. The Fed covers state member banks and relevant holding companies. The FDIC covers insured state nonmember banks and state savings associations, as set out in section 3(q) of the Federal Deposit Insurance Act. For the Fed, the community banking program covers domestic state member banks, bank holding companies and savings and loan holding companies with less than $10 billion in assets. The joint policy does not create one new asset threshold across all three agencies.

Concentration turns contract friction into supervisory risk

The market structure explains the intervention. A Federal Reserve Bank of Kansas City study found that Fiserv, Jack Henry and FIS served more than 70% of banks surveyed in 2022. Fiserv alone served 42%.

The installed base is sticky. Jack Henry's latest annual filing reports core systems at more than 900 banks and more than 700 credit unions. Hosted core and recurring payments clients typically sign six-year contracts. The American Bankers Association's 2024 survey drew 780 bankers and 15 providers. Only 19% of bank respondents said they were likely to convert at their next renewal, while 69% were likely to stay.

Those figures do not prove abuse. They show why exit rights, integration access and information asymmetry deserve more weight than they would in an ordinary software contract. A bank can dislike a provider and still rationally avoid a multi-year conversion of its account system.

Examiners now have a contract-level allocation rule

The agencies already examine banks' third-party risk management and conduct risk-based reviews of some providers. The statement specifies what can move supervisory resources.

On transparency, examiners can consider whether a provider supplies timely due-diligence material such as audit, security and penetration-testing reports. They can weigh measurable service levels, incident disclosure and billing that a bank can reconcile. Contract clauses that impede comparisons with rival offers also count.

On contract design, the list is unusually concrete: opaque pricing, extensive back-billing windows, unsupported or undefined deconversion fees and excessive restrictions on integrations with unaffiliated providers. A deconversion charge is not automatically suspect. The statement singles out fees that lack contractual support, especially after a provider breach, inadequate service or a possible legal violation.

Technology enters the same allocation decision. Agencies can examine security-incident frequency and severity, management of end-of-support and end-of-life assets, and demonstrated operational resilience.

These factors can affect targeted or full-scope exams, their frequency, the contents of reports shared with client banks and whether a provider enters the service-provider examination program. That is the policy's operative change. A difficult contract term can now help determine where supervisors spend scarce examination time.

Direct liability is possible, not automatic

The statement also points to a route for action against a provider. Under 12 USC 1813(u)(3), an agency can determine by regulation or case by case that a person who participates in the conduct of an insured bank's affairs is an institution-affiliated party.

The agencies argue that some core providers may meet that test because they run central back-end operations and customer interfaces without which a bank could not provide its services. That opens the possibility of direct liability for a bank's practices or violations. It is not a blanket designation of Fiserv, FIS, Jack Henry or every technology vendor.

Nor does outsourcing transfer the bank's duty. The statement says the bank remains responsible for safe and sound operations and compliance, whether an activity is performed internally or by a third party. Examiners can act against the provider, the bank or both.

The outcome evidence has not arrived

As of 6 October, the agencies had not publicly identified a provider newly added to the examination program, a change in examination frequency, a new report supplied to client banks or an enforcement case based on the statement. No major provider had publicly announced revised pricing, exit fees or integration terms in response.

Jack Henry offered the clearest early reaction at its 15 September investor day. Management said its product terms are coterminous, argued that several criticised practices do not describe the company and said it was not especially concerned. That is a provider's defence of existing practice, not evidence that the policy changed a contract.

The scorecard is therefore straightforward. Watch exam selection and frequency, the information banks receive, contract changes at renewal, integration access, exit costs and any case-by-case institution-affiliated-party action. If those measures do not move, the statement will remain an allocation signal. If they do, contract language will have become a prudential tool.