Overview

When a provider serves many banks, an individual bank sees its own exposure while supervisors can compare arrangements, examine significant providers where authority permits, and coordinate across institutions, sectors, and borders. This chapter explains how U.S. and BCBS approaches add visibility into systemic concentration without guaranteeing controls or replacing bank-specific judgment.

Learning outcomes

A provider examination adds evidence about shared services but is not a seal of approval or a guarantee for every bank configuration.
Supervisors can identify systemic concentration by aggregating registers, dependency maps, recovery plans, and incident reports across institutions.
Supervision and coordination add visibility; each bank still owns its service decision, continuity response, and obligations.

Keywords

SupervisionSystemic riskExaminationsCoordinationConcentrationInformation sharing

When One Provider Serves Many Banks

This chapter widens the subject from one bank’s dependency map to the supervisory network around a provider serving many banks. The focus is the boundary between what an individual bank must manage directly and what supervisors can see only by comparing institutions, examining providers, and coordinating across infrastructure sectors and borders. Understanding that boundary helps the reader use supervision as an additional source of visibility without mistaking it for a replacement for bank accountability.

U.S. supervision follows the service into the provider

A provider does not become irrelevant to supervision merely because it is a separate legal entity. If its service can affect a bank’s safety, soundness, or ability to operate, the provider’s performance is part of the risk a supervisor may need to understand. The exact legal authority depends on jurisdiction. In the United States, the Office of the Comptroller of the Currency (OCC) reports that it examines certain third-party services provided to banks under authority from the Bank Service Company Act and the Home Owners’ Loan Act. Those examinations are often coordinated with the Federal Reserve Board and the Federal Deposit Insurance Corporation.

This is not a claim that every supplier to every bank receives the same treatment. The OCC’s 2026 Cybersecurity and Financial System Resilience Report describes a programme focused on significant service providers. It says providers are identified for examination using factors such as the criticality of the services supplied, the number of banking institutions served, and the total assets serviced. The selection logic follows potential impact: a provider that supports a critical service for many institutions presents a different supervisory question from a provider whose replaceable service affects one bank in a limited way.

The services named in the report illustrate the operating boundary. The programme can focus on core banking services, including loans, deposits, and balance-sheet activities; payment services; technology infrastructure; mortgage processing; and trust services. These are not all equivalent, but they share a feature that matters for supervision: a failure at the provider can affect a bank’s ability to perform functions that customers, counterparties, or authorities depend on.

The examinations use interagency guidance, the Federal Financial Institutions Examination Council’s Information Technology Examination Handbook, and other applicable material. The OCC, Federal Reserve, and FDIC have implemented a consistent framework for cybersecurity assessments of services provided by third parties, according to the report. Annual strategies set supervisory goals for a specific provider based on the risk profile of the services supplied to client institutions, cybersecurity-related activities, and emerging risks across the sector.

Risk-based selection also explains why a provider examination is not a seal of approval. The examination effort is directed toward the services and risks that deserve supervisory attention, and the strategy can change as the provider’s portfolio, technology, or threat environment changes. An examination report may identify deficient practices and give client banks information they could not obtain from their own relationship alone. It does not mean that every control was tested in every client configuration or that future conditions will match the examination period.

Published by DeepMox

FAQ

Why is a provider examination not a seal of approval for a bank?

A provider examination is not a seal of approval because it is risk-based, time-bound, and may not test every control in every bank’s configuration. The bank must connect findings to its own service, data, dependencies, and tolerance.

How can supervisors detect systemic concentration that a bank cannot see?

Supervisors can compare bank registers, dependency maps, recovery and resolution plans, and incident reports, then use scenario analysis and data analytics to identify shared providers or dependencies.

What is the limit of cross-sector and cross-border coordination?

Coordination cannot erase different legal powers, notification practices, access limits, or uncertainty in complex supply chains. It connects partial views but does not replace bank-level diagnosis and continuity planning.

Previous11 minBank Service Monitoring, Incidents, and Recovery

Next9 minCritical Bank Service Accountability by Design

Supervision When One Provider Serves Many Banks

When One Provider Serves Many Banks

U.S. supervision follows the service into the provider

FAQ