Records a bank needs from its third parties to resolve customer disputes

OCC, Federal Reserve Board, FDIC and NCUA · Policy submission ·

Concerns the records a bank needs from its third parties to resolve customer disputes. Proposes that the agencies name record dependence as a characteristic that can make a relationship higher risk: the bank relies on a third party for records it needs to meet a legal obligation to its customers, and has no copy, and no contractual right of access, that would survive the third party’s exit or failure. Proposes one sentence each for sections B.1.iii, B.2.iii, B.2.iv and B.2.v, in the guidance’s own permissive language.

Read the comment (PDF, 6 pages)

The document

Title
When a third party holds the bank’s evidence
Proposal
Proposed Third-Party Risk Management Guidance, 91 Fed. Reg. 58536, 15 September 2026
Dockets
OCC, Docket ID OCC-2026-0793
Federal Reserve Board, Docket No. OP-1881
FDIC, ZRIN 3064-ZA58
NCUA, Docket No. NCUA-2026-1684
Responds to
The invitation to comment on all aspects; the questions in footnotes 9 and 15; sections B.1.iii, B.2.iii, B.2.iv and B.2.v
Capacity
Personal capacity. As founder of True Primary, he declares its commercial interest in the safe adoption of agentic payments (paragraph 16)
Submitted
, by email to the Federal Reserve Board and the FDIC, and on regulations.gov to the OCC and the NCUA
Length
6 pages, numbered paragraphs 1 to 16
Confidentiality
None. “No part is confidential. It may be published in full, with my name.”
Agency copies
Posted by each agency after review

The four proposals

  1. Name record dependence as a higher-risk characteristic. In answer to footnote 15: a relationship can be higher risk where the bank relies on the third party for records needed to meet legal obligations to customers, with no copy or right of access that would survive the third party’s exit or failure. The Board, FDIC and OCC named this risk in their 2024 joint statement on bank-fintech arrangements, which the final guidance would replace.
  2. Complaints review that reaches the records. Under section B.2.iii, a review of customer complaints can include confirming that the bank can obtain and use the records behind them.
  3. Retention that covers transactions made before termination. Under section B.2.iv, data retention can extend to records of earlier transactions for as long as disputes and record duties about them can arise. Under operational resilience, those records can count as critical data.
  4. Indemnities judged with the evidence they need. Under section B.2.v, whether an indemnity mitigates risk can also depend on whether the bank can obtain the records that establish a claim, including in a dispute with the third party and after termination.

Each proposal is one sentence in the guidance’s own permissive language. If the agencies add one sentence only, the first carries the point. The other three show where it applies, and could sit in the explanation that accompanies the final guidance in place of its text.

The proposed text

Footnote 15 list, or section B.1.iii
“A third-party relationship may present higher risk where the banking organization relies on the third party for records needed to meet legal obligations to customers, such as resolving disputes in time, without copies or access that would survive the third party’s exit or failure.”
Section B.2.iii, after example (5)
“Where a third party holds records the banking organization needs to resolve customer complaints, reviews may include confirming that those records can be obtained and used within the time the banking organization’s obligations allow.”
Section B.2.iv
“Data retention considerations may include continued access to records of transactions completed before termination, for as long as the banking organization may need them to resolve disputes or meet recordkeeping obligations.”
Section B.2.v
“That conclusion may also depend on whether the banking organization can obtain the records needed to establish a claim, including during a dispute with the third party and after termination.”

Record dependence

Record dependence: the bank relies on a third party for records it needs to meet a legal obligation to its customers, and has no copy, and no contractual right of access, that would survive the third party’s exit or failure. A service with record dependence can run without interruption while the bank loses the means to explain, to a customer or an examiner, what the service did.

Three of the four agencies named this risk in 2024. The 2024 joint statement of the Board, FDIC and OCC on banks’ arrangements with third parties to deliver deposit products listed “Lack of access to records” among the risks of those arrangements, because it “can impair the bank’s ability to determine its deposit obligations”. The final guidance would replace that statement, with the rest of the supplemental resources.

The case it puts

Consider a hypothetical bank that offers consumer deposit accounts through a fintech platform. The platform keeps the instruction records and submits customers’ ACH payments for the bank. A consumer authorises one payment of $40 to a merchant. The platform misses the acknowledgement of the first attempt and submits an automatic retry as a second payment. The consumer sees two debits and reports the second as an error in writing.

Under Regulation E, the bank must determine whether an error occurred within 10 business days of the notice. If it cannot finish in that time, it may take up to 45 days on the conditions in 12 CFR 1005.11(c)(2). New accounts and some other transfers have longer periods. The record that links the retry to the first attempt sits with the platform, and the bank’s answer depends on the platform’s delivery.

In the $40 case, the platform can close the complaint after finding two successful payment messages. Whether those messages carry one authorisation or two is the question the customer raised, and a closure rate leaves it unanswered.

What it does not ask for

The proposed sentences describe considerations a bank may weigh. They name no contract term a bank is expected to hold. A bank that can already obtain and use the records in time, even after exit or failure, needs no new access terms.

Sources