The Federal Reserve, the FDIC, and the OCC have issued a joint statement on supervising core service providers to community banks.
The Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) have issued a joint statement clarifying how they will apply risk-based supervision to core service providers used by community banking organisations (CBOs). The statement addresses how CBOs engage with these providers, how that engagement will factor into supervisory decisions, and the agencies' authority to act where a core provider causes or contributes to unsafe practices or regulatory violations.
Why core providers matter to community banks
Core providers deliver the systems and infrastructure underpinning a CBO's essential functions, including transaction processing, account management, payments processing, customer relationship management, compliance and reporting, as well as online banking. The agencies describe these relationships as among the most material, complex, and highest-risk third-party arrangements a CBO maintains, given that the availability, integrity, and security of a core processing platform affect nearly all banking operations.
The statement notes that a small number of large providers account for a significant share of the core provider market, which limits CBOs' negotiating leverage. As a result, CBOs have reported difficulty obtaining adequate due diligence information, negotiating contract terms, and conducting ongoing monitoring, making it harder to hold providers accountable for service quality. The statement references the OCC's Request for Information on community banks' engagement with core service providers, published in the Federal Register in November 2025, as part of the basis for this clarification.
Factors shaping supervisory allocation
The agencies said they will weigh three factors when deciding the nature, extent, and frequency of supervisory activity applied to core providers, and when determining whether to add a provider to their service provider examination programme.
Transparency covers a provider's willingness to share timely due diligence information, contractual limits on a CBO's ability to compare providers, use of measurable service level agreements, disclosure of operational issues and security incidents, and the clarity of billing practices.
In addition, contract features cover terms that may restrict a CBO's ability to exit a relationship or add supplementary providers, including opaque pricing and billing, extended back-billing windows, undefined deconversion fees, and restrictions on integration with unaffiliated service providers.
Technology covers a provider's investment in up-to-date systems, including the frequency and severity of security incidents, management of end-of-support assets, and demonstrated operational resilience.
Enforcement implications
The statement confirms that CBOs retain responsibility for safety, soundness, and regulatory compliance regardless of outsourcing arrangements. It also outlines that the agencies may pursue action directly against core providers, including by determining that a provider qualifies as an institution-affiliated party under the Federal Deposit Insurance Act, on the basis that many core provider services are integral to a CBO's operations and directly affect the banking experience it delivers to customers.
For the payments and fintech ecosystem, the statement signals closer regulatory attention to contractual and technological practices among the concentrated group of core banking technology vendors serving smaller US financial institutions.
