Vendor Compliance Management Series: Where To Start?

Vendor Compliance Management Series:
Where To Start?

What’s Changed?

There needs to be a full chain of custody as the CFPB expects you to “oversee their business relationships with service providers in a manner that ensures compliance with Federal consumer financial law….” For example, if you have “any person (i.e. service provider) that provides a material service to a covered person (i.e. you) in connection with the offering or provision by such covered person of a consumer financial product or service,” then you are responsible for their compliance to all relevant CFPB requirements. In essence, both parties are responsible for upholding the requirements of the CFPB.

For your vendor compliance management program to meet these requirements, it will need to include the following required components:

  • Due diligence in vendor selection and onboarding
  • Ongoing risk assessment
  • Contractual requirements
  • Audit plan
  • Monitoring
  • Termination
  • List of third parties to include a description of services performed
  • Third party contracts
  • Statement or Work or Service Level Agreements
  • Third parties’ SOC 1 reports, PCI RoC, etc.

To ensure that your vendor compliance management program incorporates these required components, you can begin by doing the following:

  • Conduct a risk assessment
  • Develop policies and procedures that define due diligence requirements according to risk ranking and services performed
  • Develop policies and procedures that define due diligence requirements according to risk ranking and services performed
  • Establish vendor compliance management policies, procedures, checklists, and templates

Download the full webinar to learn more about vendor compliance management. For more information about vendor compliance management or CFPB compliance, contact us today.