OCC Bulletin 2013-29 requires national banks to manage third-party relationships across the full lifecycle — due diligence, ongoing monitoring, and documented oversight for critical activities. VendorAuditly automates OCC-aligned vendor assessments and generates examiner-ready evidence packs without a dedicated compliance team.
OCC Bulletin 2013-29 (supplemented by interagency guidance in 2021 and 2023) sets out a lifecycle framework for managing third-party relationships. The framework applies to all OCC-supervised institutions — national banks and federal savings associations.
Before entering a third-party relationship, banks must assess the risks posed by the activity and the proposed provider. For critical activities, this includes a formal business case, risk assessment, and due diligence plan. OCC examiners expect to see this documented before contract execution.
Due diligence depth scales with the risk and criticality of the activity. For critical activities, banks must assess financial condition, business experience, risk management practices, information security, business continuity, and sub-contractor reliance. Evidence of completion must be on file.
Critical activities require enhanced due diligenceOCC-supervised banks must ensure third-party contracts include: scope of arrangement, performance standards, audit rights, regulatory access, sub-contracting controls, data security requirements, business continuity obligations, and termination provisions. Missing provisions are a common examiner finding.
Banks must monitor third-party performance against contract standards throughout the relationship. For critical activities, this includes periodic reviews, tracking of SOC reports, financial statements, incidents, and complaints. The evidence of monitoring matters as much as the monitoring itself.
Banks must maintain termination plans for critical activities that address data return, transition timelines, and business continuity during the exit. OCC examiners check whether banks can exit critical third-party relationships without operational disruption.
OCC Bulletin 2013-29 identifies “critical activities” as third-party relationships that warrant heightened due diligence and more frequent monitoring. These are the relationships OCC examiners sample first.
A relationship is a critical activity if it involves: significant bank functions (e.g. core banking, payments, technology infrastructure), contains sensitive customer information, has significant customer impact if it fails, or relies on a provider that is difficult to replace quickly. Banks must formally document which relationships are critical.
For critical activities, OCC examiners expect: board-level awareness and approval, dedicated relationship owners, documented due diligence with evidence, periodic review reports (annual minimum), sub-contractor mapping, and formal contingency and exit planning. The absence of any of these for a critical activity is a likely examiner finding.
Common finding: monitoring documented in policy but not evidenced in practiceOCC Bulletin 2013-29 requires banks to understand and manage the risk from their critical providers’ own sub-contractors. Banks must ensure their contracts allow them to receive information about material sub-contractors and that critical providers have appropriate sub-contractor oversight programmes.
In June 2023, the OCC, Federal Reserve, and FDIC issued joint guidance aligning their third-party risk expectations across US banking regulators. The guidance reinforces the OCC Bulletin 2013-29 lifecycle framework and clarifies that all banks — including community banks — are expected to have a risk-based programme proportionate to their size and complexity.
VendorAuditly automates the OCC third-party risk management lifecycle for community banks and OCC-supervised institutions that don’t have a dedicated compliance function.
Maintain a complete, live inventory of all third-party relationships with risk tier classification (Critical, High, Medium, Low), relationship owner, data access level, and contract dates. OCC examiners can see at a glance that your inventory is current and systematically classified.
Send vendors security questionnaires covering information security practices, business continuity plans, sub-contractor reliance, and data handling. Questionnaire responses are timestamped and stored per vendor — documenting that due diligence was completed before contract execution.
Track contract expiry dates, renewal terms, and AI-assisted contract clause analysis. VendorAuditly flags missing provisions required by OCC guidance — including audit rights, regulatory access, data security requirements, and sub-contractor controls — so gaps are caught before an examiner does.
VendorAuditly runs continuous monitoring across all vendors: live risk score recalculation, breach watchlist screening (HIBP + CISA KEV), and website availability monitoring. Every monitoring event is timestamped, giving examiners a dated evidence trail that monitoring happened — not just that a policy says it should.
Generate a complete evidence pack covering your entire third-party register: vendor inventory, risk classifications, due diligence records, contract status, certificate tracking, and monitoring history. Structured, dated, and ready to present at an OCC examination without additional preparation.
Most community banks manage third-party risk in spreadsheets and email threads. OCC examiners can tell. VendorAuditly gives examiners what they expect to see: a systematic, documented, dated programme.
OCC examiners don’t expect community banks to have a GRC platform costing $100k/year. They do expect a systematic, documented approach to third-party risk management that can be evidenced quickly on request. VendorAuditly provides exactly that, at a price that fits a community bank’s budget.
Live vendor register, timestamped due diligence, contract tracking, and one-click evidence pack — at $49/month.
No credit card required. Set up in under an hour.