Requirements ยท Financial services
Interagency Guidance on Third-Party Relationships
Third-party risk management. 9 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
The Interagency Guidance on Third-Party Relationships: Risk Management was issued in June 2023 by the Federal Reserve Board, the FDIC and the Office of the Comptroller of the Currency. It describes how banking organizations should manage the risks of their relationships with third parties, such as vendors and service providers, through the life of the relationship: planning, due diligence, contract negotiation, ongoing monitoring and termination.
Source: OCC Bulletin 2023-17. This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- Interagency Guidance on Third-Party Relationships: Risk Management (2023) 7 products
- Interagency Guidance on Third-Party Relationships: Risk Management 2 products
For what it requires of your organization, read the rule itself or ask your counsel.
Products
The 9 products that support it
API Security & Integration
Securing the connectivity between legacy mainframes (COBOL) and modern fintech apps.
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
ATM & Cash Logistics Optimizer
Predictive analytics for branch cash replenishment, minimizing idle cash holding costs (non-earning assets).
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management
Business Continuity Planning
Managing disaster recovery plans and automated testing logs for examiners.
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
CRM for Finance
Managed Salesforce Shield encryption with key material held by Moraph outside Salesforce, so Salesforce does not store your decryption keys. Field permissions remain your decision.
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
Crypto-Asset Custody Bridge
A control layer allowing banks to hold digital assets via sub-custodians while maintaining the legal ledger of record. Permission to offer custody is for the bank and its regulators.
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
Dynamic Collateral Monitor
Middleware connecting to borrower ERPs (NetSuite) to reconcile reported receivables for asset-based lending, helping detect "air lending" fraud. Field exams and credit decisions remain the lender's.
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
Public Cloud Infrastructure
Managing the tenant with "Policy as Code" guardrails designed to block public S3 buckets holding consumer data. Guardrails reduce, not remove, misconfiguration risk; data decisions remain yours.
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
Third-Party Risk Scoring
Continuous credit-rating-style monitoring of vendor security postures.
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management (2023)
Vendor Risk Management (VRM)
Centralized repository for tracking third-party SOC 2 reports and insurance certificates, automating vendor due diligence.
Lists:
- Interagency Guidance on Third-Party Relationships: Risk Management
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.