District Circular Letters

• District Circular Letters Index

March 31, 1998

BANKING SUPERVISION AND REGULATION:
INTERAGENCY GUIDANCE REGARDING YEAR 2000

To Bank Holding Companies, State Member Banks,
Edge Act Corporations, U.S. Branches and Agencies
of Foreign Banks, and Others Concerned
in the Twelfth Federal Reserve District

Guidance Regarding the Year 2000

The member agencies of the Federal Financial Institutions Council (FFIEC) are continuing to monitor the progress being made by depository institutions as they address Year 2000 issues, as well as to offer guidance to assist institutions' Year 2000 preparations. Accordingly, the Federal Reserve Bank of San Francisco is pleased to provide the enclosed publications, the fourth and fifth in a series of FFIEC guidances addressing safety and soundness issues pertaining to the Year 2000.

Year 2000 Impact on Customers

The advisory entitled "Guidance Concerning the Year 2000 Impact on Customers" describes the responsibilities of each depository institution's senior management and board of directors for assessing the risks arising from the failure or inability of the institution's customers to address their Year 2000 exposure. More specifically, the guidance

• prescribes a due diligence process that identifies, assesses, and establishes controls for the Year 2000 risk posed by three categories of customers: funds takers, funds providers, and capital market/asset management counterparties;
• points out that each depository institution should have a due diligence process in place by June 30, 1998, and that the assessment of customer preparedness and the resulting impact on the institution should be substantially completed by September 30, 1998;
• advises that management at each institution should 1) identify to its board of directors those of the institution's material customers who are not effectively addressing Year 2000 problems and 2) summarize the actions management has taken to contain the resulting risk; and
• provides models of information collection processes that depository institutions have used to help identify and manage their customer-related Year 2000 customer risk.

Due Diligence Regarding Service Providers and Software Vendors

The advisory entitled "Guidance Concerning Due Diligence in Connection with Service Provider and Software Vendor Year 2000 Readiness" explains that senior management and the boards of directors of each depository institution should establish a due diligence process for determining the ability of their service providers and software vendors to be Year 2000 compliant. The guidance states that an effective due diligence program is able to

• identify and assess mission-critical services and products provided by service providers and software vendors;
• monitor the progress made by service providers and software vendors toward Year 2000 compliance;
• establish a process for testing remediated products in the depository institution's own environment to the extent possible; and
• establish contingency plans for each mission-critical product and service.

The guidance also identifies the information depository institutions should obtain from service providers and software vendors concerning Year 2000 readiness and advises depository institutions to establish "trigger dates" for changing service providers and software vendors, when necessary, to allow sufficient time to achieve readiness with new vendors.

Please feel free to forward a copy of one or both of these Interagency Statements to your customers, vendors, and third party service providers.

For Additional Information

For additional information regarding the Federal Reserve's Year 2000 bank supervision program, please contact Mr. Robert Johnson, Assistant Vice President, Banking Supervision and Regulation, at (213) 683-2738.

If you have questions about the Federal Reserve System's Century Date Change Project, please contact your local Business Development office, as listed below:

FEDERAL RESERVE BANK OF SAN FRANCISCO