To the Chief Executive Officers of all Bank Holding Companies, State Member Banks, U.S. Branches and Agencies of Foreign Banks, and Edge Corporations in the Second Federal Reserve District:
Banking organizations are increasingly relying on services provided by other entities to support a range of banking operations. The outsourcing of information and transaction processing activities, either to affiliated institutions or third-party service providers, may help banks manage data processing and related personnel costs, improve services, and obtain expertise not available internally. However, the reduced operational control over these outsourced activities may expose an institution to additional risks.
We have established procedures to examine and evaluate the adequacy of controls by banking institutions over service providers, most recently in a paper prepared by this Bank to identify issues and risks associated with the outsourcing of banking activities (see our Circular No. 11193, dated October 14, 1999). The Board of Governors of the Federal Reserve System has issued a supervisory letter to reiterate and clarify the Federal Reserve's expectations regarding the management of risks that may arise from the outsourcing of critical information and transaction processing activities by banking organizations. We would also call your attention to the section of the letter entitled "International Considerations," which contains risk management guidelines regarding outsourcing arrangements to service providers located outside the United States.
In addition, we are planning an industry conference later this year to discuss this topic more broadly. We will send you information on this once the details have been finalized.