The Office of the Comptroller of the Currency on Tuesday published updated standards for the use of independent consultants by banks.

The guidance describes the criteria used to determine whether it will require a national bank or federal savings association to retain a consultant, and the necessary due diligence to ensure that they have sufficient independence, capacity, resources, and expertise. Also covered is the process for reviewing qualifications and oversight of the consultant's performance. The use of an independent consultant does not absolve bank management or its board of directors of their responsibility for ensuring compliance with enforcement actions.

The OCC frequently requires banks to retain independent consultants. Among the reasons: assessing compliance with legal requirements; meeting obligations to provide restitution for violations of consumer protection statutes; addressing deficiencies with Bank Secrecy Act compliance programs and anti-money laundering laws and regulations, including reviews of risk assessments and internal controls; and performing forensic audits for irregularities in banks' books and records. Independent consultants are also brought in to review transaction activity, determine whether banks must file suspicious activity reports and whether SARs need to be corrected, amended, or expanded upon to meet regulatory requirements.

A bank has an obligation to conduct appropriate due diligence before using a consultant. In conducting due diligence, a bank should be guided by OCC Bulletin 2013-29, “Third-Party Relationships: Risk Management Guide.”

The bank's submission to the OCC for approval of the consultant under consideration should document its evaluation of their qualifications, independence, resources, expertise, capacity, reputation, information security and document custody practices, conflicts of interests, and financial viability. The bank should require the consultant to disclose any professional disciplinary actions. Any direct conflicts or facts that call into question the independent consultant's integrity will cause the OCC to disqualify the consultant. The bank's assessment of independence must address any existing and prior relationships with the bank, affiliates, or insiders.

The bank's assessments should also address, and the OCC will consider:

All prior work performed by the consultant for the bank for at least the previous three years.

The specialized expertise of the consultant and availability of other consultants.

Any financial interest between the bank and the proposed consultant.

All business or personal relationships of the consultant, or employees of the consultant, with a member of the board or an executive officer of the bank.

Other obligations include: maintaining complete records; making available, upon request, all work papers, analyses, drafts, and reports; bringing disagreements that cannot be resolved between the bank and consultant to the OCC's immediate attention; meeting ongoing reporting requirements; submitting material modifications to the contract, work plan, or staffing in writing to the agency; and submitting sub-contractors for approval.

The OCC will review the consultant's final written report to the bank's board of directors and management and assess whether all concerns were adequately addressed. The bank will then prepare a plan to address the findings. This plan, once approved by the bank's board of directors, is subject to OCC review and approval before it can be implemented.

Topics