District Circular Letters

December 26, 2000

BANKING SUPERVISION AND REGULATION: GUIDANCE ON TECHNOLOGY OUTSOURCING

To State Member Banks, Bank
Holding Companies, U.S. Branches and
Agencies of Foreign Banks, and Others Concerned
in the Twelfth Federal Reserve District

The federal banking agencies recently issued a supplemental guidance on managing risk when outsourcing technology services. Banking organizations should consider this guidance when assessing the scope and importance of outsourcing services to their enterprise, as well as the risks resulting from those services. This new guidance contains many of the same sound practices and recommendations set forth in SR letter 00-4, "Outsourcing of Information and Transaction Processing," which was issued by the Federal Reserve on February 29, 2000. The interagency guidance provides banking organizations with additional specific information that may be useful to consider on topics relevant to their outsourcing management practices.

The interagency guidance focuses on the risk management process of identifying, measuring, monitoring, and controlling the risks associated with outsourcing technology services. While outsourcing can improve banking services, control costs, and provide the technical assistance needed to maintain and expand product offerings, it also introduces additional risks that need to be addressed. The guidance includes four key elements to address those risks: risk assessment, service provider selection, contract provisions and review, and ongoing service provider monitoring. The guidance also includes an appendix that provides examples of considerations that may be relevant in such areas as diligence in selecting a service provider, contracting issues, and ongoing service provider monitoring.

Copies

Copies of the Guidance (SR 00-17) are available from our Corporate Services Department. To request copies of SR 00-17 to be sent by mail, please call (415) 974-2060. For a copy to be sent by fax, please call (415) 974-3333, and specify document number 4228.

All circulars and documents are available on the Internet through the Federal Reserve Bank of San Francisco's Internet site, at http://www.frbsf.org/banking/bsr/regletters/.

Additional Information

For additional information about the risks associated with technology outsourcing, please contact our Banking Supervision and Regulation Department, at (415) 974-2995.

FEDERAL RESERVE BANK OF SAN FRANCISCO