--- title: "Third-Party Risk Management for Debt Buyers and Collectors" canonical: "https://searchreceivables.com/blog/tprm-protocols-engineering-the-bank-grade-compliance-deck" date: "2025-12-15" lastUpdated: "2026-10-04" author: "Jeffery Hartman" categories: ["ARM Industry", "Search Receivables", "Accounts Receivables", "Portfolio Strategy", "Banks"] --- # Third-Party Risk Management for Debt Buyers and Collectors > Third-party risk management (TPRM) is a bank’s risk-based process for assessing, contracting with, and monitoring firms that support bank activities. For debt buyers, collection agencies, and service providers, the practical task is to provide evidence of controls that fits the work, data, consumer contact, and subcontractor risk. This guide separates current federal guidance from a one-size-fits-all compliance deck and identifies points that need legal review. Third-party risk management (TPRM) is the risk-based process a bank uses to assess, contract with, and oversee firms that perform activities for, through, or on its behalf. A debt buyer, collection agency, or service provider should be ready to explain its controls and produce evidence, but there is no universal “bank-grade deck” or guaranteed approval. The practical goal is to give a prospective bank enough reliable, current information to evaluate the particular relationship: the activity, customer impact, data access, consumer-contact practices, use of subcontractors, and the provider’s ability to keep operating through a disruption. The scope should match the risk; a small, low-risk service and a customer-facing collection operation should not receive the same review. ## What TPRM is—and is not TPRM is primarily the banking organization’s framework for managing third-party risk. The federal banking agencies state that using a third party does not reduce a banking organization’s responsibility to operate safely and soundly or comply with applicable law. Their final interagency guidance describes a lifecycle of planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination. See the [final interagency guidance in the Federal Register](https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management). For a prospective vendor or buyer, TPRM is therefore not a certification and not a promise that a bank will enter a forward-flow or other commercial arrangement. It is a reason to maintain accurate, well-organized evidence that lets the bank make its own risk-based decision. ## The current federal guidance matters Older materials often point to OCC Bulletin 2013-29. That bulletin was rescinded when the OCC issued [Bulletin 2023-17](https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html), which announced the 2023 interagency guidance. The guidance is final as of June 6, 2023 and is directed to banking organizations supervised by the OCC, Federal Reserve, and FDIC; it is guidance on sound risk-management principles, not a vendor checklist or a substitute for a contract or applicable law. There is also an important current-status qualification. On September 11, 2026, the FDIC, OCC, Federal Reserve, and NCUA issued a [proposed replacement third-party risk-management guidance](https://www.fdic.gov/news/financial-institution-letters/2026/proposed-interagency-third-party-risk-management-guidance). The agencies said any finalized guidance would replace the 2023 guidance. Organizations preparing diligence materials should confirm the proposal’s status and the supervising agency’s expectations before relying on this article for a live program. ## Build evidence around the relationship lifecycle The strongest preparation is not a stack of generic policies. It is a concise evidence set that maps to the work the provider will actually do and can be updated as the relationship changes. Risk-based evidence a prospective bank may evaluate Lifecycle stage Questions the provider should be able to answer Useful supporting material Planning What activity is being performed, for whom, with what customer impact and data access? Service description, process map, data-flow summary, responsible owners, and a clear inventory of subcontractors. Due diligence Can the provider perform the activity lawfully, securely, and reliably? Licensing or registration information where applicable; financial and operational information; relevant policies; training and quality controls; security and resilience evidence. Contracting Are responsibilities, information handling, reporting, audit access, remediation, and exit terms clear? Contract exhibits, service-level reporting examples, incident-escalation process, record-retention approach, and business-continuity commitments. Ongoing monitoring and exit How will material changes, complaints, control failures, breaches, and performance problems be identified and addressed? Periodic reporting, issue and remediation logs, test or assessment summaries, change notices, and an orderly transition or data-return plan. The 2023 guidance says due diligence should be tailored to the activity’s risk and complexity. It identifies, among other factors, legal and regulatory compliance, financial condition, risk management, information security, operational resilience, incident management, reliance on subcontractors, and insurance as potential considerations. It also says a bank should document limitations when it cannot obtain desired diligence information and consider controls, monitoring, or alternatives to address the gap. See the [interagency guidance’s due-diligence discussion](https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management). ## Make the review package specific, current, and proportionate A provider should not represent that every item below is legally required or that it will be requested in every review. Instead, use these materials to answer the real risks presented by the relationship. - Governance and accountability: identify the responsible executive, compliance owner, security contact, and the process for escalating material issues. - Operational capability: describe the service, staffing, quality assurance, training, technology, and measurable performance controls that support it. - Financial capacity: provide financial information appropriate to the relationship and explain any material developments that could affect service continuity. - Information security and privacy: explain what customer information is received or accessed, where it moves, who can access it, how it is protected, and how incidents are reported. - Resilience: provide business-continuity and disaster-recovery information that is relevant to the service, including the status of testing and material findings. - Compliance and customer treatment: describe applicable licensing, policies, training, call or correspondence controls when relevant, complaint handling, and corrective-action governance. - Third parties and affiliates: identify subcontractors or other parties that materially support the service and explain the oversight and contractual controls used for them. The FDIC’s [community-bank TPRM guide](https://www.fdic.gov/resources/bankers/third-party-relationships/third-party-risk-management-guide.pdf) is useful context: it presents illustrative, non-comprehensive diligence considerations such as financial and operational capability, information security, continuity, subcontractors, and a consumer-complaint program. That is a better model than presenting a fixed document list as a regulatory rule. ## Data security deserves its own evidence trail When a relationship gives a provider access to customer information, information security cannot be treated as a generic policy statement. For national banks and federal savings associations, the current interagency information-security standards require appropriate service-provider due diligence, contractual measures designed to meet the standards’ objectives, and risk-based monitoring. The standards expressly contemplate review of audits, test-result summaries, or equivalent evaluations. See [12 CFR Part 30, Appendix B](https://www.ecfr.gov/current/title-12/chapter-I/part-30/appendix-Appendix%20B%20to%20Part%2030). That rule is not a direct statement of every provider’s independent legal duty, and other institutions may be subject to different authorities. Still, a provider that handles customer data is better prepared when it can show its access controls, incident-notification path, retention and disposal practices, assessment results, and remediation process without overstating what any one report proves. ## Subcontractors are part of the risk picture The common label “fourth party” is useful shorthand, but it should not obscure the real question: which other entities help deliver the service or obtain access to data, systems, or consumers? The 2023 guidance expressly includes reliance on subcontractors among its due-diligence considerations and addresses subcontracting in contract negotiation. Maintain a current subcontractor inventory for the relationship. For each material subcontractor, document the service, data or system access, geographic or operational dependencies where relevant, diligence performed, contractual restrictions, incident escalation, and the provider’s monitoring and exit plan. A bank may assess that information differently depending on the relationship’s risk, so transparency is more useful than an unsupported assurance that all downstream risk has been eliminated. ## Use complaints as a control signal, not a slogan Complaint volume alone does not establish compliance or consumer harm. For a customer-facing third party, however, a usable program should preserve the complaint, identify the responsible activity, investigate it, record the outcome, and track recurring patterns and corrective actions. The FDIC’s [third-party-risk examination material](https://www.fdic.gov/consumer-compliance-examination-manual/vii-4-third-party-risk) lists, as contract and monitoring considerations, complaint responsibilities, copies of complaints and responses, periodic status and resolution reports, trend analysis, record retention, and follow-up on significant complaints. Root-cause analysis can be valuable when a pattern or material issue appears, but the federal interagency guidance does not impose a universal script, a fixed response time, or a rule that every complaint must receive the same investigation. The appropriate response depends on the facts, the contract, the activity, and applicable law. ## Collection-law controls remain separate from TPRM TPRM does not replace debt-collection law, state licensing requirements, contract obligations, or a consumer’s rights. Where an entity is a “debt collector” under the FDCPA, [Regulation F (12 CFR Part 1006)](https://www.consumerfinance.gov/rules-policy/regulations/1006/) sets federal rules on topics including collection communications, prohibited conduct, validation information, disputes, and record retention. Whether Regulation F, the FDCPA, state law, or a particular licensing rule applies to a debt buyer, agency, vendor, or account requires fact-specific legal analysis. For an operator, the practical connection is simple: the TPRM materials should accurately describe the collection controls that apply to the service, who owns each control, how issues are escalated, and how the organization checks that its actual practice matches its policy. Do not use a bank’s diligence request as a reason to make legal conclusions that have not been reviewed. ## A practical pre-review checklist - Define the exact service, consumer interaction, data access, and jurisdictions involved. - Assign one accountable owner for the response and verify that all statements are current. - Map material subcontractors, data flows, and continuity dependencies. - Separate completed evidence from gaps; explain a limitation and the compensating control rather than silently omitting it. - Confirm that policies, training, call or correspondence controls, reporting, and incident procedures match the service being evaluated. - Have qualified compliance, privacy, information-security, and legal personnel review the package where the activity or jurisdiction warrants it. ## Related reading - [Data privacy processes for debt buyers](/blog/data-privacy-protocols-navigating-glba-ccpa-liability-for-debt-buyers) - [Regulation F limited-content messages](/blog/the-stealth-protocol-engineering-the-reg-f-limited-content-message) ## Important limitation This article is general U.S. educational information, not legal advice and not a representation of any bank’s vendor-approval standards. Federal guidance, a pending proposal, the supervising agency, the account type, the parties’ roles, contract terms, and state law can all change the appropriate controls. Obtain qualified advice before using these materials to make a compliance determination or enter a bank relationship. --- *Original canonical URL: [https://searchreceivables.com/blog/tprm-protocols-engineering-the-bank-grade-compliance-deck](https://searchreceivables.com/blog/tprm-protocols-engineering-the-bank-grade-compliance-deck)*