Banks Need Clearer Rules for the Cloud They Already Depend On

The United States' main bank regulators have opened a consequential question about who really runs the financial system. The Federal Reserve, FDIC, National Credit Union Administration and Office of the Comptroller of the Currency asked for comments Friday on proposed guidance for managing third-party relationships, including the outside providers on which banks increasingly rely.

The agencies describe the proposal as principles-based and non-binding. They say it would help banks and credit unions tailor oversight to the risk of each relationship, and that a final version would replace existing third-party guidance. The agencies also issued a statement about community banks' engagement with core service providers, while the Fed proposed a companion guide for the community banks it supervises. Comments are due 60 days after publication in the Federal Register.

The policy problem is real. A bank may own the customer relationship while a cloud company, software vendor or fintech partner carries the data, payments or operational process that makes the relationship work. A failure at one provider can therefore become a concentration event across many institutions. But supervision becomes brittle when non-binding guidance quietly functions as law, with firms learning the real standard only during an examination.

The agencies should publish a risk taxonomy, model examination questions and anonymised examples of the evidence that would trigger escalation. They should also identify which duties belong to the bank, which can be tested through a provider and which require a regulator-to-provider channel. That would let smaller banks buy useful technology without pretending that a checklist can substitute for resilience, and it would give vendors a clear incentive to document recovery, subcontracting and data controls.

The goal should be fewer surprises, not more paperwork. Regulators are right to update a framework built for a financial system that now runs through a dense vendor network. They should make the framework transparent enough that banks can comply before a failure, rather than discover after one that voluntary guidance had become an invisible rule.